Interpolated Adversarial Training: Achieving Robust Neural Networks Without Sacrificing Too Much Accuracy

Vikas Verma, Alex Lamb, Juho Kannala, Yoshua Bengio

Research output: Chapter in Book/Report/Conference proceedingConference article in proceedingsScientificpeer-review

271 Downloads (Pure)

Abstract

Adversarial robustness has become a central goal in deep learning, both in theory and in practice. However, successful methods to improve the adversarial robustness (such as adversarial training) greatly hurt generalization performance on the unperturbed data. This could have a major impact on how achieving adversarial robustness affects real world systems (i.e. many may opt to forego robustness if it can improve accuracy on the unperturbed data). We propose Interpolated Adversarial Training, which employs recently proposed interpolation based training methods in the framework of adversarial training. On CIFAR-10, adversarial training increases the standard test error (when there is no adversary) from 4.43% to 12.32%, whereas with our Interpolated adversarial training we retain adversarial robustness while achieving a standard test error of only 6.45%. With our technique, the relative increase in the standard error for the robust model is reduced from 178.1% to just 45.5%.
Original languageEnglish
Title of host publicationAISec'19: Proceedings of the 12th ACM Workshop on Artificial Intelligence and Security
PublisherACM
Pages95-103
ISBN (Print)978-1-4503-6833-9
DOIs
Publication statusPublished - 2019
MoE publication typeA4 Conference publication
EventACM Workshop on Artificial Intelligence and Security - London, United Kingdom
Duration: 15 Nov 201915 Nov 2019
Conference number: 12
https://aisec.cc/

Workshop

WorkshopACM Workshop on Artificial Intelligence and Security
Abbreviated titleAISec
Country/TerritoryUnited Kingdom
CityLondon
Period15/11/201915/11/2019
Internet address

Fingerprint

Dive into the research topics of 'Interpolated Adversarial Training: Achieving Robust Neural Networks Without Sacrificing Too Much Accuracy'. Together they form a unique fingerprint.

Cite this