Using Single-Step Adversarial Training to Defend Iterative Adversarial Examples

Guanxiong Liu, Issa Khalil, Abdallah Khreishah

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

Adversarial examples are among the biggest challenges for machine learning models, especially neural network classifiers. Adversarial examples are inputs manipulated with perturbations insignificant to humans while being able to fool machine learning models. Researchers achieve great progress in utilizing adversarial training as a defense. However, the overwhelming computational cost degrades its applicability, and little has been done to overcome this issue. Single-Step adversarial training methods have been proposed as computationally viable solutions; however, they still fail to defend against iterative adversarial examples. In this work, we first experimentally analyze several different state-of-the-art (SOTA) defenses against adversarial examples. Then, based on observations from experiments, we propose a novel single-step adversarial training method that can defend against both single-step and iterative adversarial examples. Through extensive evaluations, we demonstrate that our proposed method successfully combines the advantages of both single-step (low training overhead) and iterative (high robustness) adversarial training defenses. Compared with ATDA on the CIFAR-10 dataset, for example, our proposed method achieves a 35.67% enhancement in test accuracy and a 19.14% reduction in training time. When compared with methods that use BIM or Madry examples (iterative methods) on the CIFAR-10 dataset, our proposed method saves up to 76.03% in training time, with less than 3.78% degeneration in test accuracy. Finally, our experiments with the ImageNet dataset clearly show the scalability of our approach and its performance advantages over SOTA single-step approaches.

Original languageEnglish (US)
Title of host publicationCODASPY 2021 - Proceedings of the 11th ACM Conference on Data and Application Security and Privacy
PublisherAssociation for Computing Machinery, Inc
Pages17-27
Number of pages11
ISBN (Electronic)9781450381437
DOIs
StatePublished - Apr 26 2021
Event11th ACM Conference on Data and Application Security and Privacy, CODASPY 2021 - Virtual, Online, United States
Duration: Apr 26 2021Apr 28 2021

Publication series

NameCODASPY 2021 - Proceedings of the 11th ACM Conference on Data and Application Security and Privacy

Conference

Conference11th ACM Conference on Data and Application Security and Privacy, CODASPY 2021
CountryUnited States
CityVirtual, Online
Period4/26/214/28/21

All Science Journal Classification (ASJC) codes

  • Computer Science Applications
  • Information Systems
  • Software

Keywords

  • Adversarial example
  • adversarial training
  • neural network

Fingerprint Dive into the research topics of 'Using Single-Step Adversarial Training to Defend Iterative Adversarial Examples'. Together they form a unique fingerprint.

Cite this