English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Deep neural networks (DNNs) are vulnerable to adversarial noise. A range ofadversarial defense techniques have been proposed to mitigate the interferenceof adversarial noise, among which the input pre-processing methods are scalableand show great potential to safeguard DNNs. However, pre-processing methods maysuffer from the robustness degradation effect, in which the defense reducesrather than improving the adversarial robustness of a target model in awhite-box setting. A potential cause of this negative effect is thatadversarial training examples are static and independent to the pre-processingmodel. To solve this problem, we investigate the influence of full adversarialexamples which are crafted against the full model, and find they indeed have apositive impact on the robustness of defenses. Furthermore, we find that simplychanging the adversarial training examples in pre-processing methods does notcompletely alleviate the robustness degradation effect. This is due to theadversarial risk of the pre-processed model being neglected, which is anothercause of the robustness degradation effect. Motivated by above analyses, wepropose a method called Joint Adversarial Training based Pre-processing (JATP)defense. Specifically, we formulate a feature similarity based adversarial riskfor the pre-processing model by using full adversarial examples found in afeature space. Unlike standard adversarial training, we only update thepre-processing model, which prompts us to introduce a pixel-wise loss toimprove its cross-model transferability. We then conduct a joint adversarialtraining on the pre-processing model to minimize this overall risk. Empiricalresults show that our method could effectively mitigate the robustnessdegradation effect across different target models in comparison to previousstate-of-the-art approaches.

Improving White-box Robustness of Pre-processing Defenses via Joint Adversarial Training