2017

Exploring the Landscape of Spatial Robustness

Engstrom, Logan, Tran, Brandon, Tsipras, Dimitris et al.

Understand

The study of adversarial robustness has so far largely focused on perturbations bound in p-norms.

However, state-of-the-art models turn out to be also vulnerable to other, more natural classes of perturbations such as translations and rotations.
In this work, we thoroughly investigate the vulnerability of neural network--based classifiers to rotations and translations.
While data augmentation offers relatively small robustness, we use ideas from robust optimization and test-time input aggregation to significantly improve robustness.

Built on

The mnist database of handwritten digits
LeCun, Y · 1998
Earlier work this paper cites.
A unified architecture for natural language processing: Deep neural networks with multitask learning
Collobert, R. and Weston, J · 2008
Earlier work this paper cites.
Robust optimization
Ben-Tal, A., El Ghaoui, L., and Nemirovski, A · 2009
Earlier work this paper cites.
Learning multiple layers of features from tiny images
Krizhevsky, A · 2009
Earlier work this paper cites.
Imagenet classification with deep convolutional neural networks
Krizhevsky, A., Sutskever, I., and Hinton, G. E · 2012
Earlier work this paper cites.
Speech recognition with deep recurrent neural networks
Graves, A., Mohamed, A.-r., and Hinton, G · 2013
Earlier work this paper cites.
Intriguing properties of neural networks
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R · 2014
Earlier work this paper cites.
Deepface: Closing the gap to human-level performance in face verification
Taigman, Y., Yang, M., Ranzato, M., and Wolf, L · 2014
Earlier work this paper cites.
Manitest: Are classifiers really invariant?
Fawzi, A. and Frossard, P · 2015
Earlier work this paper cites.
Explaining and harnessing adversarial examples
Goodfellow, I. J., Shlens, J., and Szegedy, C · 2015
Earlier work this paper cites.
Delving deep into rectifiers: Surpassing human-level performance on imagenet classification
He, K., Zhang, X., Ren, S., and Sun, J · 2015
Earlier work this paper cites.

Similar

Spatial transformer networks
Jaderberg, M., Simonyan, K., Zisserman, A., et al · 2015
Cited alongside, same era.
ImageNet Large Scale Visual Recognition Challenge
Russakovsky, O., Deng, J., Su, H., Krause, J., Satheesh, S., Ma, S., Huang, Z., Karpathy, A., Khosla, A., Bernstein, M., Berg, A. C., and Fei-Fei, L · 2015
Cited alongside, same era.
Tensorflow: A system for large-scale machine learning
Abadi, M., Barham, P., Chen, J., Chen, Z., Davis, A., Dean, J., Devin, M., Ghemawat, S., Irving, G., Isard, M., et al · 2016
Cited alongside, same era.
Deep residual learning for image recognition
He, K., Zhang, X., Ren, S., and Sun, J · 2016
Cited alongside, same era.
Deepfool: a simple and accurate method to fool deep neural networks
Moosavi-Dezfooli, S., Fawzi, A., and Frossard, P · 2016
Cited alongside, same era.
Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition
Sharif, M., Bhagavatula, S., Bauer, L., and Reiter, M. K · 2016
Cited alongside, same era.
Tensorpack
Wu, Y. et al · 2016
Cited alongside, same era.
Exploring the space of black-box attacks on deep neural networks
Original
Bhagoji, A. N., He, W., Li, B., and Song, D · 2017
Cited alongside, same era.
Towards evaluating the robustness of neural networks
Carlini, N. and Wagner, D · 2017
Cited alongside, same era.
Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models
Chen, P.-Y., Zhang, H., Sharma, Y., Yi, J., and Hsieh, C.-J · 2017
Cited alongside, same era.
Adversarial machine learning at scale
Kurakin, A., Goodfellow, I. J., and Bengio, S · 2017
Cited alongside, same era.

Then

Practical black-box attacks against machine learning
Papernot, N., McDaniel, P., Goodfellow, I., Jha, S., Celik, Z. B., and Swami, A · 2017
Closest in time.
Personal communication, 2017
Tramèr, F. and Boneh, D · 2017
Closest in time.
Synthesizing robust adversarial examples
Athalye, A., Engstrom, L., Ilyas, A., and Kwok, K · 2018
Closest in time.
Black-box adversarial attacks with limited queries and information
Ilyas, A., Engstrom, L., Athalye, A., and Lin, J · 2018
Closest in time.
Geometric robustness of deep networks: analysis and improvement
Kanbak, C., Moosavi-Dezfooli, S.-M., and Frossard, P · 2018
Closest in time.
Towards deep learning models resistant to adversarial attacks
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A · 2018
Closest in time.
Certified defenses against adversarial examples
Raghunathan, A., Steinhardt, J., and Liang, P · 2018
Closest in time.
Certifiable distributional robustness with principled adversarial training
Sinha, A., Namkoong, H., and Duchi, J · 2018
Closest in time.
Provable defenses against adversarial examples via the convex outer adversarial polytope
Wong, E. and Kolter, J. Z · 2018
Closest in time.
Spatially transformed adversarial examples
Xiao, C., Zhu, J., Li, B., He, W., Liu, M., and Song, D · 2018
Closest in time.

Beyond the bibliography

alphaXiv searches the wider corpus for related work and actual follow-ups.

Open on alphaXiv

alphaXiv is searching for related work…

Reading the bibliography…