Abstract:With its growing use in safety/security-critical applications, Deep Learning (DL) has raised increasing concerns regarding its dependability. In particular, DL has a notorious problem of lacking robustness. Input added with adversarial perturbations, i.e. Adversarial Examples (AEs) are easily mis-predicted by the DL model. Despite recent efforts made in detecting AEs via state-of-the-art attack and testing methods, they are normally input distribution agnostic and/or disregard the perceptual quality of adversarial perturbations. Consequently, the detected AEs are irrelevant inputs in the application context or unrealistic that can be easily noticed by humans. This may lead to a limited effect on improving the DL model’s dependability, as the testing budget is likely to be wasted on detecting AEs that are encountered very rarely in its real-life operations. In this paper, we propose a new robustness testing approach for detecting AEs that considers both the feature level distribution and the pixel level distribution, capturing the perceptual quality of adversarial perturbations. The two considerations are encoded by a novel hierarchical mechanism. First, we select test seeds based on the density of feature level distribution and the vulnerability of adversarial robustness. The vulnerability of test seeds are indicated by the auxiliary information, that are highly correlated with local robustness. Given a test seed, we then develop a novel genetic algorithm based local test case generation method, in which two fitness functions work alternatively to control the perceptual quality of detected AEs. Finally, extensive experiments confirm that our holistic approach considering hierarchical distributions is superior to the state-of-the-arts that either disregard any input distribution or only consider a single (non-hierarchical) distribution, in terms of not only detecting imperceptible AEs but also improving the overall robustness of the DL model under testing.

Distribution Mismatch Correction for Improved Robustness in Deep Neural Networks

DC4L: Distribution Shift Recovery via Data-Driven Control for Deep Learning Models

Skeptical Deep Learning with Distribution Correction

Towards In-Distribution Compatible Out-of-Distribution Detection.

Making Deep Neural Networks Robust to Label Noise: a Loss Correction Approach

Dynamic Batch Norm Statistics Update for Natural Robustness

Mean Shift Rejection: Training Deep Neural Networks Without Minibatch Statistics or Normalization

Wasserstein distributional robustness of neural networks

Regularizing activations in neural networks via distribution matching with the Wasserstein metric

Hierarchical Distribution-Aware Testing of Deep Learning

Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift

Improve Adversarial Robustness Via Probabilistic Distributions Decoupled Network While Guaranteeing Clean Performance

Improving Out-of-Distribution Data Handling and Corruption Resistance via Modern Hopfield Networks

Generalizability of Adversarial Robustness Under Distribution Shifts

Adaptive Retraining for Neural Network Robustness in Classification

A statistical framework for efficient out of distribution detection in deep neural networks

Benchmarking the Robustness of Deep Neural Networks to Common Corruptions in Digital Pathology

Patch-aware Batch Normalization for Improving Cross-domain Robustness

A Robust Framework for Distributional Shift Detection Under Sample-Bias

Distributionally Robust Multiclass Classification and Applications in Deep Image Classifiers

Mitigating Neural Network Overconfidence with Logit Normalization.