josejhlee/doodling

For lab, for personal, for school.

doodling

---

For lab, for personal, for school.

doodling's Issues

Adversarial Examples Are Not Bugs, They Are Features

link: https://arxiv.org/abs/1905.02175

Adversarial attacks

Standard training vs Robust training

Standard training

Robust training (adversarial loss function)

What was the common consensus on adversarial attacks?

• Viewed adversarial examples as aberrations arising either from the high dimensional nature of the input space or statistical fluctuations in the training data.

What this paper proposes?

• Adversarial vulnerability is a direct result of our models' sensitivity to well-generalization features in the data.

The model's main objective is to increase the accuracy rate. If there is a feature that cooperates with that goal, it will make use of it. Because non-robust features are well-generalizing features, enhancing the accuracy, it is exploited. This explains why different models have adversarial transferability. The two models were trying to find the best classifying features.

defining robustness

Binary classification (+1 or -1)

p-useful features

As the name implies, we define the features that are useful for classification.

Gamma-robustly useful features

Even with the introduction of perturbation, it remains gamma-useful feature.

non-robust useful feature

• A useful, non-robust feature is a feature which is p-useful for some p
  bounded away from zero, but is not a gamma-robust feature for any gamma >= 0.

That means that while under no perturbation a feature was giving a positive value for a given x, it may give a negative value for the same x under perturbation application.

Constructing a robust dataset (with only robust features)

• Making robust images directly from the original pictures by minimizing the distance between the features.
• Start from random noise (or another random image from another class) and backpropagate wrt the image.
  

Constructing a non-robust dataset (with only non-robust features)

Results of the experiment