Adversarial robustness via noise injection in smoothed models

Deep neural networks are known to be vulnerable to malicious perturbations. Current methods for improving adversarial robustness make use of either implicit or explicit regularization, with the latter is usually based on adversarial training. Randomized smoothing, the averaging of the classifier out...

Full description

Saved in:
Bibliographic Details
Published in:Applied intelligence (Dordrecht, Netherlands) Netherlands), 2023-04, Vol.53 (8), p.9483-9498
Main Authors: Nemcovsky, Yaniv, Zheltonozhskii, Evgenii, Baskin, Chaim, Chmiel, Brian, Bronstein, Alex M., Mendelson, Avi
Format: Article
Language:English
Subjects:
Accuracy
Artificial Intelligence
Artificial neural networks
Classifiers
Computer Science
Infinity
Machines
Manufacturing
Mechanical Engineering
Noise
Performance enhancement
Perturbation
Processes
Randomization
Regularization
Robustness
Smoothing
Training
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Deep neural networks are known to be vulnerable to malicious perturbations. Current methods for improving adversarial robustness make use of either implicit or explicit regularization, with the latter is usually based on adversarial training. Randomized smoothing, the averaging of the classifier outputs over a random distribution centered in the sample, has been shown to guarantee a classifier’s performance subject to bounded perturbations of the input. In this work, we study the application of randomized smoothing to improve performance on unperturbed data and increase robustness to adversarial attacks. We propose to combine smoothing along with adversarial training and randomization approaches, and find that doing so significantly improves the resilience compared to the baseline. We examine our method’s performance on common white-box (FGSM, PGD) and black-box (transferable attack and NAttack) attacks on CIFAR-10 and CIFAR-100, and determine that for a low number of iterations, smoothing provides a significant performance boost that persists even for perturbations with a high attack norm, ε . For example, under a PGD-10 attack on CIFAR-10 using Wide-ResNet28-4, we achieve 60.3% accuracy for infinity norm ε ∞ = 8 / 255 and 13.1% accuracy for ε ∞ = 35 / 255 – outperforming previous art by 3% and 6%, respectively. We achieve nearly twice the accuracy on ε ∞ = 35 / 255 and even more so for perturbations with higher infinity norm. A https://github.com/yanemcovsky/SIAM of the proposed method is provided.
ISSN:0924-669X
1573-7497
DOI:10.1007/s10489-022-03423-5