PR-117: PeerNets: Exploiting Peer Wisdom Against Adversarial Attacks
•Als PPTX, PDF herunterladen•
0 gefällt mir•204 views
- Title: PeerNets: Exploiting Peer Wisdom Against Adversarial Attacks - Paper: https://arxiv.org/abs/1806.00088 - Video: https://youtu.be/VQsG_Yk9KuQ Taekmin Kim, http://github.com/tantara
Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Ähnlich wie PR-117: PeerNets: Exploiting Peer Wisdom Against Adversarial Attacks
Ähnlich wie PR-117: PeerNets: Exploiting Peer Wisdom Against Adversarial Attacks (20)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
PR-117: PeerNets: Exploiting Peer Wisdom Against Adversarial Attacks
- 1. PeerNets: Exploiting Peer Wisdom Against Adversarial Attacks PR-117 Taekmin Kim Nov 11, 2018
- 4. Adversarial Attack EXPLAINING AND HARNESSING ADVERSARIAL EXAMPLES(ICLR 2015)
- 5. X Y
- 8. ● Adversarial abilities ○ White-box ○ Black-box ○ Grey-box ● Adversarial goals ○ Confidence reduction ○ Non-targeted misclassification ○ Targeted misclassification ○ Source/Target misclassification Adversarial Attack White-Box Attaack
- 9. Generating Adversarial Example ● L-BFGS ● FSGM ● IGSM ● Iter l.l ● JSMA ● DeepFool ● Carlini Attack(C&W) ● Ensemble Attack
- 10. Defenses against AE ● Methods ○ Adversarial Training ○ Detection ○ Defensive Distillation ● Goals ○ Low impact on the model architecture ○ Maintain model speed ○ Maintain accuracy ○ Defense should be targeted
- 11. Related Work ● Adversarial Attack ○ Intriguing properties of neural networks(2013) ○ Universal adversarial perturbations(2016) ○ One pixel attack for fooling deep neural networks(2017) ● Defense against adversarial attacks ○ Ensemble adversarial training: Attacks and defenses(2018) ● Graph Convolutional Network ○ Graph attention networks(2017)
- 12. Overview ● Use non-local forward propagation ○ GCN(Graph Convolutional Network) ● Results ○ higher robustness(up to x3) to adversarial attacks ■ minor accuracy drop ○ strong regularization effect ■ Peer Regularization
- 22. Peer Regularization ● The output feature map X_i is pixel-wise weighted sum of the peers
- 24. Randomized approximation ● Problem: Search NN accross all the available samples ○ not feasible due to memory and computation limitations ● Solution: Use a Monte Carlo approximation ○ In order to limit the computational overhead, ■ M = 1 is used during training, ■ whereas larger values of M are used during inference
- 25. Architectures
- 26. Training & Inference ● Training ○ All the images of the current batch are peers ○ Select K-nearest neighboars with cosine distance ■ K=10 ○ Dropout ■ 0.2 on the all-pairs distance ■ 0.5 on the attention weights ● Inference ■ N fixed peer images ● N=50 on MNIST, CIFAR-10 ● N-500 on CIFAR-100 ■ Monte Carlo sampling over M forward passes
- 27. Experiments ● Benchmarks ○ MNIST w/ LeNet5 ○ CIFAR-10 w/ ResNet-32 ○ CIFAR-100 w/ ResNet-100 ● Attacks ○ Whitebox: gradient based, fast-gradient sign method, universal adversarial pertubation ● Metrics ○ fooling rate: ratio of images for which the network predicts a different label as the result of the perturbation ● Hyperparameters ○ K = 10 for all the experiments
- 28. Results
- 30. On MNIST
- 31. On CIFAR-10
- 32. On CIFAR-100
- 33. Accuracy Drop
- 34. Summary ● Goals ○ Low impact on the model architecture ○ Maintain accuracy ○ Maintain model speed ○ Defense should be targeted
Hinweis der Redaktion
- White box code example Universal adversarial perturbation 46논문 Defensive distillation training Deep dictionary training
- it forces the network to converge to a bad local minimum