Improving Adversarial Robustness via Promoting Ensemble Diversity
Though deep neural networks have achieved significant progress on various tasks, often enhanced by model ensemble, existing high-performance models can be vulnerable to adversarial attacks. Many efforts have been devoted to enhancing the robustness of individual networks and then constructing a straightforward ensemble, e.g., by directly averaging the outputs, which ignores the interaction among networks. This paper presents a new method that explores the interaction among individual networks to improve robustness for ensemble models. Technically, we define a new notion of ensemble diversity in the adversarial setting as the diversity among non-maximal predictions of individual members, and present an adaptive diversity promoting (ADP) regularizer to encourage the diversity, which leads to globally better robustness for the ensemble by making adversarial examples difficult to transfer among individual members. Our method is computationally efficient and compatible with the defense methods acting on individual networks. Empirical results on various datasets verify that our method can improve adversarial robustness while maintaining state-of-the-art accuracy on normal examples.
Code (6)
Tasks
Adversarial RobustnessDiversitySimilar Papers 제목 키워드 기반
Improving Ensemble Robustness by Collaboratively Promoting and Demoting Adversarial Robustness
Ensemble-based adversarial training is a principled approach to achieve robustness against adversarial attacks. An important technique of this approach is to control the transferability of adversarial examples among ense…
Adversarial RobustnessDiversityTRS: Transferability Reduced Ensemble via Promoting Gradient Diversity and Model Smoothness
Adversarial Transferability is an intriguing property - adversarial perturbation crafted against one model is also effective against another model, while these models are from different model families or training process…
DiversityTRS: Transferability Reduced Ensemble via Encouraging Gradient Diversity and Model Smoothness
Adversarial Transferability is an intriguing property - adversarial perturbation crafted against one model is also effective against another model, while these models are from different model families or training process…
DiversityImproved Robustness Against Adaptive Attacks With Ensembles and Error-Correcting Output Codes
Neural network ensembles have been studied extensively in the context of adversarial robustness and most ensemble-based approaches remain vulnerable to adaptive attacks. In this paper, we investigate the robustness of Er…
Adversarial RobustnessDiversityEnsemble Adversarial Defense via Integration of Multiple Dispersed Low Curvature Models
The integration of an ensemble of deep learning models has been extensively explored to enhance defense against adversarial attacks. The diversity among sub-models increases the attack cost required to deceive the majori…
Adversarial DefenseAdversarial RobustnessDiversity