Stratified Adversarial Robustness with Rejection
Recently, there is an emerging interest in adversarially training a classifier with a rejection option (also known as a selective classifier) for boosting adversarial robustness. While rejection can incur a cost in many applications, existing studies typically associate zero cost with rejecting perturbed inputs, which can result in the rejection of numerous slightly-perturbed inputs that could be correctly classified. In this work, we study adversarially-robust classification with rejection in the stratified rejection setting, where the rejection cost is modeled by rejection loss functions monotonically non-increasing in the perturbation magnitude. We theoretically analyze the stratified rejection setting and propose a novel defense method -- Adversarial Training with Consistent Prediction-based Rejection (CPR) -- for building a robust selective classifier. Experiments on image datasets demonstrate that the proposed method significantly outperforms existing methods under strong adaptive attacks. For instance, on CIFAR-10, CPR reduces the total robust loss (for different rejection losses) by at least 7.3% under both seen and unseen attacks.
Code (1)
Tasks
Adversarial RobustnessRobust classificationSimilar Papers 제목 키워드 기반
Revisiting Adversarial Robustness of Classifiers With a Reject Option
Adversarial training of deep neural networks (DNNs) is an important defense mechanism that allows a DNN to be robust to input perturbations, that can otherwise result in predictions errors. Recently, there is a growing i…
Adversarial Robustnessimage-classificationImage ClassificationTwo Coupled Rejection Metrics Can Tell Adversarial Examples Apart
Correctly classifying adversarial examples is an essential but challenging requirement for safely deploying machine learning models. As reported in RobustBench, even the state-of-the-art adversarially trained models stru…
Vocal Bursts Valence PredictionAdversarial Defense by Stratified Convolutional Sparse Coding
We propose an adversarial defense method that achieves state-of-the-art performance among attack-agnostic adversarial defense methods while also maintaining robustness to input resolution, scale of adversarial perturbati…
Adversarial DefenseTwo Heads are Better than One: Towards Better Adversarial Robustness by Combining Transduction and Rejection
Both transduction and rejection have emerged as important techniques for defending against adversarial perturbations. A recent work by Tram\`er showed that, in the rejection-only case (no transduction), a strong rejectio…
Adversarial RobustnessMeasuring Equality in Machine Learning Security Defenses: A Case Study in Speech Recognition
Over the past decade, the machine learning security community has developed a myriad of defenses for evasion attacks. An understudied question in that community is: for whom do these defenses defend? This work considers …
Adversarial RobustnessFairnessspeech-recognitionSpeech Recognition