{"type":"ScholarlyArticle","title":"Feature Prioritization and Regularization Improve Standard Accuracy and Adversarial Robustness","authors":[{"name":"Chihuang Liu","slug":"chihuang-liu","given":"Chihuang","family":"Liu","affiliation":"Institute for Advanced Computer Studies and Department of Electrical and Computer Engineering University of Maryland , College Park , MD 20742 , USA"},{"name":"Joseph JaJa","slug":"joseph-jaja","given":"Joseph","family":"JaJa","affiliation":"Institute for Advanced Computer Studies and Department of Electrical and Computer Engineering University of Maryland , College Park , MD 20742 , USA"}],"abstract":"Adversarial training has been successfully applied to build robust models at a certain cost. While the robustness of a model increases, the standard classification accuracy declines. This phenomenon is suggested to be an inherent trade-off. We propose a model that employs feature prioritization by a nonlinear attention module and L2 feature regularization to improve the adversarial robustness and the standard accuracy relative to adversarial training. The attention module encourages the model to rely heavily on robust features by assigning larger weights to them while suppressing non-robust features. The regularizer encourages the model to extract similar features for the natural and adversarial images, effectively ignoring the added perturbation. In addition to evaluating the robustness of our model, we provide justification for the attention module and propose a novel experimental strategy that quantitatively demonstrates that our model is almost ideally aligned with salient data characteristics. Additional experimental results illustrate the power of our model relative to the state of the art methods.","doi":"10.24963/ijcai.2019/415","url":"https://ijcai.org/proceedings/2019/415","pdf":"https://ijcai.org/proceedings/2019/0415.pdf","markdown":"https://ijcai.org/proceedings/2019/415.md","bibtex":"https://ijcai.org/proceedings/2019/bibtex/415","volume":{"slug":"2019","title":"Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2019","url":"https://ijcai.org/proceedings/2019/","year":2019,"location":"Macao","dates":"10-16 August 2019","editors":"Sarit Kraus","isbn":"978-0-9992411-4-1","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2019"},"section":"Machine Learning A-L","track":"Main track","number":415,"pages":{"first":2994,"last":3000},"keywords":["Machine Learning: Adversarial Machine Learning","Machine Learning: Deep Learning"],"videos":[],"references":[{"position":1,"raw":"[Akhtar and Mian, 2018] Naveed Akhtar and Ajmal Mian. Threat of adversarial attacks on deep learning in computer vision: A survey. arXiv preprint arXiv:1801.00553, 2018.","title":"Threat of adversarial attacks on deep learning in computer vision: A survey","authors":"Naveed Akhtar, Ajmal Mian","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Athalye and Carlini, 2018] Anish Athalye and Nicholas Carlini. On the robustness of the cvpr 2018 white- box adversarial example defenses. arXiv preprint arXiv:1804.03286, 2018.","title":"On the robustness of the cvpr 2018 whitebox adversarial example defenses","authors":"Anish Athalye, Nicholas Carlini","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Athalye and Sutskever, 2017] Anish Athalye and Ilya Sutskever. Synthesizing robust adversarial examples. arXiv preprint arXiv:1707.07397, 2017.","title":"Synthesizing robust adversarial examples","authors":"Anish Athalye, Ilya Sutskever","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Athalye et al., 2018] Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. arXiv preprint arXiv:1802.00420, 2018.","title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","authors":"Anish Athalye, Nicholas Carlini, David Wagner","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Carlini and Wagner, 2017] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium on Security and Privacy (SP), pages 39-57. IEEE, 2017.","title":"Towards evaluating the robustness of neural networks","authors":"Wagner Carlini, Nicholas Carlini, David Wagner","year":"2017","venue":"IEEE Symposium on Security and Privacy (SP)","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Dvijotham et al., 2018] Krishnamurthy Dvijotham, Sven Gowal, Robert Stanforth, Relja Arandjelovic, Brendan O'Donoghue, Jonathan Uesato, and Pushmeet Kohli. Training verified learners with learned verifiers. arXiv preprint arXiv:1805.10265, 2018.","title":"Training verified learners with learned verifiers","authors":"Krishnamurthy Dvijotham, Sven Gowal, Robert Stanforth, Relja Arandjelovic, O' Brendan, Jonathan Donoghue, Pushmeet Uesato, Kohli","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Fawzi et al., 2018] Alhussein Fawzi, Omar Fawzi, and Pas- cal Frossard. Analysis of classifiers' robustness to adver- sarial perturbations. Machine Learning, 107(3):481-508, 2018.","title":"Analysis of classifiers' robustness to adversarial perturbations","authors":"Fawzi","year":"2018","venue":"Machine Learning","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Goodfellow et al., 2015] Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2015.","title":"Explaining and harnessing adversarial examples","authors":"Ian J Goodfellow, Jonathon Shlens, Christian Szegedy","year":"2015","venue":null,"doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Goodfellow et al., 2016] Ian Goodfellow, Yoshua Bengio, Aaron Courville, and Yoshua Bengio. Deep learning, vol- ume 1. MIT Press, 2016.","title":"Deep learning","authors":"Ian Goodfellow, Yoshua Bengio, Aaron Courville, Yoshua Bengio","year":"2016","venue":null,"doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Jetley et al., 2018] Saumya Jetley, Nicholas A Lord, Namhoon Lee, and Philip HS Torr. Learn to pay attention. arXiv preprint arXiv:1804.02391, 2018.","title":"Learn to pay attention","authors":"Saumya Jetley, Nicholas A Lord, Namhoon Lee, Philip Hs Torr","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Kannan et al., 2018] Harini Kannan, Alexey Kurakin, and Ian Goodfellow. Adversarial logit pairing. arXiv preprint arXiv:1803.06373, 2018.","title":"Adversarial logit pairing","authors":"Alexey Harini Kannan, Ian Kurakin, Goodfellow","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Kolter and Wong, 2017] J Zico Kolter and Eric Wong. Provable defenses against adversarial examples via the convex outer adversarial polytope. arXiv preprint arXiv:1711.00851, 2017.","title":"Provable defenses against adversarial examples via the convex outer adversarial polytope","authors":"Wong ; ] J Zico Kolter, Eric Kolter, Wong","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Kurakin et al., 2016] Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning at scale. arXiv preprint arXiv:1611.01236, 2016.","title":"Adversarial machine learning at scale","authors":"Alexey Kurakin, Ian Goodfellow, Samy Bengio","year":"2016","venue":null,"doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Liao et al., 2017] Fangzhou Liao, Ming Liang, Yinpeng Dong, Tianyu Pang, Xiaolin Hu, and Jun Zhu. Defense against adversarial attacks using high-level representation guided denoiser. arXiv preprint arXiv:1712.02976, 2017.","title":"Defense against adversarial attacks using high-level representation guided denoiser","authors":"Fangzhou Liao, Ming Liang, Yinpeng Dong, Tianyu Pang, Xiaolin Hu, Jun Zhu","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Madry et al., 2017] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083, 2017.","title":"Towards deep learning models resistant to adversarial attacks","authors":"Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, Adrian Vladu","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Na et al., 2017] Taesik Na, Jong Hwan Ko, and Saibal Mukhopadhyay. Cascade adversarial machine learning regularized with a unified embedding. arXiv preprint arXiv:1708.02582, 2017.","title":"Cascade adversarial machine learning regularized with a unified embedding","authors":"Na","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Prakash et al., 2018] Aaditya Prakash, Nick Moran, Solomon Garber, Antonella DiLillo, and James Storer. Deflecting adversarial attacks with pixel deflection. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 8571-8580, 2018.","title":"Deflecting adversarial attacks with pixel deflection","authors":"Aaditya Prakash, Nick Moran, Solomon Garber, Antonella Dilillo, James Storer","year":"2018","venue":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Samangouei et al., 2018] Pouya Samangouei, Maya Kabkab, and Rama Chellappa. Defense-gan: Protecting classifiers against adversarial attacks using generative models. arXiv preprint arXiv:1805.06605, 2018.","title":"Defense-gan: Protecting classifiers against adversarial attacks using generative models","authors":"Pouya Samangouei, Maya Kabkab, Rama Chellappa","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Seo et al., 2016] Paul Hongsuck Seo, Zhe Lin, Scott Cohen, Xiaohui Shen, and Bohyung Han. Progressive attention networks for visual attribute prediction. arXiv preprint arXiv:1606.02393, 2016.","title":"Progressive attention networks for visual attribute prediction","authors":"Paul Hongsuck, Seo, Zhe Lin, Scott Cohen, Xiaohui Shen, Bohyung Han","year":"2016","venue":null,"doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Simonyan and Zisserman, 2014] Karen Simonyan and An- drew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556, 2014.","title":"Very deep convolutional networks for large-scale image recognition","authors":"Karen Simonyan, Andrew Zisserman","year":"2014","venue":null,"doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Song et al., 2017] Yang Song, Taesup Kim, Sebastian Nowozin, Stefano Ermon, and Nate Kushman. Pix- eldefend: Leveraging generative models to understand and defend against adversarial examples. arXiv preprint arXiv:1710.10766, 2017.","title":"Pixeldefend: Leveraging generative models to understand and defend against adversarial examples","authors":"Yang Song, Taesup Kim, Sebastian Nowozin, Stefano Ermon, Nate Kushman","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Song et al., 2018] Chuanbiao Song, Kun He, Liwei Wang, and John E Hopcroft. Improving the generalization of ad- versarial training with domain adaptation. arXiv preprint arXiv:1810.00740, 2018.","title":"Improving the generalization of adversarial training with domain adaptation","authors":"Song","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Szegedy et al., 2013] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013.","title":"Intriguing properties of neural networks","authors":"Szegedy","year":"2013","venue":null,"doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Tanay et al., 2018] Thomas Tanay, Jerone TA Andrews, and Lewis D Griffin. Built-in vulnerabilities to im- perceptible adversarial perturbations. arXiv preprint arXiv:1806.07409, 2018.","title":"Built-in vulnerabilities to imperceptible adversarial perturbations","authors":"Thomas Tanay, T A Jerone, Lewis D Andrews, Griffin","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Tramèr et al., 2017] Florian Tramèr, Alexey Kurakin, Nico- las Papernot, Ian Goodfellow, Dan Boneh, and Patrick Mc- Daniel. Ensemble adversarial training: Attacks and de- fenses. arXiv preprint arXiv:1705.07204, 2017.","title":"Ensemble adversarial training: Attacks and defenses","authors":"Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, Patrick Mc-Daniel","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":26,"raw":"[Tsipras et al., 2018] Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. There is no free lunch in adversarial robust- ness (but there are unexpected benefits). arXiv preprint arXiv:1805.12152, 2018.","title":"There is no free lunch in adversarial robustness (but there are unexpected benefits)","authors":"Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, Aleksander Madry","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":27,"raw":"[Wong and Kolter, 2018] Eric Wong and Zico Kolter. Prov- able defenses against adversarial examples via the convex outer adversarial polytope. In International Conference on Machine Learning, pages 5283-5292, 2018.","title":"Provable defenses against adversarial examples via the convex outer adversarial polytope","authors":"Kolter ; Wong, Eric Wong, Zico Kolter","year":"2018","venue":"International Conference on Machine Learning","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}