Perturbation Augmentation for Adversarial Training with Diverse Attacks

Duygu Serbes; İnci M. Baytaş

Article Details

Perturbation Augmentation for Adversarial Training with Diverse Attacks

Authors:

Duygu Serbes | İnci M. Baytaş

Publisher:

Gazi University

Main Topics:

Deep Learning

Journal:

Gazi University Journal of Science Part A: Engineering and Innovation Vol.11 Issue 2, pp.274-288

Document Type:

Article

Publication Date:

6/2024

Document Language:

English

Document ID (Org No.):

2001318114

pISSN:

2147-9542

Keywords:

Abstract:

 Adversarial Training AT aims to alleviate the vulnerability of deep neural networks to adversarial perturbations. However, the AT techniques struggle to maintain the performance on natural samples while improving the deep models robustness. The absence of perturbation diversity in generated during the adversarial training degrades the generalizability of the robust models, causing overfitting to particular perturbations and a decrease in natural performance. This study proposes an adversarial training framework that augments adversarial directions from a single-step attack to address the trade-off between robustness and generalization. Inspired by feature scattering adversarial training, the proposed framework computes a principal adversarial direction with a single-step attack that finds a perturbation disrupting the inter-sample relationships in the mini-batch during adversarial training. The principal direction obtained at each iteration is augmented by sampling new adversarial directions within a region spanning 45 degrees from the principal adversarial direction. The proposed adversarial training approach does not require extra backpropagation steps in adversarial direction augmentation. Therefore, generalization of the robust model is improved without posing an additional burden on the feature scattering adversarial training. Experiments on CIFAR-10, CIFAR-100, SVHN, Tiny-ImageNet, and The German Traffic Sign Recognition Benchmark consistently improve the accuracy on adversarial with an almost pristine natural performance.

 Adversarial Training AT aims to alleviate the vulnerability of deep neural networks to adversarial perturbations. However, the AT techniques struggle to maintain the performance on natural samples while improving the deep models robustness. The absence of perturbation diversity in generated during the adversarial training degrades the generalizability of the robust models, causing overfitting to particular perturbations and a decrease in natural performance. This study proposes an adversarial training framework that augments adversarial directions from a single-step attack to address the trade-off between robustness and generalization. Inspired by feature scattering adversarial training, the proposed framework computes a principal adversarial direction with a single-step attack that finds a perturbation disrupting the inter-sample relationships in the mini-batch during adversarial training. The principal direction obtained at each iteration is augmented by sampling new adversarial directions within a region spanning 45 degrees from the principal adversarial direction. The proposed adversarial training approach does not require extra backpropagation steps in adversarial direction augmentation. Therefore, generalization of the robust model is improved without posing an additional burden on the feature scattering adversarial training. Experiments on CIFAR-10, CIFAR-100, SVHN, Tiny-ImageNet, and The German Traffic Sign Recognition Benchmark consistently improve the accuracy on adversarial with an almost pristine natural performance.

 Adversarial Training AT aims to alleviate the vulnerability of deep neural networks to adversarial perturbations. However, the AT techniques struggle to maintain the performance on natural samples while improving the deep models robustness. The absence of perturbation diversity in generated during the adversarial training degrades the generalizability of the robust models, causing overfitting to particular perturbations and a decrease in natural performance. This study proposes an adversarial training framework that augments adversarial directions from a single-step attack to address the trade-off between robustness and generalization. Inspired by feature scattering adversarial training, the proposed framework computes a principal adversarial direction with a single-step attack that finds a perturbation disrupting the inter-sample relationships in the mini-batch during adversarial training. The principal direction obtained at each iteration is augmented by sampling new adversarial directions within a region spanning 45 degrees from the principal adversarial direction. The proposed adversarial training approach does not require extra backpropagation steps in adversarial direction augmentation. Therefore, generalization of the robust model is improved without posing an additional burden on the feature scattering adversarial training. Experiments on CIFAR-10, CIFAR-100, SVHN, Tiny-ImageNet, and The German Traffic Sign Recognition Benchmark consistently improve the accuracy on adversarial with an almost pristine natural performance.

 Adversarial Training AT aims to alleviate the vulnerability of deep neural networks to adversarial perturbations. However, the AT techniques struggle to maintain the performance on natural samples while improving the deep models robustness. The absence of perturbation diversity in generated during the adversarial training degrades the generalizability of the robust models, causing overfitting to particular perturbations and a decrease in natural performance. This study proposes an adversarial training framework that augments adversarial directions from a single-step attack to address the trade-off between robustness and generalization. Inspired by feature scattering adversarial training, the proposed framework computes a principal adversarial direction with a single-step attack that finds a perturbation disrupting the inter-sample relationships in the mini-batch during adversarial training. The principal direction obtained at each iteration is augmented by sampling new adversarial directions within a region spanning 45 degrees from the principal adversarial direction. The proposed adversarial training approach does not require extra backpropagation steps in adversarial direction augmentation. Therefore, generalization of the robust model is improved without posing an additional burden on the feature scattering adversarial training. Experiments on CIFAR-10, CIFAR-100, SVHN, Tiny-ImageNet, and The German Traffic Sign Recognition Benchmark consistently improve the accuracy on adversarial with an almost pristine natural performance.

Article Details

Perturbation Augmentation for Adversarial Training with Diverse Attacks

Authors:

Duygu Serbes | İnci M. Baytaş

Publisher:

Gazi University

Main Topics:

Deep Learning

Journal:

Gazi University Journal of Science Part A: Engineering and Innovation Vol.11 Issue 2, pp.274-288

Document Type:

Article

Publication Date:

6/2024

Document Language:

English

Document ID (Org No.):

2001318114

pISSN:

2147-9542

Adversarial Attacks

Adversarial Training

Adversarial Robustness

Deep Neural Networks

Issues

Article Details

Perturbation Augmentation for Adversarial Training with Diverse Attacks

Authors: Duygu Serbes | İnci M. Baytaş

Publisher: Gazi University

Main Topics: Deep Learning

Journal: Gazi University Journal of Science Part A: Engineering and Innovation Vol.11 Issue 2, pp.274-288

Document Type: Article

Publication Date: 6/2024

Document Language: English

Document ID (Org No.): 2001318114

pISSN: 2147-9542

Adversarial Attacks

Adversarial Training

Adversarial Robustness

Deep Neural Networks

Issues

Authors:

Duygu Serbes | İnci M. Baytaş

Publisher:

Gazi University

Main Topics:

Deep Learning

Journal:

Gazi University Journal of Science Part A: Engineering and Innovation Vol.11 Issue 2, pp.274-288

Document Type:

Article

Publication Date:

6/2024

Document Language:

English

Document ID (Org No.):

2001318114

pISSN:

2147-9542