Abstract:Adversarial Examples threaten to fool deep learning models to output erroneous predictions with high confidence. Optimization-based methods for constructing such samples have been extensively studied. While being effective in terms of aggression, they typically lack clear interpretation and constraint about their underlying generation process, which thus hinders us from leveraging the produced adversarial samples for model protection in the reverse direction. Hence, we expect them to repair bugs in the pre-trained models by produced additional training data equipped with strong attack ability rather than time-consuming full re-training from scratch. To address these issues, we first study the black-box behaviors and the intrinsic deficiency of neighborhood information in previous optimization-based adversarial attacks and defenses, respectively. Then we introduce a new method dubbed FeaCP, which uses correct predicted samples in disjoint classes to guide the generation of more explainable adversarial samples in the ambiguous region around the decision boundary instead of uncontrolled “blind spots”, via convex combination in a feature component-wise manner which takes the individual importance of feature ingredients into account. Our method incorporates the prior fact that for well-separated samples, the path connecting them would go through model’s decision-boundary that lies in a low-density region, however, wherein adversarial examples are spread with high probability, thus having an impact on the ultimate trained model. In our work, the path is constructed by proposed inhomogeneous feature-wise convex interpolation rather than operating on sample-wise level, limiting the search space of FeaCP to obtain an adaptive neighborhood. Finally, we provide detailed insights and extend our method to adversarial fine-tuning using vicinity distribution to optimize the approximated decision boundary, and validate the significance of our FeaCP to model performance. The experimental results show that our method provides competitive performance on various datasets and networks.

Patch-level Neighborhood Interpolation: A General and Effective Graph-based Regularization Strategy

Neighborhood Region Smoothing Regularization for Finding Flat Minima in Deep Neural Networks

Neighborhood Region Smoothing Regularization for Finding Flat Minima In Deep Neural Networks

PatchShuffle Regularization.

PANDA: AdaPtive Noisy Data Augmentation for Regularization of Undirected Graphical Models

Patch-aware Batch Normalization for Improving Cross-domain Robustness

Network as Regularization for Training Deep Neural Networks: Framework, Model and Performance

Regularization of polynomial networks for image recognition

On Mixup Regularization

ifMixup: Interpolating Graph Pair to Regularize Graph Classification

PointPatchMix: Point Cloud Mixing with Patch Scoring

PatchMix: patch-level mixup for data augmentation in convolutional neural networks

Feature Variance Regularization: A Simple Way to Improve the Generalizability of Neural Networks

Adversarial Adaptive Neighborhood With Feature Importance-Aware Convex Interpolation

Regularizing Deep Networks Using Efficient Layerwise Adversarial Training

Rethinking Pan-Sharpening in Closed-Loop Regularization

Patch Reordering: a Novel Way to Achieve Rotation and Translation Invariance in Convolutional Neural Networks

Hypergraph $p$-Laplacian regularization on point clouds for data interpolation

Defending Adversarial Patches via Joint Region Localizing and Inpainting

Learning from small data sets: Patch-based regularizers in inverse problems for image reconstruction

Patch-Grid: An Efficient and Feature-Preserving Neural Implicit Surface Representation