Beyond cross-entropy: learning highly separable feature distributions for robust and accurate classification
This addresses the critical issue of adversarial robustness in deep learning for image classification, offering a solution that enhances security without sacrificing performance, though it appears incremental as it builds on existing loss function frameworks.
The paper tackles the problem of deep classifiers being vulnerable to adversarial attacks, which often reduces accuracy, by proposing the Gaussian class-conditional simplex (GCCS) loss to learn highly separable feature distributions, resulting in improved robustness and accuracy that outperforms state-of-the-art methods on challenging datasets.
Deep learning has shown outstanding performance in several applications including image classification. However, deep classifiers are known to be highly vulnerable to adversarial attacks, in that a minor perturbation of the input can easily lead to an error. Providing robustness to adversarial attacks is a very challenging task especially in problems involving a large number of classes, as it typically comes at the expense of an accuracy decrease. In this work, we propose the Gaussian class-conditional simplex (GCCS) loss: a novel approach for training deep robust multiclass classifiers that provides adversarial robustness while at the same time achieving or even surpassing the classification accuracy of state-of-the-art methods. Differently from other frameworks, the proposed method learns a mapping of the input classes onto target distributions in a latent space such that the classes are linearly separable. Instead of maximizing the likelihood of target labels for individual samples, our objective function pushes the network to produce feature distributions yielding high inter-class separation. The mean values of the distributions are centered on the vertices of a simplex such that each class is at the same distance from every other class. We show that the regularization of the latent space based on our approach yields excellent classification accuracy and inherently provides robustness to multiple adversarial attacks, both targeted and untargeted, outperforming state-of-the-art approaches over challenging datasets.