Understanding (Non-)Robust Feature Disentanglement and the Relationship Between Low- and High-Dimensional Adversarial Attacks

2020/04/04 by Zuowen Wang, Wang, Zuowen, Leo Horne +1
Biochemistry, Genetics and Molecular Biology · Computer Science · #Advanced Malware Detection Techniques #Adversarial Robustness in Machine Learning #Bacillus and Francisella bacterial research #Computer Vision and Pattern Recognition (cs.CV) #FOS: Computer and information sciences

paper · pdf · doi:10.48550/arxiv.2004.01903

openalex publication_date 2020/04/04 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Recent work has put forth the hypothesis that adversarial vulnerabilities in neural networks are due to them overusing "non-robust features" inherent in the training data. We show empirically that for PGD-attacks, there is a training stage where neural networks start heavily relying on non-robust features to boost natural accuracy. We also propose a mechanism reducing vulnerability to PGD-style attacks consisting of mixing in a certain amount of images contain-ing mostly "robust features" into each training batch, and then show that robust accuracy is improved, while natural accuracy is not substantially hurt. We show that training on "robust features" provides boosts in robust accuracy across various architectures and for different attacks. Finally, we demonstrate empirically that these "robust features" do not induce spatial invariance.

Citations

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Adversarial Examples Are Not Bugs, They Are Features
• Exploring the Landscape of Spatial Robustness
• Invariance-inducing regularization using worst-case transformations suffices to boost accuracy and spatial robustness
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• PyTorch: An Imperative Style, High-Performance Deep Learning Library
• Learning Multiple Layers of Features from Tiny Images

Related

• Exploring Robust Features for Improving Adversarial Robustness
• Learning More Robust Features with Adversarial Training
• Robust Models are less Over-Confident
• A Useful Taxonomy for Adversarial Robustness of Neural Networks
• Adversarial Perturbations Are Not So Weird: Entanglement of Robust and Non-Robust Features in Neural Network Classifiers