Towards Understanding the Generative Capability of Adversarially Robust Classifiers

Zhu, Yao; Ma, Jiacheng; Sun, Jiayi; Chen, Zewei; Jiang, Rongxin; Li, Zhenguo

doi:10.1109/iccv48922.2021.00763

Cited by 11 publications

(9 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We borrow the idea from the score-matching generative models [25,26,27] which propose to estimate the gradient of the ground truth data distribution and then move the initial image from its original distribution p D (x|y 0 ) to the target distribution p D (x|y) iteratively through the Stochastic Gradient Langevin Dynamics (SGLD) [28,56,57]:…”

Section: B Motivationmentioning

confidence: 99%

“…We borrow the idea from the score-matching generative models [25,26,27,28], which propose to estimate the gradient of the ground truth data distribution ∇ x log p D (x|y) and generate the image of the certain distribution iteratively using the estimated gradient of the ground truth data distribution through Langevin dynamics [25,27]. Previous attacks iteratively minimize (maximize) the conditional density of the model p θ (y|x) along the gradient of the conditional density of the model ∇ x log p θ (y|x) to perform the untargeted (targeted) attacks.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Toward Understanding and Boosting Adversarial Transferability From a Distribution Perspective

Zhu

Chen

et al. 2022

IEEE Trans. on Image Process.

View full text Add to dashboard Cite

Transferable adversarial attacks against Deep neural networks (DNNs) have received broad attention in recent years. An adversarial example can be crafted by a surrogate model and then attack the unknown target model successfully, which brings a severe threat to DNNs. The exact underlying reasons for the transferability are still not completely understood. Previous work mostly explores the causes from the model perspective, e.g., decision boundary, model architecture, and model capacity. adversarial attacks against Deep neural networks (DNNs) have received broad attention in recent years. An adversarial example can be crafted by a surrogate model and then attack the unknown target model successfully, which brings a severe threat to DNNs. The exact underlying reasons for the transferability are still not completely understood. Previous work mostly explores the causes from the model perspective, e.g., decision boundary, model architecture, and model capacity.Here, we investigate the transferability from the data distribution perspective and hypothesize that pushing the image away from its original distribution can enhance the adversarial transferability. To be specific, moving the image out of its original distribution makes different models hardly classify the image correctly, which benefits the untargeted attack, and dragging the image into the target distribution misleads the models to classify the image as the target class, which benefits the targeted attack. Towards this end, we propose a novel method that crafts adversarial examples by manipulating the distribution of the image. We conduct comprehensive transferable attacks against multiple DNNs to demonstrate the effectiveness of the proposed method. Our method can significantly improve the transferability of the crafted attacks and achieves state-of-the-art performance in both untargeted and targeted scenarios, surpassing the previous best method by up to 40% in some cases. In summary, our work provides new insight into studying adversarial transferability and provides a strong counterpart for future research on adversarial defense 1 .

show abstract

Section: B Motivationmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Toward Understanding and Boosting Adversarial Transferability From a Distribution Perspective

Zhu

Chen

et al. 2022

IEEE Trans. on Image Process.

View full text Add to dashboard Cite

show abstract

“…Santurkar et al (2019) demonstrated that adversarially robust models can be used for solving various generative tasks, including basic synthesis, inpainting, and superresolution. Zhu et al (2021) drew the connection between adversarial training and energy-based models and proposed a joint energy-adversarial training method for improving the generative capabilities of robust classifiers. Furthermore, Ganz and Elad (2021) proposed using a robust classifier for sample refinement as a post-processing step.…”

Section: Related Workmentioning

confidence: 99%

Enhancing Diffusion-Based Image Synthesis with Robust Classifier Guidance

Kawar¹,

Roy²,

Elad³

2022

Preprint

View full text Add to dashboard Cite

Denoising diffusion probabilistic models (DDPMs) are a recent family of generative models that achieve state-of-the-art results. In order to obtain class-conditional generation, it was suggested to guide the diffusion process by gradients from a time-dependent classifier. While the idea is theoretically sound, deep learning-based classifiers are infamously susceptible to gradient-based adversarial attacks. Therefore, while traditional classifiers may achieve good accuracy scores, their gradients are possibly unreliable and might hinder the improvement of the generation results. Recent work discovered that adversarially robust classifiers exhibit gradients that are aligned with human perception, and these could better guide a generative process towards semantically meaningful images. We utilize this observation by defining and training a timedependent adversarially robust classifier and use it as guidance for a generative diffusion model. In experiments on the highly challenging and diverse ImageNet dataset, our scheme introduces significantly more intelligible intermediate gradients, better alignment with theoretical findings, as well as improved generation results under several evaluation metrics. Furthermore, we conduct an opinion survey whose findings indicate that human raters prefer our method's results.

show abstract

“…Future research could do more work toward creating models with adversarially robust representations [40]. Researchers could enhance data for adversarial robustness by simulating more data [208], augmenting data [149], repurposing existing real data [30,80], and extracting more information from available data [82]. Others could create architectures that are more adversarially robust [203].…”

Section: Adversarial Robustnessmentioning

confidence: 99%

Unsolved Problems in ML Safety

Hendrycks¹,

Carlini²,

Schulman³

et al. 2021

Preprint

View full text Add to dashboard Cite

Machine learning (ML) systems are rapidly increasing in size, are acquiring new capabilities, and are increasingly deployed in high-stakes settings. As with other powerful technologies, safety for ML should be a leading research priority. In response to emerging safety challenges in ML, such as those introduced by recent large-scale models, we provide a new roadmap for ML Safety and refine the technical problems that the field needs to address. We present four problems ready for research, namely withstanding hazards ("Robustness"), identifying hazards ("Monitoring"), steering ML systems ("Alignment"), and reducing risks to how ML systems are handled ("External Safety"). Throughout, we clarify each problem's motivation and provide concrete research directions.

show abstract

Towards Understanding the Generative Capability of Adversarially Robust Classifiers

Cited by 11 publications

References 3 publications

Toward Understanding and Boosting Adversarial Transferability From a Distribution Perspective

Toward Understanding and Boosting Adversarial Transferability From a Distribution Perspective

Enhancing Diffusion-Based Image Synthesis with Robust Classifier Guidance

Unsolved Problems in ML Safety

Contact Info

Product

Resources

About