DVERGE: Diversifying Vulnerabilities for Enhanced Robust Generation of Ensembles

Understand

Recent research finds CNN models for image classification demonstrate overlapped adversarial vulnerabilities: adversarial attacks can mislead CNN models with small perturbations, which can effectively transfer between different models trained on the same dataset.

• Adversarial training, as a general robustness improvement technique, eliminates the vulnerability in a single model by forcing it to learn robust features.
• The process is hard, often requires models with large capacity, and suffers from significant loss on clean data accuracy.
• Alternatively, ensemble methods are proposed to induce sub-models with diverse outputs against a transfer adversarial example, making the ensemble robust against transfer attacks even if each sub-model is individually non-robust.