{"type":"ScholarlyArticle","title":"Adversarial Amendment is the Only Force Capable of Transforming an Enemy into a Friend","authors":[{"name":"Chong Yu","slug":"chong-yu","given":"Chong","family":"Yu","affiliation":"Academy for Engineering and Technology , Fudan University"},{"name":"Tao Chen","slug":"tao-chen","given":"Tao","family":"Chen","affiliation":"School for Information Science and Technology , Fudan University"},{"name":"Zhongxue Gan","slug":"zhongxue-gan","given":"Zhongxue","family":"Gan","affiliation":"Academy for Engineering and Technology , Fudan University"}],"abstract":"Adversarial attack is commonly regarded as a huge threat to neural networks because of misleading behavior. This paper presents an opposite perspective: adversarial attacks can be harnessed to improve neural models if amended correctly. Unlike traditional adversarial defense or adversarial training schemes that aim to improve the adversarial robustness, the proposed adversarial amendment (AdvAmd) method aims to improve the original accuracy level of neural models on benign samples. We thoroughly analyze the distribution mismatch between the benign and adversarial samples. This distribution mismatch and the mutual learning mechanism with the same learning ratio applied in prior art defense strategies is the main cause leading the accuracy degradation for benign samples. The proposed AdvAmd is demonstrated to steadily heal the accuracy degradation and even leads to a certain accuracy boost of common neural models on benign classification, object detection, and segmentation tasks. The efficacy of the AdvAmd is contributed by three key components: mediate samples (to reduce the influence of distribution mismatch with a fine-grained amendment), auxiliary batch norm (to solve the mutual learning mechanism and the smoother judgment surface), and AdvAmd loss (to adjust the learning ratios according to different attack vulnerabilities) through quantitative and ablation experiments.","doi":"10.24963/ijcai.2023/503","url":"https://ijcai.org/proceedings/2023/503","pdf":"https://ijcai.org/proceedings/2023/0503.pdf","markdown":"https://ijcai.org/proceedings/2023/503.md","bibtex":"https://ijcai.org/proceedings/2023/bibtex/503","volume":{"slug":"2023","title":"Proceedings of the Thirty-Second International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2023","url":"https://ijcai.org/proceedings/2023/","year":2023,"location":"Macao, SAR","dates":"19-25 August 2023","editors":"Edith Elkind","isbn":"978-1-956792-03-4","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2023"},"section":"Machine Learning","track":"Main Track","number":503,"pages":{"first":4522,"last":4530},"keywords":["Constraint Satisfaction and Optimization: CSO: Applications","AI Ethics, Trust, Fairness: ETF: Safety and robustness","Machine Learning: ML: Robustness"],"videos":[],"references":[{"position":1,"raw":"[Belinkov and Bisk, 2017] Yonatan Belinkov and Yonatan Bisk. Synthetic and natural noise both break neural ma- chine translation. arXiv preprint arXiv:1711.02173, 2017.","title":"Synthetic and natural noise both break neural machine translation","authors":"Bisk Belinkov, Yonatan Belinkov, Yonatan Bisk","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Cisse et al., 2017] Moustapha M Cisse, Yossi Adi, Natalia Neverova, and Joseph Keshet. Houdini: Fooling deep structured visual and speech recognition models with ad- versarial examples. Advances in Neural Information Pro- cessing Systems, 30, 2017.","title":"Houdini: Fooling deep structured visual and speech recognition models with adversarial examples","authors":"Yossi Moustapha M Cisse, Natalia Adi, Joseph Neverova, Keshet","year":"2017","venue":"Advances in Neural Information Processing Systems","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Deng et al., 2009] Jia Deng, Wei Dong, Richard Socher, Li- Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248-255. IEEE, 2009.","title":"Imagenet: A large-scale hierarchical image database","authors":"Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, Li Fei-Fei","year":"2009","venue":"IEEE conference on computer vision and pattern recognition","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Dziugaite et al., 2016] Gintare Karolina Dziugaite, Zoubin Ghahramani, and Daniel M Roy. A study of the effect of jpg compression on adversarial images. arXiv preprint arXiv:1608.00853, 2016.","title":"A study of the effect of jpg compression on adversarial images","authors":"Gintare Karolina Dziugaite, Zoubin Ghahramani, Daniel M Roy","year":"2016","venue":null,"doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Goodfellow et al., 2014] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014.","title":"Explaining and harnessing adversarial examples","authors":"Ian J Goodfellow, Jonathon Shlens, Christian Szegedy","year":"2014","venue":null,"doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[He et al., 2016] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770-778, 2016.","title":"Deep residual learning for image recognition","authors":"Kaiming He, Xiangyu Zhang, Shaoqing Ren, Jian Sun","year":"2016","venue":"Proceedings of the IEEE conference on computer vision and pattern recognition","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[He et al., 2017] Kaiming He, Georgia Gkioxari, Piotr Dollár, and Ross Girshick. Mask r-cnn. In Proceedings of the IEEE International Conference on Computer Vision, pages 2961-2969, 2017.","title":"Kaiming He, Georgia Gkioxari, Piotr Dollár, and Ross Girshick. Mask r-cnn","authors":"He","year":"2017","venue":"Proceedings of the IEEE International Conference on Computer Vision","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Hinton et al., 2015] Geoffrey Hinton, Oriol Vinyals, and Jeff Dean. Distilling the knowledge in a neural network. arXiv preprint arXiv:1503.02531, 2015.","title":"Distilling the knowledge in a neural network","authors":"Geoffrey Hinton, Oriol Vinyals, Jeff Dean","year":"2015","venue":null,"doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Huang et al., 2015] Ruitong Huang, Bing Xu, Dale Schuur- mans, and Csaba Szepesvári. Learning with a strong ad- versary. arXiv preprint arXiv:1511.03034, 2015.","title":"Learning with a strong adversary","authors":"Huang","year":"2015","venue":null,"doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Ioffe and Szegedy, 2015] Sergey Ioffe and Christian Szegedy. Batch normalization: Accelerating deep net- work training by reducing internal covariate shift. In International Conference on Machine Learning, pages 448-456. PMLR, 2015.","title":"Batch normalization: Accelerating deep network training by reducing internal covariate shift","authors":"Szegedy Ioffe, Sergey Ioffe, Christian Szegedy","year":"2015","venue":"International Conference on Machine Learning","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Jocher, 2022] Glenn Jocher. ultralytics/yolov5: v6.1 -Ten- sorRT, TensorFlow Edge TPU and OpenVINO Export and Inference, February 2022.","title":"Glenn Jocher. ultralytics/yolov5: v6.1 -Ten-sorRT, TensorFlow Edge TPU and OpenVINO Export and Inference","authors":"Jocher","year":"2022","venue":null,"doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Kurakin et al., 2016] Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning at scale. arXiv preprint arXiv:1611.01236, 2016.","title":"Adversarial machine learning at scale","authors":"Alexey Kurakin, Ian Goodfellow, Samy Bengio","year":"2016","venue":null,"doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Liang et al., 2017] Bin Liang, Hongcheng Li, Miaoqiang Su, Pan Bian, Xirong Li, and Wenchang Shi. Deep text classification can be fooled. arXiv preprint arXiv:1704.08006, 2017.","title":"Deep text classification can be fooled","authors":"Bin Liang, Hongcheng Li, Miaoqiang Su, Pan Bian, Xirong Li, Wenchang Shi","year":"2017","venue":null,"doi":null,"url":null,"internal_url":"/proceedings/2018/585"},{"position":14,"raw":"[Lin et al., 2014] Tsung-Yi Lin, Michael Maire, Serge Be- longie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Com- mon objects in context. In European Conference on Com- puter Vision, pages 740-755. Springer, 2014.","title":"Microsoft coco: Common objects in context","authors":"Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, C Lawrence, Zitnick","year":"2014","venue":"European Conference on Computer Vision","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Lin et al., 2017] Tsung-Yi Lin, Priya Goyal, Ross Girshick, Kaiming He, and Piotr Dollár. Focal loss for dense ob- ject detection. In Proceedings of the IEEE International Conference on Computer Vision, pages 2980-2988, 2017.","title":"Focal loss for dense object detection","authors":"Tsung-Yi Lin, Priya Goyal, Ross Girshick, Kaiming He, Piotr Dollár","year":"2017","venue":"Proceedings of the IEEE International Conference on Computer Vision","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Liu et al., 2016] Wei Liu, Dragomir Anguelov, Dumitru Er- han, Christian Szegedy, Scott Reed, Cheng-Yang Fu, and Alexander C Berg. Ssd: Single shot multibox detector. In European Conference on Computer Vision, pages 21-37. Springer, 2016.","title":"Ssd: Single shot multibox detector","authors":"Wei Liu, Dragomir Anguelov, Dumitru Erhan, Christian Szegedy, Scott Reed, Cheng-Yang Fu, Alexander C Berg","year":"2016","venue":"European Conference on Computer Vision","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Lyu et al., 2015] Chunchuan Lyu, Kaizhu Huang, and Hai- Ning Liang. A unified gradient regularization family for adversarial examples. In 2015 IEEE International Confer- ence on Data Mining, pages 301-309. IEEE, 2015.","title":"A unified gradient regularization family for adversarial examples","authors":"Lyu","year":"2015","venue":"IEEE International Conference on Data Mining","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Madry et al., 2018] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018.","title":"Towards deep learning models resistant to adversarial attacks","authors":"Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, Adrian Vladu","year":"2018","venue":"International Conference on Learning Representations","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Meng and Chen, 2017] Dongyu Meng and Hao Chen. Mag- net: a two-pronged defense against adversarial examples. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pages 135-147, 2017.","title":"Magnet: a two-pronged defense against adversarial examples","authors":"Dongyu Meng, Hao Chen","year":"2017","venue":"Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Mirjalili and Ross, 2017] Vahid Mirjalili and Arun Ross. Soft biometric privacy: Retaining biometric utility of face images while perturbing gender. In 2017 IEEE Interna- tional Joint Conference on Biometrics, pages 564-573. IEEE, 2017.","title":"Soft biometric privacy: Retaining biometric utility of face images while perturbing gender","authors":"Vahid Mirjalili, Arun Ross","year":"2017","venue":"IEEE International Joint Conference on Biometrics","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Moosavi-Dezfooli et al., 2016] Seyed-Mohsen Moosavi- Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deep- fool: a simple and accurate method to fool deep neural networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 2574-2582, 2016.","title":"Deepfool: a simple and accurate method to fool deep neural networks","authors":"Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Pascal Frossard","year":"2016","venue":"Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Nadarajah and Pogány, 2016] Saralees Nadarajah and Ti- bor K Pogány. On the distribution of the product of cor- related normal random variables. Comptes Rendus Math- ematique, 354(2):201-204, 2016.","title":"Saralees Nadarajah and Tibor K Pogány. On the distribution of the product of correlated normal random variables","authors":"Pogány Nadarajah","year":"2016","venue":"Comptes Rendus Mathematique","doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Ozdag, 2018] Mesut Ozdag. Adversarial attacks and de- fenses against deep neural networks: a survey. Procedia Computer Science, 140:152-161, 2018.","title":"Adversarial attacks and defenses against deep neural networks: a survey","authors":"Mesut Ozdag, Ozdag","year":"2018","venue":"Procedia Computer Science","doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Papernot and McDaniel, 2017] Nicolas Papernot and Patrick McDaniel. Extending defensive distillation. arXiv preprint arXiv:1705.05264, 2017.","title":"Extending defensive distillation","authors":"Nicolas Papernot, Patrick Mcdaniel","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Papernot et al., 2016] Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. Distillation as a defense to adversarial perturbations against deep neu- ral networks. In 2016 IEEE Symposium on Security and Privacy, pages 582-597. IEEE, 2016.","title":"Distillation as a defense to adversarial perturbations against deep neural networks","authors":"Nicolas Papernot, Patrick Mcdaniel, Xi Wu, Somesh Jha, Ananthram Swami","year":"2016","venue":"IEEE Symposium on Security and Privacy","doi":null,"url":null,"internal_url":null},{"position":26,"raw":"[Paszke et al., 2017] Adam Paszke, Sam Gross, Soumith Chintala, Gregory Chanan, Edward Yang, Zachary De- Vito, Zeming Lin, Alban Desmaison, Luca Antiga, and Adam Lerer. Automatic differentiation in pytorch. In Ad- vances in Neural Information Processing Systems-Autodiff Workshop, 2017.","title":"Automatic differentiation in pytorch","authors":"Adam Paszke, Sam Gross, Soumith Chintala, Gregory Chanan, Edward Yang, Zachary De-Vito, Zeming Lin, Alban Desmaison, Luca Antiga, Adam Lerer","year":"2017","venue":"Advances in Neural Information Processing Systems-Autodiff Workshop","doi":null,"url":null,"internal_url":null},{"position":27,"raw":"[Ren et al., 2015] Shaoqing Ren, Kaiming He, Ross Gir- shick, and Jian Sun. Faster r-cnn: Towards real-time ob- ject detection with region proposal networks. Advances in Neural Information Processing Systems, 28, 2015.","title":"Faster r-cnn: Towards real-time object detection with region proposal networks","authors":"Ren","year":"2015","venue":"Advances in Neural Information Processing Systems","doi":null,"url":null,"internal_url":null},{"position":28,"raw":"[Samangouei et al., 2018] Pouya Samangouei, Maya Kabkab, and Rama Chellappa. Defense-gan: Protecting classifiers against adversarial attacks using generative models. arXiv preprint arXiv:1805.06605, 2018.","title":"Defense-gan: Protecting classifiers against adversarial attacks using generative models","authors":"Pouya Samangouei, Maya Kabkab, Rama Chellappa","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":29,"raw":"[Szegedy et al., 2013] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013.","title":"Intriguing properties of neural networks","authors":"Szegedy","year":"2013","venue":null,"doi":null,"url":null,"internal_url":null},{"position":30,"raw":"[Tan et al., 2020] Mingxing Tan, Ruoming Pang, and Quoc V Le. Efficientdet: Scalable and efficient object detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10781- 10790, 2020.","title":"Efficientdet: Scalable and efficient object detection","authors":"Mingxing Tan, Ruoming Pang, Quoc V Le","year":"2020","venue":"Proceedings of the IEEE/CVF conference on computer vision and pattern recognition","doi":null,"url":null,"internal_url":null},{"position":31,"raw":"[Touvron et al., 2021] Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablay- rolles, and Hervé Jégou. Training data-efficient image transformers & distillation through attention. In In- ternational Conference on Machine Learning, pages 10347-10357. PMLR, 2021.","title":"Training data-efficient image transformers & distillation through attention","authors":"Touvron","year":"2021","venue":"ternational Conference on Machine Learning","doi":null,"url":null,"internal_url":null},{"position":32,"raw":"[Tramèr et al., 2017] Florian Tramèr, Alexey Kurakin, Nico- las Papernot, Ian Goodfellow, Dan Boneh, and Patrick Mc- Daniel. Ensemble adversarial training: Attacks and de- fenses. arXiv preprint arXiv:1705.07204, 2017.","title":"Ensemble adversarial training: Attacks and defenses","authors":"Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, Patrick Mc-Daniel","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":33,"raw":"[Xie et al., 2019] Cihang Xie, Yuxin Wu, Laurens van der Maaten, Alan L Yuille, and Kaiming He. Feature denois- ing for improving adversarial robustness. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pat- tern Recognition, pages 501-509, 2019.","title":"Feature denoising for improving adversarial robustness","authors":"Xie","year":"2019","venue":"Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":34,"raw":"[Xu et al., 2020] Xing Xu, Jingran Zhang, Yujie Li, Yichuan Wang, Yang Yang, and Heng Tao Shen. Adversarial at- tack against urban scene segmentation for autonomous vehicles. IEEE Transactions on Industrial Informatics, 17(6):4117-4126, 2020.","title":"Adversarial attack against urban scene segmentation for autonomous vehicles","authors":"Xing Xu, Jingran Zhang, Yujie Li, Yichuan Wang, Yang Yang, Heng Tao Shen","year":"2020","venue":"IEEE Transactions on Industrial Informatics","doi":null,"url":null,"internal_url":null},{"position":35,"raw":"[Zhang et al., 2020] Ziqi Zhang, Xinge Zhu, Yingwei Li, Xiangqun Chen, and Yao Guo. Adversarial at- tacks on monocular depth estimation. arXiv preprint arXiv:2003.10315, 2020.","title":"Adversarial attacks on monocular depth estimation","authors":"Ziqi Zhang, Xinge Zhu, Yingwei Li, Xiangqun Chen, Yao Guo","year":"2020","venue":null,"doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}