Signal Processing - November 2017 - 60

Improving robustness

(i.e., the region where the nonlinear activation function is flat)
[47]. The networks learned using this approach are shown to
significantly im--prove in terms of robustness on a simple digit
recognition classification task, without losing significantly in
terms of accuracy. In [38], the authors propose to improve the
robustness by using distillation, a technique first introduced
in [39] for transferring knowledge from larger architectures to
Improving the robustness to adversarial perturbations
smaller ones. However, [40] shows that, when using more elabWe first describe the methods that have been proposed to
orate algorithms to compute perturbations, this approach fails
construct deep networks with better robustness to adversarial
to improve the robustness. In [41], a regularization scheme is
perturbations, following the papers [1], [9] that originally highintroduced for improving the network's sensitivity to perturbalighted the vulnerability of these classifiers. The straightfortions by constraining the Lipschitz constant of the network.
ward approach, which consists of adding perturbed images to
In [42], an information-theoretic loss function is used to train
the training set and fine-tuning the network, has been shown
stochastic neural networks; the resultto be mildly effective against newly com--
ing classifiers are shown to be more
puted adversarial perturbations [5]. To
robust to adversarial perturbations than
The importance of analyzing
further improve the robustness, it is
their deterministic counterpart. The
natural to consider the Jacobian matrix
the vulnerability of deep neural
increased robustness is intuitively due to
2g/2x of the model (with gthe last layer
networks to perturbations
the randomness of the neural network,
of the neural network) and ensure that
therefore goes beyond the
which maps an input to a distribution
all of the elements in the matrix are
practical security implications,
of features; attacking the network with
sufficiently small. Following this idea,
as it further reveals crucial
a small designed perturbation therefore
the authors of [31] consider a modibecomes harder than for deterministic
fied objective function, where a term is
geometric properties of
neural networks.
added to penalize the Jacobians of the
deep networks.
While all of these methods are
function computed by each layer with
shown to yield some improvements on
respect to the previous layer. This has
the robustness of deep neural networks, the design of robust
the effect of learning smooth functions with respect to the
visual classifiers on challenging classification tasks (e.g.,
input and thus learn more robust classifiers. In [32], a robust
ImageNet) is still an open problem. Moreover, while the preoptimization formulation is considered for training deep
viously mentioned methods provide empirical results showneural networks. Specifically, a minimization-maximizaing the improvement in robustness with respect to one or a
tion approach is proposed, where the loss is minimized over
subset of adversarial generation techniques, it is necessary
worst-case examples, rather than only on the original data.
in many applications to design robust networks against all
That is, the following minimization-maximization training
adversarial attacks. To do so, we believe it is crucial to derive
procedure is used to train the network:
formal certificates on the robustness of newly proposed netN
works, as it is practically impossible to test against all posmin / max
J (x i + ri, y i, i), (9)

r !U
i
sible attacks, and we see this as an important future work
i =1
in this area.
Although there is currently no method to effectively (and
where i, N, and U denote, respectively, the parameters of the
provably) combat adversarial perturbations on large-scale
network, the number of training points, and the set of plausible
data sets, several studies [42]-[44] have recently considered
perturbations; and y i denotes the label of x i . The set U is
the related problem of detectability of adversarial perturgenerally set to be the , 2 or , 3 ball centered at zero and of sufbations. The detectability property is essential in realficiently small radius. Unfortunately, this optimization probworld applications, as it allows the possibility to raise an
lem in (9) is difficult to solve efficiently. To circumvent this
exception when tampered images are detected. In [42], the
difficulty, [32] proposes an alternating iterative method where
authors propose to augment the network with a detector neta single step of gradient ascent and descent is performed at
work, which detects original images from perturbed ones.
each iteration. Note that the construction of robust classiUsing the optimization methods in the section "Adversarial
fiers using min-max robust optimization methods has been
Perturbations," the authors conclude that the network sucan active area of research, especially in the context of SVM
cessfully learns to distinguish between perturbed samples
classifiers [33]. In particular, for certain sets U, the objective
and original samples. Moreover, the overall network (i.e.,
function of various learning tasks can be written as a convex
the network and detector) is shown to be more robust to
optimization function as shown in [34]-[37], which makes
adversarial perturbations tailored for this architecture. In
the task of finding a robust classifier feasible. In a very recent
[43], the Bayesian uncertainty estimates in the subspace of
work inspired by biophysical principles of neural circuits,
learned representations are used to discriminate perturbed
Nayebi and Ganguli consider a regularizer to push activations
images from clean samples. Finally, as shown in [44], side
of the network in the saturating regime of the nonlinearity
An important objective of the analysis of robustness is to contribute to the design of better and more reliable systems. We next
summarize some of the recent attempts that have been made to
render systems more robust to different forms of p- erturbations.

IEEE SIGNAL PROCESSING MAGAZINE

November 2017

Table of Contents for the Digital Edition of Signal Processing - November 2017