English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Adversarial training (AT) and its variants have spearheaded progress inimproving neural network robustness to adversarial perturbations and commoncorruptions in the last few years. Algorithm design of AT and its variants arefocused on training models at a specified perturbation strength $\epsilon$ andonly using the feedback from the performance of that $\epsilon$-robust model toimprove the algorithm. In this work, we focus on models, trained on a spectrumof $\epsilon$ values. We analyze three perspectives: model performance,intermediate feature precision and convolution filter sensitivity. In each, weidentify alternative improvements to AT that otherwise wouldn't have beenapparent at a single $\epsilon$. Specifically, we find that for a PGD attack atsome strength $\delta$, there is an AT model at some slightly larger strength$\epsilon$, but no greater, that generalizes best to it. Hence, we proposeoverdesigning for robustness where we suggest training models at an $\epsilon$just above $\delta$. Second, we observe (across various $\epsilon$ values) thatrobustness is highly sensitive to the precision of intermediate features andparticularly those after the first and second layer. Thus, we propose adding asimple quantization to defenses that improves accuracy on seen and unseenadaptive attacks. Third, we analyze convolution filters of each layer of modelsat increasing $\epsilon$ and notice that those of the first and second layermay be solely responsible for amplifying input perturbations. We present ourfindings and demonstrate our techniques through experiments with ResNet andWideResNet models on the CIFAR-10 and CIFAR-10-C datasets.

Towards Alternative Techniques for Improving Adversarial Robustness: Analysis of Adversarial Training at a Spectrum of Perturbations