Perturbation Augmentation for Adversarial Training with Diverse Attacks

Duygu Serbes; İnci M. Baytaş

Makale detayları

Perturbation Augmentation for Adversarial Training with Diverse Attacks

Yazarlar:

Duygu Serbes | İnci M. Baytaş

Yayıncı:

Gazi University

Ana Başlıklar:

Deep Learning

Dergi:

Gazi University Journal of Science Part A: Engineering and Innovation Vol.11 Issue 2, pp.274-288

Belge Tipi:

Makale

Yayın Tarihi:

6/2024

Belge Dili:

İngilizce

Document ID (Org No.):

2001318114

pISSN:

2147-9542

Anahtar kelimeler:

Özet:

 Adversarial Training AT aims to alleviate the vulnerability of deep neural networks to adversarial perturbations. However, the AT techniques struggle to maintain the performance on natural samples while improving the deep models robustness. The absence of perturbation diversity in generated during the adversarial training degrades the generalizability of the robust models, causing overfitting to particular perturbations and a decrease in natural performance. This study proposes an adversarial training framework that augments adversarial directions from a single-step attack to address the trade-off between robustness and generalization. Inspired by feature scattering adversarial training, the proposed framework computes a principal adversarial direction with a single-step attack that finds a perturbation disrupting the inter-sample relationships in the mini-batch during adversarial training. The principal direction obtained at each iteration is augmented by sampling new adversarial directions within a region spanning 45 degrees from the principal adversarial direction. The proposed adversarial training approach does not require extra backpropagation steps in adversarial direction augmentation. Therefore, generalization of the robust model is improved without posing an additional burden on the feature scattering adversarial training. Experiments on CIFAR-10, CIFAR-100, SVHN, Tiny-ImageNet, and The German Traffic Sign Recognition Benchmark consistently improve the accuracy on adversarial with an almost pristine natural performance.

 Adversarial Training AT aims to alleviate the vulnerability of deep neural networks to adversarial perturbations. However, the AT techniques struggle to maintain the performance on natural samples while improving the deep models robustness. The absence of perturbation diversity in generated during the adversarial training degrades the generalizability of the robust models, causing overfitting to particular perturbations and a decrease in natural performance. This study proposes an adversarial training framework that augments adversarial directions from a single-step attack to address the trade-off between robustness and generalization. Inspired by feature scattering adversarial training, the proposed framework computes a principal adversarial direction with a single-step attack that finds a perturbation disrupting the inter-sample relationships in the mini-batch during adversarial training. The principal direction obtained at each iteration is augmented by sampling new adversarial directions within a region spanning 45 degrees from the principal adversarial direction. The proposed adversarial training approach does not require extra backpropagation steps in adversarial direction augmentation. Therefore, generalization of the robust model is improved without posing an additional burden on the feature scattering adversarial training. Experiments on CIFAR-10, CIFAR-100, SVHN, Tiny-ImageNet, and The German Traffic Sign Recognition Benchmark consistently improve the accuracy on adversarial with an almost pristine natural performance.

 Adversarial Training AT aims to alleviate the vulnerability of deep neural networks to adversarial perturbations. However, the AT techniques struggle to maintain the performance on natural samples while improving the deep models robustness. The absence of perturbation diversity in generated during the adversarial training degrades the generalizability of the robust models, causing overfitting to particular perturbations and a decrease in natural performance. This study proposes an adversarial training framework that augments adversarial directions from a single-step attack to address the trade-off between robustness and generalization. Inspired by feature scattering adversarial training, the proposed framework computes a principal adversarial direction with a single-step attack that finds a perturbation disrupting the inter-sample relationships in the mini-batch during adversarial training. The principal direction obtained at each iteration is augmented by sampling new adversarial directions within a region spanning 45 degrees from the principal adversarial direction. The proposed adversarial training approach does not require extra backpropagation steps in adversarial direction augmentation. Therefore, generalization of the robust model is improved without posing an additional burden on the feature scattering adversarial training. Experiments on CIFAR-10, CIFAR-100, SVHN, Tiny-ImageNet, and The German Traffic Sign Recognition Benchmark consistently improve the accuracy on adversarial with an almost pristine natural performance.

 Adversarial Training AT aims to alleviate the vulnerability of deep neural networks to adversarial perturbations. However, the AT techniques struggle to maintain the performance on natural samples while improving the deep models robustness. The absence of perturbation diversity in generated during the adversarial training degrades the generalizability of the robust models, causing overfitting to particular perturbations and a decrease in natural performance. This study proposes an adversarial training framework that augments adversarial directions from a single-step attack to address the trade-off between robustness and generalization. Inspired by feature scattering adversarial training, the proposed framework computes a principal adversarial direction with a single-step attack that finds a perturbation disrupting the inter-sample relationships in the mini-batch during adversarial training. The principal direction obtained at each iteration is augmented by sampling new adversarial directions within a region spanning 45 degrees from the principal adversarial direction. The proposed adversarial training approach does not require extra backpropagation steps in adversarial direction augmentation. Therefore, generalization of the robust model is improved without posing an additional burden on the feature scattering adversarial training. Experiments on CIFAR-10, CIFAR-100, SVHN, Tiny-ImageNet, and The German Traffic Sign Recognition Benchmark consistently improve the accuracy on adversarial with an almost pristine natural performance.

Makale detayları

Perturbation Augmentation for Adversarial Training with Diverse Attacks

Yazarlar:

Duygu Serbes | İnci M. Baytaş

Yayıncı:

Gazi University

Ana Başlıklar:

Deep Learning

Dergi:

Gazi University Journal of Science Part A: Engineering and Innovation Vol.11 Issue 2, pp.274-288

Belge Tipi:

Makale

Yayın Tarihi:

6/2024

Belge Dili:

İngilizce

Document ID (Org No.):

2001318114

pISSN:

2147-9542

Adversarial Attacks

Adversarial Training

Adversarial Robustness

Deep Neural Networks

Sayı

Makale detayları

Perturbation Augmentation for Adversarial Training with Diverse Attacks

Yazarlar: Duygu Serbes | İnci M. Baytaş

Yayıncı: Gazi University

Ana Başlıklar: Deep Learning

Dergi: Gazi University Journal of Science Part A: Engineering and Innovation Vol.11 Issue 2, pp.274-288

Belge Tipi: Makale

Yayın Tarihi: 6/2024

Belge Dili: İngilizce

Document ID (Org No.): 2001318114

pISSN: 2147-9542

Adversarial Attacks

Adversarial Training

Adversarial Robustness

Deep Neural Networks

Sayı

Yazarlar:

Duygu Serbes | İnci M. Baytaş

Yayıncı:

Gazi University

Ana Başlıklar:

Deep Learning

Dergi:

Gazi University Journal of Science Part A: Engineering and Innovation Vol.11 Issue 2, pp.274-288

Belge Tipi:

Makale

Yayın Tarihi:

6/2024

Belge Dili:

İngilizce

Document ID (Org No.):

2001318114

pISSN:

2147-9542