Abstract:Adversarial training is one of the most effective approaches to improve model robustness against adversarial examples. However, previous works mainly focus on the overall robustness of the model, and the in-depth analysis on the role of each class involved in adversarial training is still missing. In this paper, we propose to analyze the class-wise robustness in adversarial training. First, we provide a detailed diagnosis of adversarial training on six benchmark datasets, i.e., MNIST, CIFAR-10, CIFAR-100, SVHN, STL-10 and ImageNet. Surprisingly, we find that there are remarkable robustness discrepancies among classes, leading to unbalance/unfair class-wise robustness in the robust models. Furthermore, we keep investigating the relations between classes and find that the unbalanced class-wise robustness is pretty consistent among different attack and defense methods. Moreover, we observe that the stronger attack methods in adversarial learning achieve performance improvement mainly from a more successful attack on the vulnerable classes (i.e., classes with less robustness). Inspired by these interesting findings, we design a simple but effective attack method based on the traditional PGD attack, named Temperature-PGD attack, which proposes to enlarge the robustness disparity among classes with a temperature factor on the confidence distribution of each image. Experiments demonstrate our method can achieve a higher attack rate than the PGD attack. Furthermore, from the defense perspective, we also make some modifications in the training and inference phase to improve the robustness of the most vulnerable class, so as to mitigate the large difference in class-wise robustness. We believe our work can contribute to a more comprehensive understanding of adversarial training as well as rethinking the class-wise properties in robust models.

Robustness Analysis of Classical and Fuzzy Decision Trees under Adversarial Evasion Attack

Attack As Defense: Characterizing Adversarial Examples Using Robustness.

Certifying Decision Trees Against Evasion Attacks by Program Analysis

Robust Decision Trees Against Adversarial Examples

Decision-based Evasion Attacks on Tree Ensemble Classifiers

Attack and Defense: Adversarial Security of Data-Driven FDC Systems

Attack Tree Analysis for Adversarial Evasion Attacks

Simple Perturbations Subvert Ethereum Phishing Transactions Detection: An Empirical Analysis

ROBY: Evaluating the adversarial robustness of a deep model by its decision boundaries

Beyond Robustness: Resilience Verification of Tree-Based Classifiers

Threat Risk Analysis for Cloud Security Based on Attack-Defense Trees

On the Vulnerability of Adversarially Trained Models Against Two-faced Attacks

Provable Robustness Against a Union of $\ell_0$ Adversarial Attacks

D etect S ec : Evaluating the robustness of object detection models to adversarial attacks

On the Robustness of Adversarial Training Against Uncertainty Attacks

ARDST: An Adversarial‐Resilient Deep Symbolic Tree for Adversarial Learning

An Adversarial Attack Analysis on Malicious Advertisement URL Detection Framework

Analysis and Applications of Class-wise Robustness in Adversarial Training

DetectS Ec: Evaluating the Robustness of Object Detection Models to Adversarial Attacks

Verifiable Learning for Robust Tree Ensembles

Towards A Critical Evaluation of Robustness for Deep Learning Backdoor Countermeasures