{"type":"ScholarlyArticle","title":"DDDM: A Brain-Inspired Framework for Robust Classification","authors":[{"name":"Xiyuan Chen","slug":"xiyuan-chen","given":"Xiyuan","family":"Chen","affiliation":"Institute of Neuroscience , Center for Excellence in Brain Science and Intelligence Technology , Chinese Academy of Sciences , Shanghai , China; University of Chinese Academy of Sciences , Beijing , China"},{"name":"Xingyu Li","slug":"xingyu-li","given":"Xingyu","family":"Li","affiliation":"Shanghai Center for Brain Science and Brain-Inspired Technology , Shanghai , China"},{"name":"Yi Zhou","slug":"yi-zhou","given":"Yi","family":"Zhou","affiliation":"National Engineering Laboratory for Brain-inspired Intelligence Technology and Application , School of Information Science and Technology , University of Science and Technology of China , Hefei , China; Shanghai Center for Brain Science and Brain-Inspired Technology , Shanghai , China"},{"name":"Tianming Yang","slug":"tianming-yang","given":"Tianming","family":"Yang","affiliation":"Institute of Neuroscience , Center for Excellence in Brain Science and Intelligence Technology , Chinese Academy of Sciences , Shanghai , China; Shanghai Center for Brain Science and Brain-Inspired Technology , Shanghai , China"}],"abstract":"Despite their outstanding performance in a broad spectrum of real-world tasks, deep artificial neural networks are sensitive to input noises, particularly adversarial perturbations. On the contrary, human and animal brains are much less vulnerable. In contrast to the one-shot inference performed by most deep neural networks, the brain often solves decision-making with an evidence accumulation mechanism that may trade time for accuracy when facing noisy inputs. The mechanism is well described by the Drift-Diffusion Model (DDM). In the DDM, decision-making is modeled as a process in which noisy evidence is accumulated toward a threshold. Drawing inspiration from the DDM, we propose the Dropout-based Drift-Diffusion Model (DDDM) that combines test-phase dropout and the DDM for improving the robustness for arbitrary neural networks. The dropouts create temporally uncorrelated noises in the network that counter perturbations, while the evidence accumulation mechanism guarantees a reasonable decision accuracy. Neural networks enhanced with the DDDM tested in image, speech, and text classification tasks all significantly outperform their native counterparts, demonstrating the DDDM as a task-agnostic defense against adversarial attacks.","doi":"10.24963/ijcai.2022/397","url":"https://ijcai.org/proceedings/2022/397","pdf":"https://ijcai.org/proceedings/2022/0397.pdf","markdown":"https://ijcai.org/proceedings/2022/397.md","bibtex":"https://ijcai.org/proceedings/2022/bibtex/397","volume":{"slug":"2022","title":"Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2022","url":"https://ijcai.org/proceedings/2022/","year":2022,"location":"Vienna","dates":"23-29 July 2022","editors":"Luc De Raedt","isbn":"978-1-956792-00-3","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2022"},"section":"Machine Learning","track":"Main Track","number":397,"pages":{"first":2867,"last":2873},"keywords":["Humans and AI: Brain Sciences","Machine Learning: Robustness"],"videos":[{"label":"Video #1","url":"https://slideslive.com/38987023","length_sec":83,"provider":"slideslive"},{"label":"Video #2","url":"https://slideslive.com/38985166","length_sec":639,"provider":"slideslive"}],"references":[{"position":1,"raw":"[Amodei et al., 2015] Dario Amodei, Rishita Anubhai, Eric Battenberg, Carl Case, Jared Casper, Bryan Catanzaro, Jingdong Chen, Mike Chrzanowski, Adam Coates, Greg Diamos, Erich Elsen, Jesse Engel, Linxi Fan, Christo- pher Fougner, Tony Han, Awni Hannun, Billy Jun, Patrick LeGresley, Libby Lin, Sharan Narang, Andrew Ng, Sherjil Ozair, Ryan Prenger, Jonathan Raiman, Sanjeev Satheesh, David Seetapun, Shubho Sengupta, Yi Wang, Zhiqian Wang, Chong Wang, Bo Xiao, Dani Yogatama, Jun Zhan, and Zhenyao Zhu. Deep Speech 2: End-to-End Speech Recognition in English and Mandarin. arXiv:1512.02595 [cs], December 2015.","title":"Deep Speech 2: End-to-End Speech Recognition in English and Mandarin","authors":"Dario Amodei, Rishita Anubhai, Eric Battenberg, Carl Case, Jared Casper, Bryan Catanzaro, Jingdong Chen, Mike Chrzanowski, Adam Coates, Greg Diamos, Erich Elsen, Jesse Engel, Linxi Fan, Christopher Fougner, Tony Han, Awni Hannun, Billy Jun, Patrick Legresley, Libby Lin, Sharan Narang, Andrew Ng, Sherjil Ozair, Ryan Prenger, Jonathan Raiman, Sanjeev Satheesh, David Seetapun, Shubho Sengupta, Yi Wang, Zhiqian Wang, Chong Wang, Bo Xiao, Dani Yogatama, Jun Zhan, Zhenyao Zhu","year":"2015","venue":null,"doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Andriushchenko et al., 2020] Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square Attack: A Query-Efficient Black-Box Ad- versarial Attack via Random Search. In Andrea Vedaldi, Horst Bischof, Thomas Brox, and Jan-Michael Frahm, editors, Computer Vision -ECCV 2020, volume 12368, pages 484-501. Springer International Publishing, Cham, 2020.","title":"Square Attack: A Query-Efficient Black-Box Adversarial Attack via Random Search","authors":"Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, Matthias Hein","year":"2020","venue":"Computer Vision -ECCV 2020","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Athalye et al., 2018] Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Ex- amples. arXiv:1802.00420 [cs], July 2018.","title":"Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples","authors":"Anish Athalye, Nicholas Carlini, David Wagner","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Carlini and Wagner, 2017] Nicholas Carlini and David Wagner. Towards Evaluating the Robustness of Neural Networks. arXiv:1608.04644 [cs], March 2017.","title":"Towards Evaluating the Robustness of Neural Networks","authors":"Wagner Carlini, Nicholas Carlini, David Wagner","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Carlini and Wagner, 2018] Nicholas Carlini and David Wagner. Audio Adversarial Examples: Targeted Attacks on Speech-to-Text. January 2018.","title":"Audio Adversarial Examples: Targeted Attacks on Speech-to-Text","authors":"Wagner Carlini, Nicholas Carlini, David Wagner","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Dhillon et al., 2018] Guneet S. Dhillon, Kamyar Azizzade- nesheli, Zachary C. Lipton, Jeremy Bernstein, Jean Kos- saifi, Aran Khanna, and Anima Anandkumar. Stochas- tic Activation Pruning for Robust Adversarial Defense. arXiv:1803.01442 [cs, stat], March 2018.","title":"Stochastic Activation Pruning for Robust Adversarial Defense","authors":"S Guneet, Kamyar Dhillon, Zachary C Azizzadenesheli, Jeremy Lipton, Jean Bernstein, Aran Kossaifi, Anima Khanna, Anandkumar","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Elsayed et al., 2018] Gamaleldin F. Elsayed, Shreya Shankar, Brian Cheung, Nicolas Papernot, Alexey Kurakin, Ian Goodfellow, and Jascha Sohl-Dickstein. Adversarial examples that fool both computer vision and time-limited humans. In Proceedings of the 32nd Inter- national Conference on Neural Information Processing Systems, NIPS'18, pages 3914-3924, Red Hook, NY, USA, December 2018.","title":"Adversarial examples that fool both computer vision and time-limited humans","authors":"F Gamaleldin, Shreya Elsayed, Brian Shankar, Nicolas Cheung, Alexey Papernot, Ian Kurakin, Jascha Goodfellow, Sohl-Dickstein","year":"2018","venue":"Proceedings of the 32nd International Conference on Neural Information Processing Systems, NIPS'18","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"Curran Associates Inc. [Engstrom et al., 2019] Logan Engstrom, Brandon Tran, Dimitris Tsipras, Ludwig Schmidt, and Aleksander Madry. Exploring the Landscape of Spatial Robustness. In International Conference on Machine Learning, pages 1802-1811. PMLR, May 2019.","title":"Exploring the Landscape of Spatial Robustness","authors":"Curran Associates, Inc [ Engstrom","year":"2019","venue":"International Conference on Machine Learning","doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Gold and Shadlen, 2007] Joshua I. Gold and Michael N. Shadlen. The Neural Basis of Decision Making. Annual Review of Neuroscience, 30(1):535-574, July 2007.","title":"The Neural Basis of Decision Making","authors":"Joshua I Gold, Michael N Shadlen","year":"2007","venue":"Annual Review of Neuroscience","doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Goodfellow et al., 2015] Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and Harness- ing Adversarial Examples. arXiv:1412.6572 [cs, stat], March 2015.","title":"Explaining and Harnessing Adversarial Examples","authors":"Ian J Goodfellow, Jonathon Shlens, Christian Szegedy","year":"2015","venue":null,"doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Guo et al., 2018] Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens van der Maaten. Countering Adversar- ial Images using Input Transformations. In International Conference on Learning Representations, February 2018.","title":"Countering Adversarial Images using Input Transformations","authors":"Chuan Guo, Mayank Rana, Moustapha Cisse, Laurens Van Der Maaten","year":"2018","venue":"International Conference on Learning Representations","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Hinton et al., 2012] Geoffrey E. Hinton, Nitish Srivastava, Alex Krizhevsky, Ilya Sutskever, and Ruslan R. Salakhut- dinov. Improving neural networks by preventing co- adaptation of feature detectors. arXiv:1207.0580 [cs], July 2012.","title":"Improving neural networks by preventing coadaptation of feature detectors","authors":"Geoffrey E Hinton, Nitish Srivastava, Alex Krizhevsky, Ilya Sutskever, Ruslan R Salakhutdinov","year":"2012","venue":null,"doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Krizhevsky, 2009] Alex Krizhevsky. Learning multiple lay- ers of features from tiny images. Technical report, April 2009.","title":"Learning multiple layers of features from tiny images","authors":"Alex Krizhevsky","year":"2009","venue":null,"doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Lecun et al., 1998] Y. Lecun, L. Bottou, Y. Bengio, and P. Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(11):2278-2324, November 1998.","title":"Gradient-based learning applied to document recognition","authors":"Y Lecun, L Bottou, Y Bengio, P Haffner","year":"1998","venue":"Proceedings of the IEEE","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Li et al., 2019] Jinfeng Li, Shouling Ji, Tianyu Du, Bo Li, and Ting Wang. TextBugger: Generating Adversarial Text Against Real-world Applications. Proceedings 2019 Net- work and Distributed System Security Symposium, 2019.","title":"TextBugger: Generating Adversarial Text Against Real-world Applications","authors":"Jinfeng Li, Shouling Ji, Tianyu Du, Bo Li, Ting Wang","year":"2019","venue":"Proceedings 2019 Network and Distributed System Security Symposium","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Maas et al., 2011] Andrew L. Maas, Raymond E. Daly, Pe- ter T. Pham, Dan Huang, Andrew Y. Ng, and Christopher Potts. Learning Word Vectors for Sentiment Analysis. In Proceedings of the 49th Annual Meeting of the Association for Computational Linguistics: Human Language Tech- nologies, pages 142-150, Portland, Oregon, USA, June 2011. Association for Computational Linguistics.","title":"Learning Word Vectors for Sentiment Analysis","authors":"Andrew L Maas, Raymond E Daly, Peter T Pham, Dan Huang, Andrew Y Ng, Christopher Potts","year":"2011","venue":"Proceedings of the 49th Annual Meeting of the Association for Computational Linguistics: Human Language Technologies","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Madry et al., 2019] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards Deep Learning Models Resistant to Adversarial Attacks. arXiv:1706.06083 [cs, stat], September 2019.","title":"Towards Deep Learning Models Resistant to Adversarial Attacks","authors":"Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, Adrian Vladu","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Moosavi-Dezfooli et al., 2016] Seyed-Mohsen Moosavi- Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deep- Fool: A Simple and Accurate Method to Fool Deep Neural Networks. In 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 2574-2582, June 2016.","title":"Deep-Fool: A Simple and Accurate Method to Fool Deep Neural Networks","authors":"Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Pascal Frossard","year":"2016","venue":"IEEE Conference on Computer Vision and Pattern Recognition (CVPR)","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Qin et al., 2019] Yao Qin, Nicholas Carlini, Ian Goodfel- low, Garrison Cottrell, and Colin Raffel. Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech Recognition. March 2019.","title":"Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech Recognition","authors":"Nicholas Yao Qin, Ian Carlini, Garrison Goodfellow, Colin Cottrell, Raffel","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Ratcliff and McKoon, 2008] Roger Ratcliff and Gail McK- oon. The Diffusion Decision Model: Theory and Data for Two-Choice Decision Tasks. Neural Computation, 20(4):873-922, April 2008.","title":"The Diffusion Decision Model: Theory and Data for Two-Choice Decision Tasks","authors":"Mckoon Ratcliff, Roger Ratcliff, Gail Mckoon","year":"2008","venue":"Neural Computation","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Ratcliff and Rouder, 1998] Roger Ratcliff and Jeffrey N. Rouder. Modeling Response Times for Two-Choice De- cisions. Psychological Science, 9(5):347-356, September 1998.","title":"Modeling Response Times for Two-Choice Decisions","authors":"Roger Ratcliff, Jeffrey N Rouder","year":"1998","venue":"Psychological Science","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Rauber and Bethge, 2020] Jonas Rauber and Matthias Bethge. Fast Differentiable Clipping-Aware Normaliza- tion and Rescaling. arXiv:2007.07677 [cs, stat], July 2020.","title":"Fast Differentiable Clipping-Aware Normalization and Rescaling","authors":"Bethge Rauber, Jonas Rauber, Matthias Bethge","year":"2020","venue":null,"doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Roitman and Shadlen, 2002] Jamie D. Roitman and Michael N. Shadlen. Response of Neurons in the Lateral Intraparietal Area during a Combined Visual Discrimina- tion Reaction Time Task. The Journal of Neuroscience, 22(21):9475-9489, November 2002.","title":"Response of Neurons in the Lateral Intraparietal Area during a Combined Visual Discrimination Reaction Time Task","authors":"Jamie D Roitman, Michael N Shadlen","year":"2002","venue":"The Journal of Neuroscience","doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Roxin, 2019] Alex Roxin. Drift-diffusion models for multiple-alternative forced-choice decision making. The Journal of Mathematical Neuroscience, 9(1):5, December 2019.","title":"Drift-diffusion models for multiple-alternative forced-choice decision making","authors":"Alex Roxin","year":"2019","venue":"The Journal of Mathematical Neuroscience","doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Rusakov et al., 2020] Dmitri A. Rusakov, Leonid P. Savtchenko, and Peter E. Latham. Noisy Synaptic Con- ductance: Bug or a Feature? Trends in Neurosciences, 43(6):363-372, June 2020.","title":"Noisy Synaptic Conductance: Bug or a Feature","authors":"Dmitri A Rusakov, Leonid P Savtchenko, Peter E Latham","year":"2020","venue":"Trends in Neurosciences","doi":null,"url":null,"internal_url":null},{"position":26,"raw":"[Simonyan and Zisserman, 2015] Karen Simonyan and An- drew Zisserman. Very Deep Convolutional Networks for Large-Scale Image Recognition. arXiv:1409.1556 [cs], April 2015.","title":"Very Deep Convolutional Networks for Large-Scale Image Recognition","authors":"Karen Simonyan, Andrew Zisserman","year":"2015","venue":null,"doi":null,"url":null,"internal_url":null},{"position":27,"raw":"[Wang, 2002] Xiao-Jing Wang. Probabilistic Decision Mak- ing by Slow Reverberation in Cortical Circuits. Neuron, 36(5):955-968, December 2002.","title":"Probabilistic Decision Making by Slow Reverberation in Cortical Circuits","authors":"Xiao-Jing Wang","year":"2002","venue":"Neuron","doi":null,"url":null,"internal_url":null},{"position":28,"raw":"[Warden, 2018] Pete Warden. Speech Commands: A Dataset for Limited-Vocabulary Speech Recognition. arXiv:1804.03209 [cs], April 2018.","title":"Pete Warden. Speech Commands: A Dataset for Limited-Vocabulary Speech Recognition","authors":"Warden","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":29,"raw":"[Wong and Wang, 2006] Kong-Fatt Wong and Xiao-Jing Wang. A Recurrent Network Mechanism of Time Inte- gration in Perceptual Decisions. Journal of Neuroscience, 26(4):1314-1328, January 2006.","title":"A Recurrent Network Mechanism of Time Integration in Perceptual Decisions","authors":"Wang ; ] Kong-Fatt Wong, Xiao-Jing Wong, Wang","year":"2006","venue":"Journal of Neuroscience","doi":null,"url":null,"internal_url":null},{"position":30,"raw":"[Yang and Shadlen, 2007] Tianming Yang and Michael N. Shadlen. Probabilistic reasoning by neurons. Nature, 447(7148):1075-1080, June 2007.","title":"Probabilistic reasoning by neurons","authors":"Yang, Shadlen ; ] Tianming Yang, Michael N Shadlen","year":"2007","venue":"Nature","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}