Abstract:The vulnerability of deep neural networks (DNNs) to adversarial attack, which is an attack that can mislead state-of-the-art classifiers into making an incorrect classification with high confidence by deliberately perturbing the original inputs, raises concerns about the robustness of DNNs to such attacks. Adversarial training, which is the main heuristic method for improving adversarial robustness and the first line of defense against adversarial attacks, requires many sample-by-sample calculations to increase training size and is usually insufficiently strong for an entire network. This paper provides a new perspective on the issue of adversarial robustness, one that shifts the focus from the network as a whole to the critical part of the region close to the decision boundary corresponding to a given class. From this perspective, we propose a method to generate a single but image-agnostic adversarial perturbation that carries the semantic information implying the directions to the fragile parts on the decision boundary and causes inputs to be misclassified as a specified target. We call the adversarial training based on such perturbations "region adversarial training" (RAT), which resembles classical adversarial training but is distinguished in that it reinforces the semantic information missing in the relevant regions. Experimental results on the MNIST and CIFAR-10 datasets show that this approach greatly improves adversarial robustness even when a very small dataset from the training data is used; moreover, it can defend against fast gradient sign method, universal perturbation, projected gradient descent, and Carlini and Wagner adversarial attacks, which have a completely different pattern from those encountered by the model during retraining. (C) 2021 Elsevier B.V. All rights reserved.

Towards Robust Training of Neural Networks by Regularizing Adversarial Gradients

Towards Robust DNNs: an Taylor Expansion-Based Method for Generating Powerful Adversarial Examples.

Learning More Robust Features with Adversarial Training

Feature Augmentation for Adversarial Robustness

Towards Noise-Robust Neural Networks Via Progressive Adversarial Training

Towards Noise-Robust Neural Networks via Progressive Adversarial Training

ROBUSTNESS OF DEEP NEURAL NETWORKS TO ADVERSARIAL EXAMPLES

An adversarial defense algorithm based on robust U-net

Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing Their Input Gradients

Enhancing Adversarial Robustness in SNNs with Sparse Gradients

Adaptive Retraining for Neural Network Robustness in Classification

Improving Adversarial Robustness of Deep Neural Networks Via Linear Programming

Training Robust Deep Neural Networks via Adversarial Noise Propagation

Understanding Adversarial Training: Increasing Local Stability of Neural Nets through Robust Optimization

Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data

Robust Sparse Regularization: Defending Adversarial Attacks Via Regularized Sparse Network

Interpreting and Improving Adversarial Robustness of Deep Neural Networks With Neuron Sensitivity

Robust Sparse Regularization: Simultaneously Optimizing Neural Network Robustness and Compactness

A survey of robust adversarial training in pattern recognition: Fundamental, theory, and methodologies

A Direct Approach to Robust Deep Learning Using Adversarial Networks

Improving adversarial robustness of deep neural networks by using semantic information