Robust Neural Networks using Randomized Adversarial Training

Understand

This paper tackles the problem of defending a neural network against adversarial attacks crafted with different norms (in particular $\ell_\infty$ and $\ell_2$ bounded adversarial examples).

• It has been observed that defense mechanisms designed to protect against one type of attacks often offer poor performance against the other.
• We show that $\ell_\infty$ defense mechanisms cannot offer good protection against $\ell_2$ attacks and vice-versa, and we provide both theoretical and empirical insights on this phenomenon.
• Then, we discuss various ways of combining existing defense mechanisms in order to train neural networks robust against both types of attacks.