Towards Defending Multiple $\ell_p$-norm Bounded Adversarial
Perturbations via Gated Batch Normalization
- URL: http://arxiv.org/abs/2012.01654v2
- Date: Fri, 11 Aug 2023 12:57:04 GMT
- Title: Towards Defending Multiple $\ell_p$-norm Bounded Adversarial
Perturbations via Gated Batch Normalization
- Authors: Aishan Liu, Shiyu Tang, Xinyun Chen, Lei Huang, Haotong Qin, Xianglong
Liu, Dacheng Tao
- Abstract summary: Existing adversarial defenses typically improve model robustness against individual specific perturbations.
Some recent methods improve model robustness against adversarial attacks in multiple $ell_p$ balls, but their performance against each perturbation type is still far from satisfactory.
We propose Gated Batch Normalization (GBN) to adversarially train a perturbation-invariant predictor for defending multiple $ell_p bounded adversarial perturbations.
- Score: 120.99395850108422
- License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
- Abstract: There has been extensive evidence demonstrating that deep neural networks are
vulnerable to adversarial examples, which motivates the development of defenses
against adversarial attacks. Existing adversarial defenses typically improve
model robustness against individual specific perturbation types (\eg,
$\ell_{\infty}$-norm bounded adversarial examples). However, adversaries are
likely to generate multiple types of perturbations in practice (\eg, $\ell_1$,
$\ell_2$, and $\ell_{\infty}$ perturbations). Some recent methods improve model
robustness against adversarial attacks in multiple $\ell_p$ balls, but their
performance against each perturbation type is still far from satisfactory. In
this paper, we observe that different $\ell_p$ bounded adversarial
perturbations induce different statistical properties that can be separated and
characterized by the statistics of Batch Normalization (BN). We thus propose
Gated Batch Normalization (GBN) to adversarially train a perturbation-invariant
predictor for defending multiple $\ell_p$ bounded adversarial perturbations.
GBN consists of a multi-branch BN layer and a gated sub-network. Each BN branch
in GBN is in charge of one perturbation type to ensure that the normalized
output is aligned towards learning perturbation-invariant representation.
Meanwhile, the gated sub-network is designed to separate inputs added with
different perturbation types. We perform an extensive evaluation of our
approach on commonly-used dataset including MNIST, CIFAR-10, and Tiny-ImageNet,
and demonstrate that GBN outperforms previous defense proposals against
multiple perturbation types (\ie, $\ell_1$, $\ell_2$, and $\ell_{\infty}$
perturbations) by large margins.
Related papers
- $σ$-zero: Gradient-based Optimization of $\ell_0$-norm Adversarial Examples [14.17412770504598]
We show that $ell_infty$-norm constraints can be used to craft input perturbations.
We propose a novel $ell_infty$-norm attack called $sigma$-norm.
It outperforms all competing adversarial attacks in terms of success, size, and efficiency.
arXiv Detail & Related papers (2024-02-02T20:08:11Z) - Hindering Adversarial Attacks with Implicit Neural Representations [25.422201099331637]
Lossy Implicit Network Activation Coding (LINAC) defence successfully hinders several common adversarial attacks.
We devise a Parametric Bypass Approximation (PBA) attack strategy for key-based defences, which successfully invalidates an existing method in this category.
arXiv Detail & Related papers (2022-10-22T13:10:24Z) - Adaptive Smoothness-weighted Adversarial Training for Multiple
Perturbations with Its Stability Analysis [39.90487314421744]
Adrial Training (AT) has been demonstrated as one of the most effective methods against adversarial examples.
Adrial training for multiple perturbations (ATMP) is proposed to generalize the adversarial robustness over different perturbation types.
We develop the stability-based excess risk bounds and propose adaptive-weighted adversarial training for multiple perturbations.
arXiv Detail & Related papers (2022-10-02T15:42:34Z) - Towards Compositional Adversarial Robustness: Generalizing Adversarial
Training to Composite Semantic Perturbations [70.05004034081377]
We first propose a novel method for generating composite adversarial examples.
Our method can find the optimal attack composition by utilizing component-wise projected gradient descent.
We then propose generalized adversarial training (GAT) to extend model robustness from $ell_p$-ball to composite semantic perturbations.
arXiv Detail & Related papers (2022-02-09T02:41:56Z) - PDPGD: Primal-Dual Proximal Gradient Descent Adversarial Attack [92.94132883915876]
State-of-the-art deep neural networks are sensitive to small input perturbations.
Many defence methods have been proposed that attempt to improve robustness to adversarial noise.
evaluating adversarial robustness has proven to be extremely challenging.
arXiv Detail & Related papers (2021-06-03T01:45:48Z) - Robustifying $\ell_\infty$ Adversarial Training to the Union of
Perturbation Models [120.71277007016708]
We extend the capabilities of widely popular single-attack $ell_infty$ AT frameworks.
Our technique, referred to as Noise Augmented Processing (SNAP), exploits a well-established byproduct of single-attack AT frameworks.
SNAP prepends a given deep net with a shaped noise augmentation layer whose distribution is learned along with network parameters using any standard single-attack AT.
arXiv Detail & Related papers (2021-05-31T05:18:42Z) - Generating Structured Adversarial Attacks Using Frank-Wolfe Method [7.84752424025677]
Constraining adversarial search with different norms results in disparately structured adversarial examples.
structured adversarial examples can be used for adversarial regularization of models to make models more robust or improve their performance on datasets which are structurally different.
arXiv Detail & Related papers (2021-02-15T06:36:50Z) - Learning to Generate Noise for Multi-Attack Robustness [126.23656251512762]
Adversarial learning has emerged as one of the successful techniques to circumvent the susceptibility of existing methods against adversarial perturbations.
In safety-critical applications, this makes these methods extraneous as the attacker can adopt diverse adversaries to deceive the system.
We propose a novel meta-learning framework that explicitly learns to generate noise to improve the model's robustness against multiple types of attacks.
arXiv Detail & Related papers (2020-06-22T10:44:05Z) - Toward Adversarial Robustness via Semi-supervised Robust Training [93.36310070269643]
Adrial examples have been shown to be the severe threat to deep neural networks (DNNs)
We propose a novel defense method, the robust training (RT), by jointly minimizing two separated risks ($R_stand$ and $R_rob$)
arXiv Detail & Related papers (2020-03-16T02:14:08Z)
This list is automatically generated from the titles and abstracts of the papers in this site.
This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.