{"type":"ScholarlyArticle","title":"Improving the Robustness of Deep Neural Networks via Adversarial Training with Triplet Loss","authors":[{"name":"Pengcheng Li","slug":"pengcheng-li","given":"Pengcheng","family":"Li","affiliation":"National Key Laboratory for Novel Software Technology Nanjing University , Nanjing 210023 , China"},{"name":"Jinfeng Yi","slug":"jinfeng-yi","given":"Jinfeng","family":"Yi","affiliation":"JD AI Research , China"},{"name":"Bowen Zhou","slug":"bowen-zhou","given":"Bowen","family":"Zhou","affiliation":"JD AI Research , China"},{"name":"Lijun Zhang","slug":"lijun-zhang","given":"Lijun","family":"Zhang","affiliation":"National Key Laboratory for Novel Software Technology Nanjing University , Nanjing 210023 , China"}],"abstract":"Recent studies have highlighted that deep neural networks (DNNs) are vulnerable to adversarial examples. In this paper, we improve the robustness of DNNs by utilizing techniques of Distance Metric Learning. Specifically, we incorporate Triplet Loss, one of the most popular Distance Metric Learning methods, into the framework of adversarial training. Our proposed algorithm, Adversarial Training with Triplet Loss (AT2L), substitutes the adversarial example against the current model for the anchor of triplet loss to effectively smooth the classification boundary. Furthermore, we propose an ensemble version of AT2L, which aggregates different attack methods and model structures for better defense effects. Our empirical studies verify that the proposed approach can significantly improve the robustness of DNNs without sacrificing accuracy. Finally, we demonstrate that our specially designed triplet loss can also be used as a regularization term to enhance other defense methods.","doi":"10.24963/ijcai.2019/403","url":"https://ijcai.org/proceedings/2019/403","pdf":"https://ijcai.org/proceedings/2019/0403.pdf","markdown":"https://ijcai.org/proceedings/2019/403.md","bibtex":"https://ijcai.org/proceedings/2019/bibtex/403","volume":{"slug":"2019","title":"Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2019","url":"https://ijcai.org/proceedings/2019/","year":2019,"location":"Macao","dates":"10-16 August 2019","editors":"Sarit Kraus","isbn":"978-0-9992411-4-1","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2019"},"section":"Machine Learning A-L","track":"Main track","number":403,"pages":{"first":2909,"last":2915},"keywords":["Machine Learning: Deep Learning","Machine Learning: Classification","Computer Vision: Computer Vision"],"videos":[],"references":[{"position":1,"raw":"[Athalye et al., 2018] Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. arXiv preprint arXiv:1802.00420, 2018.","title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","authors":"Anish Athalye, Nicholas Carlini, David Wagner","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Buckman et al., 2018] Jacob Buckman, Aurko Roy, Colin Raffel, and Ian Goodfellow. Thermometer encoding: One hot way to resist adversarial examples. In Proceedings of the International Conference on Learning Representa- tions, 2018.","title":"Thermometer encoding: One hot way to resist adversarial examples","authors":"Buckman","year":"2018","venue":"Proceedings of the International Conference on Learning Representations","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Carlini and Wagner, 2017a] Nicholas Carlini and David Wagner. Adversarial examples are not easily detected: Bypassing ten detection methods. In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Secu- rity, pages 3-14. ACM, 2017.","title":"Adversarial examples are not easily detected: Bypassing ten detection methods","authors":"Wagner Carlini, Nicholas Carlini, David Wagner","year":"2017","venue":"Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Carlini and Wagner, 2017b] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural net- works. In IEEE Symposium on Security and Privacy, 2017.","title":"Towards evaluating the robustness of neural networks","authors":"Wagner Carlini, Nicholas Carlini, David Wagner","year":"2017","venue":"IEEE Symposium on Security and Privacy","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Chen et al., 2017] Pin-Yu Chen, Yash Sharma, Huan Zhang, Jinfeng Yi, and Cho-Jui Hsieh. Ead: elastic-net attacks to deep neural networks via adversarial examples. arXiv preprint arXiv:1709.04114, 2017.","title":"Ead: elastic-net attacks to deep neural networks via adversarial examples","authors":"Chen","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Dhillon et al., 2018] Guneet S Dhillon, Kamyar Azizzade- nesheli, Zachary C Lipton, Jeremy Bernstein, Jean Kos- saifi, Aran Khanna, and Anima Anandkumar. Stochastic activation pruning for robust adversarial defense. arXiv preprint arXiv:1803.01442, 2018.","title":"Stochastic activation pruning for robust adversarial defense","authors":"Kamyar Guneet S Dhillon, Zachary C Azizzadenesheli, Jeremy Lipton, Jean Bernstein, Aran Kossaifi, Anima Khanna, Anandkumar","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Elson et al., 2007] Jeremy Elson, John JD Douceur, Jon Howell, and Jared Saul. Asirra: a captcha that exploits interest-aligned manual image categorization. 2007.","title":"Asirra: a captcha that exploits interest-aligned manual image categorization","authors":"Jeremy Elson, John Jd Douceur, Jon Howell, Jared Saul","year":"2007","venue":null,"doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Evtimov et al., 2017] Ivan Evtimov, Kevin Eykholt, Ear- lence Fernandes, Tadayoshi Kohno, Bo Li, Atul Prakash, Amir Rahmati, and Dawn Song. Robust physical-world attacks on machine learning models. arXiv preprint arXiv:1707.08945, 2017.","title":"Robust physical-world attacks on machine learning models","authors":"Ivan Evtimov, Kevin Eykholt, Earlence Fernandes, Tadayoshi Kohno, Bo Li, Atul Prakash, Amir Rahmati, Dawn Song","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Goodfellow et al., 2014] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014.","title":"Explaining and harnessing adversarial examples","authors":"Ian J Goodfellow, Jonathon Shlens, Christian Szegedy","year":"2014","venue":null,"doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[He et al., 2017] Warren He, James Wei, Xinyun Chen, Nicholas Carlini, and Dawn Song. Adversarial exam- ple defenses: Ensembles of weak defenses are not strong. arXiv preprint arXiv:1706.04701, 2017.","title":"Adversarial example defenses: Ensembles of weak defenses are not strong","authors":"Warren He, James Wei, Xinyun Chen, Nicholas Carlini, Dawn Song","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Krizhevsky and Hinton, 2009] Alex Krizhevsky and Geof- frey Hinton. Learning multiple layers of features from tiny images. 2009.","title":"Learning multiple layers of features from tiny images","authors":"Alex Krizhevsky, Geoffrey Hinton","year":"2009","venue":null,"doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Kurakin et al., 2016a] Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. arXiv preprint arXiv:1607.02533, 2016.","title":"Adversarial examples in the physical world","authors":"Kurakin","year":"2016","venue":null,"doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Kurakin et al., 2016b] Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning at scale. arXiv preprint arXiv:1611.01236, 2016.","title":"Adversarial machine learning at scale","authors":"Kurakin","year":"2016","venue":null,"doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[LeCun, 1998] Yann LeCun. The mnist database of hand- written digits. http://yann. lecun. com/exdb/mnist/, 1998.","title":"The mnist database of handwritten digits","authors":"Yann Lecun","year":null,"venue":null,"doi":null,"url":"http://yann.lecun.com/exdb/mnist/,1998","internal_url":null},{"position":15,"raw":"[Li et al., 2018] Pengcheng Li, Jinfeng Yi, and Lijun Zhang. Query-efficient black-box attack by active learning. In Proceedings of the 18th IEEE International Conference on Data Mining, pages 1200-1205, 2018.","title":"Query-efficient black-box attack by active learning","authors":"Li","year":"2018","venue":"Proceedings of the 18th IEEE International Conference on Data Mining","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Moosavi-Dezfooli et al., 2016] Seyed-Mohsen Moosavi- Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deep- fool: a simple and accurate method to fool deep neural networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 2574-2582, 2016.","title":"Deepfool: a simple and accurate method to fool deep neural networks","authors":"Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Pascal Frossard","year":"2016","venue":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Ouyang and Wang, 2013] Wanli Ouyang and Xiaogang Wang. Joint deep learning for pedestrian detection. In Pro- ceedings of the IEEE International Conference on Com- puter Vision, pages 2056-2063, 2013.","title":"Joint deep learning for pedestrian detection","authors":"Wang ; ] Wanli Ouyang, Xiaogang Ouyang, Wang","year":"2013","venue":"Proceedings of the IEEE International Conference on Computer Vision","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Papernot et al., 2016] Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z Berkay Celik, and Anan- thram Swami. The limitations of deep learning in adver- sarial settings. In 2016 IEEE European Symposium on Se- curity and Privacy, pages 372-387. IEEE, 2016.","title":"The limitations of deep learning in adversarial settings","authors":"Nicolas Papernot, Patrick Mcdaniel, Somesh Jha, Matt Fredrikson, Z Berkay Celik, Ananthram Swami","year":"2016","venue":"IEEE European Symposium on Security and Privacy","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Papernot et al., 2017] Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Anan- thram Swami. Practical black-box attacks against machine learning. In Proceedings of the 2017 ACM on Asia Con- ference on Computer and Communications Security, pages 506-519. ACM, 2017.","title":"Practical black-box attacks against machine learning","authors":"Nicolas Papernot, Patrick Mcdaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, Ananthram Swami","year":"2017","venue":"Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Samangouei et al., 2018] Pouya Samangouei, Maya Kabkab, and Rama Chellappa. Defense-gan: Protecting classifiers against adversarial attacks using generative models. arXiv preprint arXiv:1805.06605, 2018.","title":"Defense-gan: Protecting classifiers against adversarial attacks using generative models","authors":"Pouya Samangouei, Maya Kabkab, Rama Chellappa","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Schroff et al., 2015] Florian Schroff, Dmitry Kalenichenko, and James Philbin. Facenet: A unified embedding for face recognition and clustering. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 815-823, 2015.","title":"Facenet: A unified embedding for face recognition and clustering","authors":"Schroff","year":"2015","venue":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Szegedy et al., 2013] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013.","title":"Intriguing properties of neural networks","authors":"Szegedy","year":"2013","venue":null,"doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Tramèr et al., 2018] Florian Tramèr, Alexey Kurakin, Nico- las Papernot, Dan Boneh, and Patrick McDaniel. Ensem- ble adversarial training: Attacks and defenses. In Proceed- ings of the International Conference on Learning Repre- sentations, 2018.","title":"Ensemble adversarial training: Attacks and defenses","authors":"Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Dan Boneh, Patrick Mcdaniel","year":"2018","venue":"Proceedings of the International Conference on Learning Representations","doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Xie et al., 2018] Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan Yuille. Mitigating adversarial effects through randomization. In Proceedings of the Interna- tional Conference on Learning Representations, 2018.","title":"Mitigating adversarial effects through randomization","authors":"Cihang Xie, Jianyu Wang, Zhishuai Zhang, Alan Zhou Ren, Yuille","year":"2018","venue":"Proceedings of the International Conference on Learning Representations","doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Xu et al., 2017] Xiaojun Xu, Xinyun Chen, Chang Liu, Anna Rohrbach, Trevor Darell, and Dawn Song. Can you fool ai with adversarial examples on a visual turing test? arXiv preprint arXiv:1709.08693, 2017.","title":"Can you fool ai with adversarial examples on a visual turing test","authors":"Xiaojun Xu, Xinyun Chen, Chang Liu, Anna Rohrbach, Trevor Darell, Dawn Song","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":26,"raw":"[Yuan et al., 2014] Zhenlong Yuan, Yongqiang Lu, Zhaoguo Wang, and Yibo Xue. Droid-sec: deep learning in android malware detection. In ACM SIGCOMM Computer Com- munication Review, volume 44, pages 371-372. ACM, 2014.","title":"Droid-sec: deep learning in android malware detection","authors":"Yuan","year":"2014","venue":"ACM SIGCOMM Computer Communication Review","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}