mlsanityData to 14 Oct 2026

Towards Deep Learning Models Resistant to Transfer-based Adversarial Attacks via Data-centric Robust Learning

arXiv 2310.09891 ↗First posted 15 Oct 2023cs.CR cs.LGcited by 2

Not on the map. Why?

Abstract (arXiv)

Transfer-based adversarial attacks raise a severe threat to real-world deep learning systems since they do not require access to target models. Adversarial training (AT), which is recognized as the strongest defense against white-box attacks, has also guaranteed high robustness to (black-box) transfer-based attacks. However, AT suffers from heavy computational overhead since it optimizes the adversarial examples during the whole training process. In this paper, we demonstrate that such heavy optimization is not necessary for AT against transfer-based attacks. Instead, a one-shot adversarial augmentation prior to training is sufficient, and we name this new defense paradigm Data-centric Robust Learning (DRL). Our experimental results show that DRL outperforms widely-used AT techniques (e.g., PGD-AT, TRADES, EAT, and FAT) in terms of black-box robustness and even surpasses the top-1 defense on RobustBench when combined with diverse data augmentations and loss regularizations. We also identify other benefits of DRL, for instance, the model generalization capability and robust fairness.

Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Builds on 38 of its 44 references that are in the map. First posted on arXiv 15 Oct 2023.

Builds on

38 of 44 references.

References · 38

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 9,122
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  5. 2013Intriguing properties of neural networkscited by 5,155
  6. 2016Wide Residual Networkscited by 3,070
  7. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  8. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
  9. 2016Practical Black-Box Attacks against Machine Learningcited by 903
  10. 2019AugMix: A Simple Data Processing Method to Improve Robustness and Uncertaintycited by 901
  11. 2017Ensemble Adversarial Training: Attacks and Defensescited by 840
  12. 2020Fast is better than free: Revisiting adversarial trainingcited by 727
26 more
  1. 2017Evasion Attacks against Machine Learning at Test Timecited by 689
  2. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 685
  3. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 666
  4. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 661
  5. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 599
  6. 2022Diffusion Models for Adversarial Purificationcited by 476
  7. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 442
  8. 2023Better Diffusion Models Further Improve Adversarial Trainingcited by 208
  9. 2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 204
  10. 2023Data-centric Artificial Intelligence: A Surveycited by 203
  11. 2018Understanding Measures of Uncertainty for Adversarial Example Detectioncited by 177
  12. 2020To be Robust or to be Fair: Towards Fairness in Adversarial Trainingcited by 137
  13. 2021Feature Importance-aware Transferable Adversarial Attackscited by 127
  14. 2021AugMax: Adversarial Composition of Random Augmentations for Robust Trainingcited by 90
  15. 2021Random Noise Defense Against Query-Based Black-Box Attackscited by 47
  16. 2020Blacklight: Scalable Defense for Neural Networks against Query-Based Black-Box Attackscited by 37
  17. 2022Towards Understanding and Boosting Adversarial Transferability from a Distribution Perspectivecited by 37
  18. 2023Making Substitute Models More Bayesian Can Enhance Transferability of Adversarial Examplescited by 32
  19. 2022Adversarial Attack on Attackers: Post-Process to Mitigate Black-Box Score-Based Query Attackscited by 19
  20. 2022Toward Learning Robust and Invariant Representations with Alignment Regularization and Data Augmentationcited by 11
  21. 2023Reinforce Data, Multiply Impact: Improved Model Accuracy and Robustness with Dataset Reinforcementcited by 11
  22. 2021Revisiting Model's Uncertainty and Confidences for Adversarial Example Detectioncited by 9
  23. 2019Minimum Uncertainty Based Detection of Adversaries in Deep Neural Networkscited by 8
  24. 2018Generalizable Adversarial Examples Detection Based on Bi-model Decision Mismatchcited by 7
  25. 2022General Adversarial Defense Against Black-box Attacks via Pixel Level and Feature Level Distribution Alignmentscited by 4
  26. 2022Data-free Defense of Black Box Models Against Adversarial Attackscited by 2

Built on by

Cited by year

Citing papers per year: 2024: 2.

2 papers.

  1. 2024Deep Networks Always Grok and Here is Whycited by 51
  2. 2024Graph Adversarial Diffusion Convolutioncited by 0