One Neuron to Fool Them All
This work addresses the root causes of adversarial vulnerability in neural networks, offering a novel perspective that could enhance robustness for security-critical applications, though it is incremental in advancing existing adversarial defense research.
The paper tackles the problem of understanding model susceptibility to adversarial attacks by evaluating the sensitivity of individual neurons, finding that targeting just one sensitive neuron can generate adversarial examples nearly as effectively as full-model attacks on CIFAR-10 and ImageNet. It proposes a regularization term to improve robustness across different perturbation constraints while maintaining accuracy on natural data.
Despite vast research in adversarial examples, the root causes of model susceptibility are not well understood. Instead of looking at attack-specific robustness, we propose a notion that evaluates the sensitivity of individual neurons in terms of how robust the model's output is to direct perturbations of that neuron's output. Analyzing models from this perspective reveals distinctive characteristics of standard as well as adversarially-trained robust models, and leads to several curious results. In our experiments on CIFAR-10 and ImageNet, we find that attacks using a loss function that targets just a single sensitive neuron find adversarial examples nearly as effectively as ones that target the full model. We analyze the properties of these sensitive neurons to propose a regularization term that can help a model achieve robustness to a variety of different perturbation constraints while maintaining accuracy on natural data distributions. Code for all our experiments is available at https://github.com/iamgroot42/sauron .