Despite their unmatched performance, deep neural networks remain susceptible to targeted attacks by nearly imperceptible levels of adversarial noise. While the underlying cause of this sensitivity is not well understood, theoretical analyses can be simplified by reframing each layer of a feed-forward network as an approximate solution to a sparse coding problem. Iterative solutions using basis pursuit are theoretically more stable and have improved adversarial robustness. However, cascading layer-wise pursuit implementations suffer from error accumulation in deeper networks. In contrast, our new method of deep pursuit approximates the activations of all layers as a single global optimization problem, allowing us to consider deeper, real-world architectures with skip connections such as residual networks. Experimentally, our approach demonstrates improved robustness to adversarial noise.
School of Computing and Information Systems, The University of Melbourne（墨尔本大学计算与信息系统学院）；Key Lab. of Machine Perception, School of Artificial Intelligence, Peking University（北京大学人工智能学院机器感知重点实验室）；Institute for Artificial Intelligence, Peking University（北京大学人工智能研究院）；University of California, Los Angeles（加州大学洛杉矶分校）；School of Computer Science, Fudan University（复旦大学计算机科学学院）
Deep neural networks (DNNs) are known to be vulnerable to adversarial attacks. A range of defense methods have been proposed to train adversarially robust DNNs, among which adversarial training has demonstrated promising results. However, despite preliminary understandings developed for adversarial training, it is still not clear, from the architectural perspective, what configurations can lead to more robust DNNs. In this paper, we address this gap via a comprehensive investigation on the impact of network width and depth on the robustness of adversarially trained DNNs. Specifically, we make …
Adversarial attacks in the form of imperceptible perturbations of normal images have been extensively studied, and for every new defense methodology created, multiple adversarial attacks are found to counteract it. In particular, a popular style of attack, exemplified in recent years by DeepFool and Carlini-Wagner, relies solely on white-box scenarios in which full access to the predictive model and its weights are required. In this work, we instead propose distinct model-agnostic benchmark perturbations of images in order to investigate the resilience and robustness of different network archi…
Michigan State University（密歇根州立大学）；Sun Yat-sen University（中山大学）
Efforts to improve the adversarial robustness of convolutional neural networks have primarily focused on developing more effective adversarial training methods. In contrast, little attention was devoted to analyzing the role of architectural elements (such as topology, depth, and width) on adversarial robustness. This paper seeks to bridge this gap and present a holistic study on the impact of architectural design on adversarial robustness. We focus on residual networks and consider architecture design at the block level, i.e., topology, kernel size, activation, and normalization, as well as a…
ELTE Eötvös Loránd University（厄特沃什·罗兰大学）；AImotive Inc.（AImotive公司）
While deep neural networks are sensitive to adversarial noise, sparse coding using the Basis Pursuit (BP) method is robust against such attacks, including its multi-layer extensions. We prove that the stability theorem of BP holds upon the following generalizations: (i) the regularization procedure can be separated into disjoint groups with different weights, (ii) neurons or full layers may form groups, and (iii) the regularizer takes various generalized forms of the $\ell_1$ norm. This result provides the proof for the architectural generalizations of Cazenavette et al. (2021), including (iv)…
Peking University（北京大学）；The University of Tokyo（东京大学）
Vision Transformers (ViTs) have recently achieved competitive performance in broad vision tasks. Unfortunately, on popular threat models, naturally trained ViTs are shown to provide no more adversarial robustness than convolutional neural networks (CNNs). Adversarial training is still required for ViTs to defend against such adversarial attacks. In this paper, we provide the first and comprehensive study on the adversarial training recipe of ViTs via extensive evaluation of various training techniques across benchmark datasets. We find that pre-training and SGD optimizer are necessary for ViTs…
Stanford University（斯坦福大学）；Technion - Israel Institute of Technology（以色列理工学院）；Johns Hopkins University（约翰斯·霍普金斯大学）
Despite their impressive performance, deep convolutional neural networks (CNNs) have been shown to be sensitive to small adversarial perturbations. These nuisances, which one can barely notice, are powerful enough to fool sophisticated and well performing classifiers, leading to ridiculous misclassification results. In this paper we analyze the stability of state-of-the-art deep-learning classification machines to adversarial perturbations, where we assume that the signals belong to the (possibly multi-layer) sparse representation model. We start with convolutional sparsity and then proceed to…
Convolutional neural networks (CNNs) are known for their good performance and generalization in vision-related tasks and have become state-of-the-art in both application and research-based domains. However, just like other neural network models, they suffer from a susceptibility to noise and adversarial attacks. An adversarial defence aims at reducing a neural network's susceptibility to adversarial attacks through learning or architectural modifications. We propose the weight map layer (WM) as a generic architectural addition to CNNs and show that it can increase their robustness to noise and…
SenseTime（商汤科技）；Zhongguancun Laboratory（中关村实验室）；Hefei Comprehensive National Science Center（合肥综合性国家科学中心）；JD Explore Academy（京东探索研究院）；Beihang University（北京航空航天大学）；Chinese Academy of Sciences（中国科学院）；Zhejiang University（浙江大学）
Adversarial training has been demonstrated to be one of the most effective remedies for defending adversarial examples, yet it often suffers from the huge robustness generalization gap on unseen testing adversaries, deemed as the adversarially robust generalization problem. Despite the preliminary understandings devoted to adversarially robust generalization, little is known from the architectural perspective. To bridge the gap, this paper for the first time systematically investigated the relationship between adversarially robust generalization and architectural design. Inparticular, we compr…
The pursuit of explaining and improving generalization in deep learning has elicited efforts both in regularization techniques as well as visualization techniques of the loss surface geometry. The latter is related to the intuition prevalent in the community that flatter local optima leads to lower generalization error. In this paper, we harness the state-of-the-art "filter normalization" technique of loss-surface visualization to qualitatively understand the consequences of using adversarial training data augmentation as the explicit regularization technique of choice. Much to our surprise, w…
In recent years novel architecture components for image classification have been developed, starting with attention and patches used in transformers. While prior works have analyzed the influence of some aspects of architecture components on the robustness to adversarial attacks, in particular for vision transformers, the understanding of the main factors is still limited. We compare several (non)-robust classifiers with different architectures and study their properties, including the effect of adversarial training on the interpretability of the learnt features and robustness to unseen threat…
Most state-of-the-art machine learning (ML) classification systems are vulnerable to adversarial perturbations. As a consequence, adversarial robustness poses a significant challenge for the deployment of ML-based systems in safety- and security-critical environments like autonomous driving, disease detection or unmanned aerial vehicles. In the past years we have seen an impressive amount of publications presenting more and more new adversarial attacks. However, the attack research seems to be rather unstructured and new attacks often appear to be random selections from the unlimited set of po…
University of Central Florida（中佛罗里达大学）；JD AI Research（京东AI研究院）；Tencent AI Lab（腾讯AI实验室）
Recent studies have shown that deep neural networks (DNNs) are vulnerable to adversarial attacks. To this end, many defense approaches that attempt to improve the robustness of DNNs have been proposed. In a separate and yet related area, recent works have explored to quantize neural network weights and activation functions into low bit-width to compress model size and reduce computational complexity. In this work, we find that these two different tracks, namely the pursuit of network compactness and robustness, can be merged into one and give rise to networks of both advantages. To the best of…
With the widespread use of machine learning, concerns over its security and reliability have become prevalent. As such, many have developed defenses to harden neural networks against adversarial examples, imperceptibly perturbed inputs that are reliably misclassified. Adversarial training in which adversarial examples are generated and used during training is one of the few known defenses able to reliably withstand such attacks against neural networks. However, adversarial training imposes a significant training overhead and scales poorly with model complexity and input dimension. In this pape…
We propose to utilize gradients for detecting adversarial and out-of-distribution samples. We introduce confounding labels -- labels that differ from normal labels seen during training -- in gradient generation to probe the effective expressivity of neural networks. Gradients depict the amount of change required for a model to properly represent given inputs, providing insight into the representational power of the model established by network architectural properties as well as training data. By introducing a label of different design, we remove the dependency on ground truth labels for gradi…
Army Military Transportation University（陆军军事交通学院）；Army Engineering University（陆军工程大学）
Deep neural networks are vulnerable to adversarial examples, which can fool deep models by adding subtle perturbations. Although existing attacks have achieved promising results, it still leaves a long way to go for generating transferable adversarial examples under the black-box setting. To this end, this paper proposes to improve the transferability of adversarial examples, and applies dual-stage feature-level perturbations to an existing model to implicitly create a set of diverse models. Then these models are fused by the longitudinal ensemble during the iterations. The proposed method is …
A No-Defense Defense Against Gradient-Based Adversarial Attacks on ML-NIDS: Is Less More?
Carleton University（卡尔顿大学）；Computer Engineering Carleton University Ottawa, Canada（计算机工程系卡尔顿大学渥太华加拿大）；School of Information Technology Carleton University Ottawa, Canada（信息科技学院卡尔顿大学渥太华加拿大）
It is commonly believed that networks cannot be both accurate and robust, that gaining robustness means losing accuracy. It is also generally believed that, unless making networks larger, network architectural elements would otherwise matter little in improving adversarial robustness. Here we present evidence to challenge these common beliefs by a careful study about adversarial training. Our key observation is that the widely-used ReLU activation function significantly weakens adversarial training due to its non-smooth nature. Hence we propose smooth adversarial training (SAT), in which we re…
The Chinese University of Hong Kong（香港中文大学）；MIT CSAIL（麻省理工学院计算机科学与人工智能实验室）
Recent advances in adversarial attacks uncover the intrinsic vulnerability of modern deep neural networks. Since then, extensive efforts have been devoted to enhancing the robustness of deep networks via specialized learning algorithms and loss functions. In this work, we take an architectural perspective and investigate the patterns of network architectures that are resilient to adversarial attacks. To obtain the large number of networks needed for this study, we adopt one-shot neural architecture search, training a large network for once and then finetuning the sub-networks sampled therefrom…
Imitation Game for Adversarial Disillusion with Chain-of-Thought Reasoning in Generative AI
Information and Society Research Division, National Institute of Informatics（信息与社会研究部，国立信息研究所）；Department of Information Engineering and Computer Science, Feng Chia University（信息工程与计算机科学系，逢甲大学）
Institute Intelligence and Data (IID), Université Laval（拉瓦尔大学智能与数据研究所（IID））；Mila（米拉研究所）
Neural network ensembles have been studied extensively in the context of adversarial robustness and most ensemble-based approaches remain vulnerable to adaptive attacks. In this paper, we investigate the robustness of Error-Correcting Output Codes (ECOC) ensembles through architectural improvements and ensemble diversity promotion. We perform a comprehensive robustness assessment against adaptive attacks and investigate the relationship between ensemble diversity and robustness. Our results demonstrate the benefits of ECOC ensembles for adversarial robustness compared to regular ensembles of c…
We extend the adversarial/non-stochastic multi-play multi-armed bandit (MPMAB) to the case where the number of arms to play is variable. The work is motivated by the fact that the resources allocated to scan different critical locations in an interconnected transportation system change dynamically over time and depending on the environment. By modeling the malicious hacker and the intrusion monitoring system as the attacker and the defender, respectively, we formulate the problem for the two players as a sequential pursuit-evasion game. We derive the condition under which a Nash equilibrium of…
University of Michigan（密歇根大学）；University of California, Irvine（加利福尼亚大学尔湾分校）
3D point clouds play pivotal roles in various safety-critical applications, such as autonomous driving, which desires the underlying deep neural networks to be robust to adversarial perturbations. Though a few defenses against adversarial point cloud classification have been proposed, it remains unknown whether they are truly robust to adaptive attacks. To this end, we perform the first security analysis of state-of-the-art defenses and design adaptive evaluations on them. Our 100% adaptive attack success rates show that current countermeasures are still vulnerable. Since adversarial training …
Neither Adversarial Training Nor Purification: Emergent Adversarial Robustness from Oscillatory Predictive Learning
Ecole polytechnique（巴黎综合理工学院）；Ecole Nationale des Ponts et Chaussées（巴黎国立路桥学校）；Mohamed bin Zayed University of Artificial Intelligence（穆罕默德·本·扎耶德人工智能大学）；Okinawa Institute of Science and Technology（冲绳科学技术大学院大学）
Watertox: The Art of Simplicity in Universal Attacks A Cross-Model Framework for Robust Adversarial Generation
School of Artificial Intelligence and Automation, Huazhong University of Science and Technology（华中科技大学人工智能与自动化学院）；School of Software Engineering, Huazhong University of Science and Technology（华中科技大学软件学院）；Journalism and Information Communication School, Huazhong University of Science and Technology（华中科技大学新闻与信息传播学院）；School of Integrated Circuit, Huazhong University of Science and Technology（华中科技大学集成电路学院）
Pathfinding makes up an important sub-component of a broad range of complex tasks in AI, such as robot path planning, transport routing, and game playing. While classical algorithms can efficiently compute shortest paths, neural networks could be better suited to adapting these sub-routines to more complex and intractable tasks. As a step toward developing such networks, we hand-code and learn models for Breadth-First Search (BFS), i.e. shortest path finding, using the unified architectural framework of Neural Cellular Automata, which are iterative neural networks with equal-size inputs and ou…
Failure Cases Are Better Learned But Boundary Says Sorry: Facilitating Smooth Perception Change for Accuracy-Robustness Trade-Off in Adversarial Training
The Hong Kong University of Science and Technology (Guangzhou)（香港科学与技术大学（广州））
Vision Transformer with Adversarial Indicator Token against Adversarial Attacks in Radio Signal Classifications
School of Mathematics and Computer Science, Swansea university（斯旺西大学数学与计算机科学学院）；Institute for Digital Technologies, Loughborough University London（伦敦洛桑大学数字技术研究所）；School of Engineering, University of Warwick（沃里克大学工程学院）；School of Electronic Engineering, Xidian University（西安电子科技大学电子工程学院）；Department of Electrical and Electronic Engineering, Faculty of Engineering, Imperial College London（伦敦帝国理工学院电子与电气工程系）；Department of Informatics, Bioengineering Robotics, and Systems Engineering, University of Genova（热那亚大学信息学、生物工程机器人与系统工程系）；Warwick Manufacturing Group, University of Warwick（沃里克大学沃里克制造集团）
Bridging Symmetry and Robustness: On the Role of Equivariance in Enhancing Adversarial Robustness
AI Research Lab, Department of Computer Science, University of South Dakota（人工智能研究实验室、计算机科学系、南达科他大学）；School of Information and Artificial Intelligence, Yangzhou University（信息与人工智能学院、扬州大学）；Department of Computer Science and Software Engineering, Auburn University（计算机科学与软件工程系、阿伯丁大学）
Deep neural networks have been successful in diverse discriminative classification tasks, although, they are poorly calibrated often assigning high probability to misclassified predictions. Potential consequences could lead to trustworthiness and accountability of the models when deployed in real applications, where predictions are evaluated based on their confidence scores. Existing solutions suggest the benefits attained by combining deep neural networks and Bayesian inference to quantify uncertainty over the models' predictions for ambiguous datapoints. In this work we propose to validate a…
Deep Learning models hold state-of-the-art performance in many fields, but their vulnerability to adversarial examples poses threat to their ubiquitous deployment in practical settings. Additionally, adversarial inputs generated on one classifier have been shown to transfer to other classifiers trained on similar data, which makes the attacks possible even if model parameters are not revealed to the adversary. This property of transferability has not yet been systematically studied, leading to a gap in our understanding of robustness of neural networks to adversarial inputs. In this work, we s…
Vision Transformers: the threat of realistic adversarial patches
Vrije Universiteit Brussel（自由大学布鲁塞尔）；Open University of the Netherlands（荷兰开放大学）；Netherlands Defence Academy（荷兰国防学院）；Fraunhofer Institute of Optronics（弗劳恩霍夫光学研究所）；imec；Belgian Royal Military Academy（比利时皇家军事学院）
Quantifying How Training Gradient Sparsity Affect Spiking Neural Network Accuracy And Robustness
College of Information and Communication Technology, Can Tho University, Vietnam（越南金瓯大学信息与通信技术学院）；College of Engineering and Computer Science, VinUniversity, Hanoi, Vietnam（越南河内Vin大学工程与计算机科学学院）；Center of Digital Transformation and Communication, Can Tho University, Vietnam（越南金瓯大学数字转型与通信中心）；Department of Computer Science and Engineering, The University of Aizu, Japan（日本立命馆大学计算机科学与工程系）
Axiomatizing Neural Networks via Pursuit of Subspaces
Tampere University, Faculty of ITC, Finland（芬兰塔尔库大学信息与通信技术学院）；Department of Electrical Engineering, Qatar University, Qatar（卡塔尔大学电气工程系）；Donders Institute, Radboud University, The Netherlands（荷兰拉德堡德大学多纳尔斯研究所）
University of California, Los Angeles（加州大学洛杉矶分校）；Google Brain（谷歌大脑）
Training Generative Adversarial Networks (GANs) is notoriously challenging. We propose and study an architectural modification, self-modulation, which improves GAN performance across different data sets, architectures, losses, regularizers, and hyperparameter settings. Intuitively, self-modulation allows the intermediate feature maps of a generator to change as a function of the input noise vector. While reminiscent of other conditioning techniques, it requires no labeled data. In a large-scale empirical study we observe a relative decrease of $5\%-35\%$ in FID. Furthermore, all else being equ…
