How Sampling Impacts the Robustness of Stochastic Neural Networks
Not on the map. Why?
Abstract (arXiv)
Stochastic neural networks (SNNs) are random functions whose predictions are gained by averaging over multiple realizations. Consequently, a gradient-based adversarial example is calculated based on one set of samples and its classification on another set. In this paper, we derive a sufficient condition for such a stochastic prediction to be robust against a given sample-based attack. This allows us to identify the factors that lead to an increased robustness of SNNs and gives theoretical explanations for: (i) the well known observation, that increasing the amount of samples drawn for the estimation of adversarial examples increases the attack's strength, (ii) why increasing the number of samples during an attack can not fully reduce the effect of stochasticity, (iii) why the sample size during inference does not influence the robustness, and (iv) why a higher gradient variance and a shorter expected value of the gradient relates to a higher robustness. Our theoretical findings give a unified view on the mechanisms underlying previously proposed approaches for increasing attack strengths or model robustness and are verified by an extensive empirical analysis.
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 44 of its 74 references that are in the map. First posted on arXiv 22 Apr 2022.
Builds on
44 of 74 references.
References · 44
- 2014Adam: A Method for Stochastic Optimizationcited by 36,960
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2013Intriguing properties of neural networkscited by 5,114
- 2015Dropout as a Bayesian Approximation: Representing Model Uncertainty in Deep Learningcited by 4,416
- 2017Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithmscited by 4,283
- 2016Wide Residual Networkscited by 3,057
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
- 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
- 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
- 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
- 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
32 more
- 2017Reluplex: An Efficient SMT Solver for Verifying Deep Neural Networkscited by 739
- 2017Evasion Attacks against Machine Learning at Test Timecited by 686
- 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 675
- 2014Convex Optimization: Algorithms and Complexitycited by 569
- 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
- 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 542
- 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
- 2018Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Surveycited by 459
- 2017Mitigating Adversarial Effects Through Randomizationcited by 382
- 2021Laplace Redux -- Effortless Bayesian Deep Learningcited by 359
- 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
- 2020Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examplescited by 275
- 2017Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradientscited by 236
- 2018Adversarial Risk and the Dangers of Evaluating Against Weak Attackscited by 221
- 2017Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulationcited by 182
- 2018Stochastic Activation Pruning for Robust Adversarial Defensecited by 171
- 2017Towards Robust Neural Networks via Random Self-ensemblecited by 158
- 2016Technical Report on the CleverHans v2.1.0 Adversarial Examples Librarycited by 123
- 2018Parametric Noise Injection: Trainable Randomness to Improve Deep Neural Network Robustness against Adversarial Attackcited by 123
- 2016Structured and Efficient Variational Deep Learning with Matrix Gaussian Posteriorscited by 82
- 2018Provable Robustness of ReLU networks via Maximization of Linear Regionscited by 51
- 2020Robustness of Bayesian Neural Networks to Gradient-Based Attackscited by 48
- 2020Probabilistic Safety for Bayesian Neural Networkscited by 41
- 2021On the Certified Robustness for Ensemble Models and Beyondcited by 40
- 2019Provable robustness against all adversarial lp-perturbations for p≥ 1cited by 39
- 2021GradDiv: Adversarial Robustness of Randomized Neural Networks via Gradient Diversity Regularizationcited by 34
- 2019Theoretical evidence for adversarial robustness through randomizationcited by 33
- 2020Learn2Perturb: an End-to-end Feature Perturbation Learning to Improve Adversarial Robustnesscited by 27
- 2021Bayesian Inference with Certifiable Adversarial Robustnesscited by 26
- 2020Weight-Covariance Alignment for Adversarially Robust Neural Networkscited by 9
- 2020Defense Through Diverse Directionscited by 2
- 2020Investigating maximum likelihood based training of infinite mixtures for uncertainty quantificationcited by 1
Built on by
Citing papers per year: 2023: 1.
1 paper.