Perceptual Adversarial Robustness: Defense Against Unseen Threat Models

Understand

A key challenge in adversarial robustness is the lack of a precise mathematical characterization of human perception, used in the very definition of adversarial attacks that are imperceptible to human eyes.

• Most current attacks and defenses try to avoid this issue by considering restrictive adversarial threat models such as those bounded by $L_2$ or $L_\infty$ distance, spatial perturbations, etc.
• However, models that are robust against any of these restrictive threat models are still fragile against other threat models.
• To resolve this issue, we propose adversarial training against the set of all imperceptible adversarial examples, approximated using deep neural networks.