Unifying Gradients to Improve Real-world Robustness for Deep Networks
Not on the map. Why?
Abstract (arXiv)
The wide application of deep neural networks (DNNs) demands an increasing amount of attention to their real-world robustness, i.e., whether a DNN resists black-box adversarial attacks, among which score-based query attacks (SQAs) are most threatening since they can effectively hurt a victim network with the only access to model outputs. Defending against SQAs requires a slight but artful variation of outputs due to the service purpose for users, who share the same output information with SQAs. In this paper, we propose a real-world defense by Unifying Gradients (UniG) of different data so that SQAs could only probe a much weaker attack direction that is similar for different samples. Since such universal attack perturbations have been validated as less aggressive than the input-specific perturbations, UniG protects real-world DNNs by indicating attackers a twisted and less informative attack direction. We implement UniG efficiently by a Hadamard product module which is plug-and-play. According to extensive experiments on 5 SQAs, 2 adaptive attacks and 7 defense baselines, UniG significantly improves real-world robustness without hurting clean accuracy on CIFAR10 and ImageNet. For instance, UniG maintains a model of 77.80% accuracy under 2500-query Square attack while the state-of-the-art adversarially-trained model only has 67.34% on CIFAR10. Simultaneously, UniG outperforms all compared baselines in terms of clean accuracy and achieves the smallest modification of the model output. The code is released at https://github.com/snowien/UniG-pytorch.
Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Builds on 55 of its 69 references that are in the map. First posted on arXiv 12 Aug 2022.
Builds on
55 of 69 references.
References · 55
- 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,305
- 2014Explaining and Harnessing Adversarial Examplescited by 7,364
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
- 2013Intriguing properties of neural networkscited by 5,155
- 2016Wide Residual Networkscited by 3,070
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
- 2016Identity Mappings in Deep Residual Networkscited by 1,965
- 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
- 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
- 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
- 2016End to End Learning for Self-Driving Carscited by 1,009
- 2016Practical Black-Box Attacks against Machine Learningcited by 903
38 more
- 2018Robustness May Be at Odds with Accuracycited by 880
- 2017Ensemble Adversarial Training: Attacks and Defensescited by 840
- 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 685
- 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 666
- 2020RobustBench: a standardized adversarial robustness benchmarkcited by 661
- 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 501
- 2022Diffusion Models for Adversarial Purificationcited by 476
- 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 468
- 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 462
- 2017Mitigating Adversarial Effects Through Randomizationcited by 383
- 2014Deep Speech: Scaling up end-to-end speech recognitioncited by 354
- 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 333
- 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 330
- 2020Do Adversarially Robust ImageNet Models Transfer Better?cited by 316
- 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 292
- 2019Adversarial Examples Improve Image Recognitioncited by 286
- 2019Simple Black-box Adversarial Attackscited by 251
- 2021Improving Robustness using Generated Datacited by 234
- 2017Towards Robust Neural Networks via Random Self-ensemblecited by 159
- 2018Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priorscited by 146
- 2019Adversarial Training Can Hurt Generalizationcited by 132
- 2018Query-Efficient Hard-label Black-box Attack:An Optimization-based Approachcited by 130
- 2018Parametric Noise Injection: Trainable Randomness to Improve Deep Neural Network Robustness against Adversarial Attackcited by 125
- 2019Improving Black-box Adversarial Attacks with a Transfer-based Priorcited by 121
- 2020MAZE: Data-Free Model Stealing Attack Using Zeroth-Order Gradient Estimationcited by 99
- 2018Adv-BNN: Improved Adversarial Defense through Robust Bayesian Neural Networkcited by 69
- 2021A Survey On Universal Adversarial Attackcited by 59
- 2019Black-Box Adversarial Attack with Transferable Model-based Embeddingcited by 57
- 2019Stateful Detection of Black-Box Adversarial Attackscited by 56
- 2019Mixup Inference: Better Exploiting Mixup to Defend Adversarial Attackscited by 54
- 2021Random Noise Defense Against Query-Based Black-Box Attackscited by 47
- 2020Universal Adversarial Attack on Attention and the Resulting Dataset DAmageNetcited by 45
- 2021Subspace Adversarial Trainingcited by 41
- 2019Theoretical evidence for adversarial robustness through randomizationcited by 33
- 2020CD-UAP: Class Discriminative Universal Adversarial Perturbationcited by 27
- 2021Combating Adversaries with Anti-Adversariescited by 27
- 2020Double Targeted Universal Adversarial Perturbationscited by 23
- 2021Fighting Gradients with Gradients: Dynamic Defenses against Adversarial Attackscited by 20
50 most cited of 55 All 55 (JSON)
Built on by
Citing papers per year: 2023: 1.
1 paper.