Robust Neural Networks using Randomized Adversarial Training
It addresses the vulnerability of neural networks to diverse adversarial attacks, offering incremental improvements for security-critical applications.
This paper tackles the problem of defending neural networks against adversarial attacks with different norms, showing that existing defenses are ineffective across norms and proposing combined mechanisms that improve protection against both ℓ∞ and ℓ₂ attacks.
This paper tackles the problem of defending a neural network against adversarial attacks crafted with different norms (in particular $\ell_\infty$ and $\ell_2$ bounded adversarial examples). It has been observed that defense mechanisms designed to protect against one type of attacks often offer poor performance against the other. We show that $\ell_\infty$ defense mechanisms cannot offer good protection against $\ell_2$ attacks and vice-versa, and we provide both theoretical and empirical insights on this phenomenon. Then, we discuss various ways of combining existing defense mechanisms in order to train neural networks robust against both types of attacks. Our experiments show that these new defense mechanisms offer better protection when attacked with both norms.