32 research outputs found
Adversarial Example Detection and Classification With Asymmetrical Adversarial Training
The vulnerabilities of deep neural networks against adversarial examples have
become a significant concern for deploying these models in sensitive domains.
Devising a definitive defense against such attacks is proven to be challenging,
and the methods relying on detecting adversarial samples are only valid when
the attacker is oblivious to the detection mechanism. In this paper we first
present an adversarial example detection method that provides performance
guarantee to norm constrained adversaries. The method is based on the idea of
training adversarial robust subspace detectors using asymmetrical adversarial
training (AAT). The novel AAT objective presents a minimax problem similar to
that of GANs; it has the same convergence property, and consequently supports
the learning of class conditional distributions. We first demonstrate that the
minimax problem could be reasonably solved by PGD attack, and then use the
learned class conditional generative models to define generative
detection/classification models that are both robust and more interpretable. We
provide comprehensive evaluations of the above methods, and demonstrate their
competitive performances and compelling properties on adversarial detection and
robust classification problems.Comment: ICLR 202
On the Decision Boundaries of Neural Networks: A Tropical Geometry Perspective
This work tackles the problem of characterizing and understanding the
decision boundaries of neural networks with piecewise linear non-linearity
activations. We use tropical geometry, a new development in the area of
algebraic geometry, to characterize the decision boundaries of a simple network
of the form (Affine, ReLU, Affine). Our main finding is that the decision
boundaries are a subset of a tropical hypersurface, which is intimately related
to a polytope formed by the convex hull of two zonotopes. The generators of
these zonotopes are functions of the network parameters. This geometric
characterization provides new perspectives to three tasks. (i) We propose a new
tropical perspective to the lottery ticket hypothesis, where we view the effect
of different initializations on the tropical geometric representation of a
network's decision boundaries. (ii) Moreover, we propose new tropical based
optimization reformulations that directly influence the decision boundaries of
the network for the task of network pruning. (iii) At last, we discuss the
reformulation of the generation of adversarial attacks in a tropical sense. We
demonstrate that one can construct adversaries in a new tropical setting by
perturbing a specific set of decision boundaries by perturbing a set of
parameters in the network.Comment: First two authors contributed equally to this wor