mlsanityData to 14 Oct 2026

Blending adversarial training and representation-conditional purification via aggregation improves adversarial robustness

arXiv 2306.06081 ↗First posted 25 May 2023cs.CV cs.AI cs.CRcited by 0

Not on the map. Why?

Abstract (arXiv)

In this work, we propose a novel adversarial defence mechanism for image classification - CARSO - blending the paradigms of adversarial training and adversarial purification in a synergistic robustness-enhancing way. The method builds upon an adversarially-trained classifier, and learns to map its internal representation associated with a potentially perturbed input onto a distribution of tentative clean reconstructions. Multiple samples from such distribution are classified by the same adversarially-trained model, and a carefully chosen aggregation of its outputs finally constitutes the robust prediction of interest. Experimental evaluation by a well-established benchmark of strong adaptive attacks, across different image datasets, shows that CARSO is able to defend itself against adaptive end-to-end white-box attacks devised for stochastic defences. Paying a modest clean accuracy toll, our method improves by a significant margin the state-of-the-art for Cifar-10, Cifar-100, and TinyImageNet-200 ℓ_∞ robust classification accuracy against AutoAttack. Code, and instructions to obtain pre-trained models are available at: https://github.com/emaballarin/CARSO .

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 52 of its 74 references that are in the map. First posted on arXiv 25 May 2023.

Builds on

52 of 74 references.

References · 52

  1. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,305
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  4. 2013Intriguing properties of neural networkscited by 5,155
  5. 2017Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithmscited by 4,349
  6. 2016Adversarial examples in the physical worldcited by 1,769
  7. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
  8. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
  9. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,318
  10. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
  11. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 953
  12. 2015Automatic differentiation in machine learning: a surveycited by 855
38 more
  1. 2017Ensemble Adversarial Training: Attacks and Defensescited by 840
  2. 2019On the Variance of the Adaptive Learning Rate and Beyondcited by 772
  3. 2017Evasion Attacks against Machine Learning at Test Timecited by 689
  4. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 685
  5. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 661
  6. 2015Cyclical Learning Rates for Training Neural Networkscited by 629
  7. 2020On Adaptive Attacks to Adversarial Example Defensescited by 555
  8. 2022Diffusion Models for Adversarial Purificationcited by 476
  9. 2019On Evaluating Adversarial Robustnesscited by 447
  10. 2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 414
  11. 2017A Downsampled Variant of ImageNet as an Alternative to the CIFAR datasetscited by 377
  12. 2021MEMO: Test Time Robustness via Adaptation and Augmentationcited by 377
  13. 2018Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Modelscited by 362
  14. 2019Lookahead Optimizer: k steps forward, 1 step backcited by 336
  15. 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 334
  16. 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
  17. 2017Parseval Networks: Improving Robustness to Adversarial Examplescited by 293
  18. 2020Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examplescited by 278
  19. 2021Improving Robustness using Generated Datacited by 234
  20. 2021Data Augmentation Can Improve Robustnesscited by 194
  21. 2019Adversarial Training and Robustness for Multiple Perturbationscited by 183
  22. 2021A Variational Perspective on Diffusion-Based Generative Models and Score Matchingcited by 183
  23. 2014Towards Deep Neural Network Architectures Robust to Adversarial Examplescited by 146
  24. 2020Perceptual Adversarial Robustness: Defense Against Unseen Threat Modelscited by 137
  25. 2021Adversarial purification with Score-based generative modelscited by 134
  26. 2019Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech Recognitioncited by 124
  27. 2022LAS-AT: Adversarial Training with Learnable Attack Strategycited by 95
  28. 2015Attribute2Image: Conditional Image Generation from Visual Attributescited by 93
  29. 2023Revisiting Adversarial Training for ImageNet: Architectures, Training and Generalization across Threat Modelscited by 79
  30. 2023Robust Classification via a Single Diffusion Modelcited by 79
  31. 2019advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorchcited by 69
  32. 2023Robust Evaluation of Diffusion-Based Adversarial Purificationcited by 65
  33. 2020Stochastic Security: Adversarial Defense Using Long-Run Dynamics of Energy-Based Modelscited by 58
  34. 2020Robustness of Bayesian Neural Networks to Gradient-Based Attackscited by 48
  35. 2021Online Adversarial Purification based on Self-Supervisioncited by 46
  36. 2019Imperceptible Adversarial Attacks on Tabular Datacited by 35
  37. 2019PuVAE: A Variational Autoencoder to Purify Adversarial Examplescited by 28
  38. 2023Improving the Accuracy-Robustness Trade-Off of Classifiers via Adaptive Smoothingcited by 18

50 most cited of 52 All 52 (JSON)

Built on by

Not cited yet.