Regularized Ensembles and Transferability in Adversarial Learning
Despite the considerable success of convolutional neural networks in a broad array of domains, recent research has shown these to be vulnerable to small adversarial perturbations, commonly known as adversarial examples. Moreover, such examples have shown to be remarkably portable, or transferable, from one model to another, enabling highly successful black-box attacks. We explore this issue of transferability and robustness from two dimensions: first, considering the impact of conventional $l_p$ regularization as well as replacing the top layer with a linear support vector machine (SVM), and second, the value of combining regularized models into an ensemble. We show that models trained with different regularizers present barriers to transferability, as does partial information about the models comprising the ensemble.
Code (0)
등록된 구현이 없습니다.
Similar Papers 제목 키워드 기반
LOTOS: Layer-wise Orthogonalization for Training Robust Ensembles
Transferability of adversarial examples is a well-known property that endangers all classification models, even those that are only accessible through black-box queries. Prior work has shown that an ensemble of models is…
Towards the Transferable Audio Adversarial Attack via Ensemble Methods
In recent years, deep learning (DL) models have achieved significant progress in many domains, such as autonomous driving, facial recognition, and speech recognition. However, the vulnerability of deep learning models to…
Adversarial AttackAutonomous Drivingspeech-recognitionSpeech Recognition+1TREND: Transferability based Robust ENsemble Design
Deep Learning models hold state-of-the-art performance in many fields, but their vulnerability to adversarial examples poses threat to their ubiquitous deployment in practical settings. Additionally, adversarial inputs g…
Adversarial RobustnessQuantizationLRS: Enhancing Adversarial Transferability through Lipschitz Regularized Surrogate
The transferability of adversarial examples is of central importance to transfer-based black-box adversarial attacks. Previous works for generating transferable adversarial examples focus on attacking \emph{given} pretra…
Adversarial RobustnessDefending against black-box adversarial attacks with gradient-free trained sign activation neural networks
Binary neural networks have been shown to be more adversarially robust than full-precision networks but their improvements are marginal. We propose an ensemble of sign activation neural networks trained with a novel grad…
Adversarial Defense