Competition on Robust Deep Learning

Yinpeng Dong,Chang Liu,Wenzhao Xiang,Hang Su,Jun Zhu

DOI: https://doi.org/10.1093/nsr/nwad087

IF: 20.6

2023-01-01

National Science Review

Abstract:This perspective paper proposes a new adversarial training method based on large-scale pre-trained models to achieve state-of-the-art adversarial robustness on ImageNet.

What problem does this paper attempt to address?

A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinking

Chang Liu,Yinpeng Dong,Wenzhao Xiang,Xiao Yang,Hang Su,Jun Zhu,Yuefeng Chen,Yuan He,Hui Xue,Shibao Zheng

DOI: https://doi.org/10.48550/arXiv.2302.14301

2023-02-28

Abstract:The robustness of deep neural networks is usually lacking under adversarial examples, common corruptions, and distribution shifts, which becomes an important research problem in the development of deep learning. Although new deep learning methods and robustness improvement techniques have been constantly proposed, the robustness evaluations of existing methods are often inadequate due to their rapid development, diverse noise patterns, and simple evaluation metrics. Without thorough robustness evaluations, it is hard to understand the advances in the field and identify the effective methods. In this paper, we establish a comprehensive robustness benchmark called \textbf{ARES-Bench} on the image classification task. In our benchmark, we evaluate the robustness of 55 typical deep learning models on ImageNet with diverse architectures (e.g., CNNs, Transformers) and learning algorithms (e.g., normal supervised training, pre-training, adversarial training) under numerous adversarial attacks and out-of-distribution (OOD) datasets. Using robustness curves as the major evaluation criteria, we conduct large-scale experiments and draw several important findings, including: 1) there is an inherent trade-off between adversarial and natural robustness for the same model architecture; 2) adversarial training effectively improves adversarial robustness, especially when performed on Transformer architectures; 3) pre-training significantly improves natural robustness based on more training data or self-supervised learning. Based on ARES-Bench, we further analyze the training tricks in large-scale adversarial training on ImageNet. By designing the training settings accordingly, we achieve the new state-of-the-art adversarial robustness. We have made the benchmarking results and code platform publicly available.

Computer Vision and Pattern Recognition
DeepDefense: Training Deep Neural Networks with Improved Robustness.

Ziang Yan,Yiwen Guo,Changshui Zhang

2018-01-01

Abstract:Despite the efficacy on a variety of computer vision tasks, deep neural networks (DNNs) are vulnerable to adversarial attacks, limiting their applications in security-critical systems. Recent works have shown the possibility of generating imperceptibly perturbed image inputs (a.k.a., adversarial examples) to fool well-trained DNN models into making arbitrary predictions. To address this problem, we propose a training recipe named DeepDefense. Our core idea is to integrate an adversarial perturbation-based regularizer into the classification objective, such that the obtained models learn to resist potential attacks, directly and precisely. The whole optimization problem is solved just like training a recursive network. Experimental results demonstrate that our method outperforms the state-of-the-arts by large margins on various datasets (including MNIST, CIFAR-10 and ImageNet) and different DNN architectures. Code and models for reproducing our results will be made publicly available.
Deep Defense: Training DNNs with Improved Adversarial Robustness

Ziang Yan,Yiwen Guo,Changshui Zhang

DOI: https://doi.org/10.48550/arXiv.1803.00404

2018-02-23

Computer Vision and Pattern Recognition

Abstract:Despite the efficacy on a variety of computer vision tasks, deep neural networks (DNNs) are vulnerable to adversarial attacks, limiting their applications in security-critical systems. Recent works have shown the possibility of generating imperceptibly perturbed image inputs (a.k.a., adversarial examples) to fool well-trained DNN classifiers into making arbitrary predictions. To address this problem, we propose a training recipe named "deep defense". Our core idea is to integrate an adversarial perturbation-based regularizer into the classification objective, such that the obtained models learn to resist potential attacks, directly and precisely. The whole optimization problem is solved just like training a recursive network. Experimental results demonstrate that our method outperforms training with adversarial/Parseval regularizations by large margins on various datasets (including MNIST, CIFAR-10 and ImageNet) and different DNN architectures. Code and models for reproducing our results are available at https://github.com/ZiangYan/deepdefense.pytorch
Local Competition and Uncertainty for Adversarial Robustness in Deep Learning

Antonios Alexos,Konstantinos P. Panousis,Sotirios Chatzis

DOI: https://doi.org/10.48550/arXiv.2006.10620

2020-06-18

Abstract:This work attempts to address adversarial robustness of deep networks by means of novel learning arguments. Specifically, inspired from results in neuroscience, we propose a local competition principle as a means of adversarially-robust deep learning. We argue that novel local winner-takes-all (LWTA) nonlinearities, combined with posterior sampling schemes, can greatly improve the adversarial robustness of traditional deep networks against difficult adversarial attack schemes. We combine these LWTA arguments with tools from the field of Bayesian non-parametrics, specifically the stick-breaking construction of the Indian Buffet Process, to flexibly account for the inherent uncertainty in data-driven modeling. As we experimentally show, the new proposed model achieves high robustness to adversarial perturbations on MNIST and CIFAR10 datasets. Our model achieves state-of-the-art results in powerful white-box attacks, while at the same time retaining its benign accuracy to a high degree. Equally importantly, our approach achieves this result while requiring far less trainable model parameters than the existing state-of-the-art.

Machine Learning
Improving Model Robustness Against Adversarial Examples with Redundant Fully Connected Layer.

Ziming Zhao,Zhaoxuan Li,Tingting Li,Jiongchi Yu,Fan Zhang,Rui Zhang

DOI: https://doi.org/10.1145/3589335.3651524

2024-01-01

Abstract:Recent studies show that deep neural networks are extremely vulnerable, especially for adversarial examples of image classification models. However, the current defense technologies exhibit a series of limitations in terms of the adaptability of different attacks, the trade-off between clean-instance accuracy and robust one, as well as efficiency for train time overhead. To tackle these problems, we present a novel component, named redundant fully connected layer, which can be combined with existing model backbones in a pluggable manner. Specifically, we design a tailor-made loss function for it that leverages cosine similarity to maximize the difference and diversity of multiple fully connected parts. We conduct extensive experiments against 12 representative attacks (white-box and black-box), based on the popular dataset. The empirical evaluations show that our scheme realizes significant outcomes against various attacks with negligible additional training overhead, while hardly bringing collateral damage for clean-instance accuracy.
Benchmarking Adversarial Robustness on Image Classification

Yinpeng Dong,Qi-An Fu,Xiao Yang,Tianyu Pang,Hang Su,Zihao Xiao,Jun Zhu

DOI: https://doi.org/10.1109/CVPR42600.2020.00040

2020-01-01

Abstract:Deep neural networks are vulnerable to adversarial examples, which becomes one of the most important research problems in the development of deep learning. While a lot of efforts have been made in recent years, it is of great significance to perform correct and complete evaluations of the adversarial attack and defense algorithms. In this paper, we establish a comprehensive, rigorous, and coherent benchmark to evaluate adversarial robustness on image classification tasks. After briefly reviewing plenty of representative attack and defense methods, we perform large-scale experiments with two robustness curves as the fair-minded evaluation criteria to fully understand the performance of these methods. Based on the evaluation results, we draw several important findings that can provide insights for future research, including: 1) The relative robustness between models can change across different attack configurations, thus it is encouraged to adopt the robustness curves to evaluate adversarial robustness; 2) As one of the most effective defense techniques, adversarial training can generalize across different threat models; 3) Randomization-based defenses are more robust to query-based black-box attacks.
Towards Deep Learning Models Resistant to Adversarial Attacks

Aleksander Madry,Aleksandar Makelov,Ludwig Schmidt,Dimitris Tsipras,Adrian Vladu

DOI: https://doi.org/10.48550/arXiv.1706.06083

IF: 5.414

2017-06-19

Machine Learning

Abstract:Recent work has demonstrated that deep neural networks are vulnerable to adversarial examples---inputs that are almost indistinguishable from natural data and yet classified incorrectly by the network. In fact, some of the latest findings suggest that the existence of adversarial attacks may be an inherent weakness of deep learning models. To address this problem, we study the adversarial robustness of neural networks through the lens of robust optimization. This approach provides us with a broad and unifying view on much of the prior work on this topic. Its principled nature also enables us to identify methods for both training and attacking neural networks that are reliable and, in a certain sense, universal. In particular, they specify a concrete security guarantee that would protect against any adversary. These methods let us train networks with significantly improved resistance to a wide range of adversarial attacks. They also suggest the notion of security against a first-order adversary as a natural and broad security guarantee. We believe that robustness against such well-defined classes of adversaries is an important stepping stone towards fully resistant deep learning models. Code and pre-trained models are available at https://github.com/MadryLab/mnist_challenge and https://github.com/MadryLab/cifar10_challenge.
Improving robustness of deep neural networks via large-difference transformation

Longwei Wang,Chengfei Wang,Yupeng Li,Rui Wang

DOI: https://doi.org/10.1016/j.neucom.2021.03.112

IF: 6

2021-08-01

Neurocomputing

Abstract:<p>Recent research shows that previous model-agnostic methods that transform the input images before feeding them into the classifiers fail to defend against the adversarial examples. We assume that the small-difference transformations commonly used are the blame and therefore propose a new model-agnostic defense using a large-difference transformation. Specifically, we try to apply the novel primitive-based transformation that re-builds the input images by primitives of colorful triangles. In terms of the distortions required to completely break the defenses, our experiments on the ImageNet subset show that significantly large distortions (0.12) are needed to break the defense compared to other state-of-the-art model-agnostic defenses (0.05-0.06) under the strong attack method Backward Pass Differentiable Approximation (BPDA). This finding indicates that large difference transformation can improve the adversarial robustness, suggesting a promising new direction towards solving the challenge of adversarial robustness.</p>

computer science, artificial intelligence
Adversarial Robustness against Multiple and Single $l_p$-Threat Models via Quick Fine-Tuning of Robust Classifiers

Francesco Croce,Matthias Hein

DOI: https://doi.org/10.48550/arXiv.2105.12508

IF: 5.414

2021-05-26

Machine Learning

Abstract:A major drawback of adversarially robust models, in particular for large scale datasets like ImageNet, is the extremely long training time compared to standard ones. Moreover, models should be robust not only to one $l_p$-threat model but ideally to all of them. In this paper we propose Extreme norm Adversarial Training (E-AT) for multiple-norm robustness which is based on geometric properties of $l_p$-balls. E-AT costs up to three times less than other adversarial training methods for multiple-norm robustness. Using E-AT we show that for ImageNet a single epoch and for CIFAR-10 three epochs are sufficient to turn any $l_p$-robust model into a multiple-norm robust model. In this way we get the first multiple-norm robust model for ImageNet and boost the state-of-the-art for multiple-norm robustness to more than $51\%$ on CIFAR-10. Finally, we study the general transfer via fine-tuning of adversarial robustness between different individual $l_p$-threat models and improve the previous SOTA $l_1$-robustness on both CIFAR-10 and ImageNet. Extensive experiments show that our scheme works across datasets and architectures including vision transformers.
A Direct Approach to Robust Deep Learning Using Adversarial Networks

Huaxia Wang,Chun-Nam Yu

DOI: https://doi.org/10.48550/arXiv.1905.09591

2019-05-23

Computer Vision and Pattern Recognition

Abstract:Deep neural networks have been shown to perform well in many classical machine learning problems, especially in image classification tasks. However, researchers have found that neural networks can be easily fooled, and they are surprisingly sensitive to small perturbations imperceptible to humans. Carefully crafted input images (adversarial examples) can force a well-trained neural network to provide arbitrary outputs. Including adversarial examples during training is a popular defense mechanism against adversarial attacks. In this paper we propose a new defensive mechanism under the generative adversarial network (GAN) framework. We model the adversarial noise using a generative network, trained jointly with a classification discriminative network as a minimax game. We show empirically that our adversarial network approach works well against black box attacks, with performance on par with state-of-art methods such as ensemble adversarial training and adversarial training with projected gradient descent.
Optimism in the Face of Adversity: Understanding and Improving Deep Learning Through Adversarial Robustness

Guillermo Ortiz-Jiménez,Apostolos Modas,Seyed-Mohsen Moosavi-Dezfooli,Pascal Frossard,Guillermo Ortiz-Jimenez

DOI: https://doi.org/10.1109/jproc.2021.3050042

IF: 20.6

2021-05-01

Proceedings of the IEEE

Abstract:Driven by massive amounts of data and important advances in computational resources, new deep learning systems have achieved outstanding results in a large spectrum of applications. Nevertheless, our current theoretical understanding of the mathematical foundations of deep learning lags far behind its empirical success. However, the field of adversarial robustness has recently become one of the main sources of explanations of our deep models. In this article, we provide an in-depth review of the field and give a self-contained introduction to its main notions. However, in contrast to the mainstream pessimistic perspective of adversarial robustness, we focus on the main positive aspects that it entails. We highlight the intuitive connection between adversarial examples and the geometry of deep neural networks and, eventually, explore how the geometric study of adversarial examples can serve as a powerful tool to understand deep learning. Furthermore, we demonstrate the broad applicability of adversarial robustness, providing an overview of the main emerging applications of adversarial robustness beyond security. The goal of this article is to provide readers with a set of new perspectives to understand deep learning and supply them with intuitive tools and insights on how to use adversarial robustness to improve it.

engineering, electrical & electronic
Improving Deep Neural Network Robustness with Siamese Empowered Adversarial Training

Yu Zhu,Zongfei Li,Fengyuan Xu,Sheng Zhong

DOI: https://doi.org/10.1007/978-3-030-68851-6_4

2021-01-01

Abstract:Deep neural networks (DNNs) have been widely used in many critical application domains. However, the security of DNNs are threatened by adversarial examples, and the problem has not been fully solved. In this work, observing the deficiency of existing adversarial training methods, we propose a new adversarial training method with a specially-crafted contrastive loss and the siamese training architecture. Our method fully leverages the distance relationships between the benign examples and adversarial examples. We conduct extensive experiments to evaluate our proposed design. The results show that the DNN models trained by our methods are more robust to adversarial examples compared to those been trained with other SOTA methods.
Adversarial Distributional Training for Robust Deep Learning

Yinpeng Dong,Zhijie Deng,Tianyu Pang,Jun Zhu,Hang Su

2020-01-01

Abstract:Adversarial training (AT) is among the most effective techniques to improve model robustness by augmenting training data with adversarial examples. However, most existing AT methods adopt a specific attack to craft adversarial examples, leading to the unreliable robustness against other unseen attacks. Besides, a single attack algorithm could be insufficient to explore the space of perturbations. In this paper, we introduce adversarial distributional training (ADT), a novel framework for learning robust models. ADT is formulated as a minimax optimization problem, where the inner maximization aims to learn an adversarial distribution to characterize the potential adversarial examples around a natural one under an entropic regularizer, and the outer minimization aims to train robust models by minimizing the expected loss over the worst-case adversarial distributions. Through a theoretical analysis, we develop a general algorithm for solving ADT, and present three approaches for parameterizing the adversarial distributions, ranging from the typical Gaussian distributions to the flexible implicit ones. Empirical results on several benchmarks validate the effectiveness of ADT compared with the state-of-the-art AT methods.
Distributed Adversarial Training to Robustify Deep Neural Networks at Scale

Gaoyuan Zhang,Songtao Lu,Yihua Zhang,Xiangyi Chen,Pin-Yu Chen,Quanfu Fan,Lee Martie,Lior Horesh,Mingyi Hong,Sijia Liu

DOI: https://doi.org/10.48550/arXiv.2206.06257

IF: 5.414

2022-06-13

Machine Learning

Abstract:Current deep neural networks (DNNs) are vulnerable to adversarial attacks, where adversarial perturbations to the inputs can change or manipulate classification. To defend against such attacks, an effective and popular approach, known as adversarial training (AT), has been shown to mitigate the negative impact of adversarial attacks by virtue of a min-max robust training method. While effective, it remains unclear whether it can successfully be adapted to the distributed learning context. The power of distributed optimization over multiple machines enables us to scale up robust training over large models and datasets. Spurred by that, we propose distributed adversarial training (DAT), a large-batch adversarial training framework implemented over multiple machines. We show that DAT is general, which supports training over labeled and unlabeled data, multiple types of attack generation methods, and gradient compression operations favored for distributed optimization. Theoretically, we provide, under standard conditions in the optimization theory, the convergence rate of DAT to the first-order stationary points in general non-convex settings. Empirically, we demonstrate that DAT either matches or outperforms state-of-the-art robust accuracies and achieves a graceful training speedup (e.g., on ResNet-50 under ImageNet). Codes are available at https://github.com/dat-2022/dat.
Adversarial Attacks on ML Defense Models Competition

Yinpeng Dong,Qi-An Fu,Xiao Yang,Wenzhao Xiang,Tianyu Pang,Hang Su,Jun Zhu,Jiayu Tang,Yuefeng Chen,XiaoFeng Mao,Yuan He,Hui Xue,Chao Li,Ye Liu,Qilong Zhang,Lianli Gao,Yunrui Yu,Xitong Gao,Zhe Zhao,Daquan Lin,Jiadong Lin,Chuanbiao Song,Zihao Wang,Zhennan Wu,Yang Guo,Jiequan Cui,Xiaogang Xu,Pengguang Chen

DOI: https://doi.org/10.48550/arXiv.2110.08042

2021-10-15

Abstract:Due to the vulnerability of deep neural networks (DNNs) to adversarial examples, a large number of defense techniques have been proposed to alleviate this problem in recent years. However, the progress of building more robust models is usually hampered by the incomplete or incorrect robustness evaluation. To accelerate the research on reliable evaluation of adversarial robustness of the current defense models in image classification, the TSAIL group at Tsinghua University and the Alibaba Security group organized this competition along with a CVPR 2021 workshop on adversarial machine learning (<a class="link-external link-https" href="https://aisecure-workshop.github.io/amlcvpr2021/" rel="external noopener nofollow">this https URL</a>). The purpose of this competition is to motivate novel attack algorithms to evaluate adversarial robustness more effectively and reliably. The participants were encouraged to develop stronger white-box attack algorithms to find the worst-case robustness of different defenses. This competition was conducted on an adversarial robustness evaluation platform -- ARES (<a class="link-external link-https" href="https://github.com/thu-ml/ares" rel="external noopener nofollow">this https URL</a>), and is held on the TianChi platform (<a class="link-external link-https" href="https://tianchi.aliyun.com/competition/entrance/531847/introduction" rel="external noopener nofollow">this https URL</a>) as one of the series of AI Security Challengers Program. After the competition, we summarized the results and established a new adversarial robustness benchmark at <a class="link-external link-https" href="https://ml.cs.tsinghua.edu.cn/ares-bench/" rel="external noopener nofollow">this https URL</a>, which allows users to upload adversarial attack algorithms and defense models for evaluation.

Computer Vision and Pattern Recognition,Artificial Intelligence,Cryptography and Security,Machine Learning
Toward Robust Neural Image Compression: Adversarial Attack and Model Finetuning

Tong Chen,Zhan Ma

DOI: https://doi.org/10.1109/TCSVT.2023.3276442

IF: 5.859

2023-01-01

IEEE Transactions on Circuits and Systems for Video Technology

Abstract:Deep neural network-based image compression has been extensively studied. However, the model robustness which is crucial to practical application is largely overlooked. We propose to examine the robustness of prevailing learned image compression models by injecting negligible adversarial perturbation into the original source image. Severe distortion in decoded reconstruction reveals the general vulnerability in existing methods regardless of their settings (e.g., network architecture, loss function, quality scale). A variety of defense strategies including geometric self-ensemble based pre-processing, and adversarial training, are investigated against the adversarial attack to improve the model's robustness. Later the defense efficiency is further exemplified in real-life image recompression case studies. Overall, our methodology is simple, effective, and generalizable, making it attractive for developing robust learned image compression solutions. All materials are made publicly accessible at https://njuvision.github.io/RobustNIC for reproducible research.
Unrestricted Adversarial Attacks on ImageNet Competition

Yuefeng Chen,Xiaofeng Mao,Yuan He,Hui Xue,Chao Li,Yinpeng Dong,Qi-An Fu,Xiao Yang,Wenzhao Xiang,Tianyu Pang,Hang Su,Jun Zhu,Fangcheng Liu,Chao Zhang,Hongyang Zhang,Yichi Zhang,Shilong Liu,Chang Liu,Yajie Wang,Huipeng Zhou,Haoran Lyu,Yidan Xu,Zixuan Xu,Taoyu Zhu,Wenjun Li,Xianfeng Gao,Guoqiu Wang,Huanqian Yan,Ying Guo,Chaoning Zhang,Zheng Fang,Yang Wang,Bingyang Fu,Yunfei Zheng,Yekui Wang,Haorong Luo,Zhen Yang

2021-01-01

Abstract:Many works have investigated the adversarial attacks or defenses under the settings where a bounded and imperceptible perturbation can be added to the input. However in the real-world, the attacker does not need to comply with this restriction. In fact, more threats to the deep model come from unrestricted adversarial examples, that is, the attacker makes large and visible modifications on the image, which causes the model classifying mistakenly, but does not affect the normal observation in human perspective. Unrestricted adversarial attack is a popular and practical direction but has not been studied thoroughly. We organize this competition with the purpose of exploring more effective unrestricted adversarial attack algorithm, so as to accelerate the academical research on the model robustness under stronger unbounded attacks. The competition is held on the TianChi platform (https://tianchi. aliyun.com/competition/entrance/531853/ introduction) as one of the series of AI Security Challengers Program.
Robust Adversarial Perturbation on Deep Proposal-based Models

Yuezun Li,Daniel Tian,Ming-Ching Chang,Xiao Bian,Siwei Lyu

DOI: https://doi.org/10.48550/arXiv.1809.05962

2018-09-16

Computer Vision and Pattern Recognition

Abstract:Adversarial noises are useful tools to probe the weakness of deep learning based computer vision algorithms. In this paper, we describe a robust adversarial perturbation (R-AP) method to attack deep proposal-based object detectors and instance segmentation algorithms. Our method focuses on attacking the common component in these algorithms, namely Region Proposal Network (RPN), to universally degrade their performance in a black-box fashion. To do so, we design a loss function that combines a label loss and a novel shape loss, and optimize it with respect to image using a gradient based iterative algorithm. Evaluations are performed on the MS COCO 2014 dataset for the adversarial attacking of 6 state-of-the-art object detectors and 2 instance segmentation algorithms. Experimental results demonstrate the efficacy of the proposed method.
Robust Diffusion Models for Adversarial Purification

Guang Lin,Zerui Tao,Jianhai Zhang,Toshihisa Tanaka,Qibin Zhao

2024-08-23

Abstract:Diffusion models (DMs) based adversarial purification (AP) has shown to be the most powerful alternative to adversarial training (AT). However, these methods neglect the fact that pre-trained diffusion models themselves are not robust to adversarial attacks as well. Additionally, the diffusion process can easily destroy semantic information and generate a high quality image but totally different from the original input image after the reverse process, leading to degraded standard accuracy. To overcome these issues, a natural idea is to harness adversarial training strategy to retrain or fine-tune the pre-trained diffusion model, which is computationally prohibitive. We propose a novel robust reverse process with adversarial guidance, which is independent of given pre-trained DMs and avoids retraining or fine-tuning the DMs. This robust guidance can not only ensure to generate purified examples retaining more semantic content but also mitigate the accuracy-robustness trade-off of DMs for the first time, which also provides DM-based AP an efficient adaptive ability to new attacks. Extensive experiments are conducted on CIFAR-10, CIFAR-100 and ImageNet to demonstrate that our method achieves the state-of-the-art results and exhibits generalization against different attacks.

Computer Vision and Pattern Recognition,Artificial Intelligence

Competition on Robust Deep Learning

A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinking

DeepDefense: Training Deep Neural Networks with Improved Robustness.

Deep Defense: Training DNNs with Improved Adversarial Robustness

Local Competition and Uncertainty for Adversarial Robustness in Deep Learning

Improving Model Robustness Against Adversarial Examples with Redundant Fully Connected Layer.

Benchmarking Adversarial Robustness on Image Classification

Towards Deep Learning Models Resistant to Adversarial Attacks

Improving robustness of deep neural networks via large-difference transformation

Adversarial Robustness against Multiple and Single $l_p$-Threat Models via Quick Fine-Tuning of Robust Classifiers

A Direct Approach to Robust Deep Learning Using Adversarial Networks

Optimism in the Face of Adversity: Understanding and Improving Deep Learning Through Adversarial Robustness

Improving Deep Neural Network Robustness with Siamese Empowered Adversarial Training

Adversarial Distributional Training for Robust Deep Learning

Distributed Adversarial Training to Robustify Deep Neural Networks at Scale

Adversarial Attacks on ML Defense Models Competition

Toward Robust Neural Image Compression: Adversarial Attack and Model Finetuning

Unrestricted Adversarial Attacks on ImageNet Competition

Robust Adversarial Perturbation on Deep Proposal-based Models

Robust Diffusion Models for Adversarial Purification