AdvMS: A Multi-source Multi-cost Defense Against Adversarial Attacks

2020/02/19 by Xiao Wang, Wang, Xiao, Siyue Wang +8
Biochemistry, Genetics and Molecular Biology · Computer Science · #Advanced Malware Detection Techniques #Adversarial Robustness in Machine Learning #Adversarial system #Adversary #Artificial intelligence #Artificial neural network #Bacillus and Francisella bacterial research #Business #Computer Vision and Pattern Recognition (cs.CV) #Computer science #Computer security #Cryptography and Security (cs.CR) #Deep neural networks #FOS: Computer and information sciences #Machine Learning (cs.LG) #Risk analysis (engineering) #Robustness (evolution) #Scheme (mathematics) #cs.CR #cs.CV #cs.LG

paper · pdf · doi:10.48550/arxiv.2002.08439

Accepted by 45th International Conference on Acoustics, Speech, and Signal Processing (ICASSP 2020)

arxiv created 2020/02/19 · openalex publication_date 2020/02/19 · arxiv updated 2020/02/21 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Designing effective defense against adversarial attacks is a crucial topic as deep neural networks have been proliferated rapidly in many security-critical domains such as malware detection and self-driving cars. Conventional defense methods, although shown to be promising, are largely limited by their single-source single-cost nature: The robustness promotion tends to plateau when the defenses are made increasingly stronger while the cost tends to amplify. In this paper, we study principles of designing multi-source and multi-cost schemes where defense performance is boosted from multiple defending components. Based on this motivation, we propose a multi-source and multi-cost defense scheme, Adversarially Trained Model Switching (AdvMS), that inherits advantages from two leading schemes: adversarial training and random model switching. We show that the multi-source nature of AdvMS mitigates the performance plateauing issue and the multi-cost nature enables improving robustness at a flexible and adjustable combination of costs over different factors which can better suit specific restrictions and needs in practice.

Citations

• Adversarial Examples in the Physical World
• On the (Statistical) Detection of Adversarial Examples
• Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression
• Synthesizing Robust Adversarial Examples
• Towards Robust Neural Networks via Random Self-ensemble
• Breaking Transferability of Adversarial Samples with Randomness
• Protecting Neural Networks with Hierarchical Random Switching: Towards Better Robustness-Accuracy Trade-off for Stochastic Defenses
• Adversarial T-shirt! Evading Person Detectors in A Physical World

Related

• Efficient Defenses Against Adversarial Attacks
• JumpReLU: A Retrofit Defense Strategy for Adversarial Attacks
• "What's in the box?!": Deflecting Adversarial Attacks by Randomly Deploying Adversarially-Disjoint Models
• Defenses in Adversarial Machine Learning: A Survey
• Efficient Two-Step Adversarial Defense for Deep Neural Networks