Towards Deep Learning Models Resistant to Large Perturbations
This addresses the need for more robust machine learning models against strong adversarial attacks, though it is incremental as it builds on existing adversarial training methods.
The paper tackles the problem of training deep learning models resistant to large adversarial perturbations, showing that standard adversarial training fails at high noise levels, and proposes a weight initialization method that enables learning with perturbations up to ε≈0.40 on MNIST and ε≈32/255 on CIFAR10.
Adversarial robustness has proven to be a required property of machine learning algorithms. A key and often overlooked aspect of this problem is to try to make the adversarial noise magnitude as large as possible to enhance the benefits of the model robustness. We show that the well-established algorithm called "adversarial training" fails to train a deep neural network given a large, but reasonable, perturbation magnitude. In this paper, we propose a simple yet effective initialization of the network weights that makes learning on higher levels of noise possible. We next evaluate this idea rigorously on MNIST ($ε$ up to $\approx 0.40$) and CIFAR10 ($ε$ up to $\approx 32/255$) datasets assuming the $\ell_{\infty}$ attack model. Additionally, in order to establish the limits of $ε$ in which the learning is feasible, we study the optimal robust classifier assuming full access to the joint data and label distribution. Then, we provide some theoretical results on the adversarial accuracy for a simple multi-dimensional Bernoulli distribution, which yields some insights on the range of feasible perturbations for the MNIST dataset.