English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Tools annual

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Tools monthly

Global: Zendy Plus monthly

Presents the access of premium content as premium feature

Premium Content

Global: Zendy Plus annual

Global: Zendy Free Plan

In adversarial machine learning, the popular $\ell_\infty$ threat model hasbeen the focus of much previous work. While this mathematical definition ofimperceptibility successfully captures an infinite set of additive imagetransformations that a model should be robust to, this is only a subset of alltransformations which leave the semantic label of an image unchanged. Indeed,previous work also considered robustness to spatial attacks as well as othersemantic transformations; however, designing defense methods against thecomposition of spatial and $\ell_{\infty}$ perturbations remains relativelyunderexplored. In the following, we improve the understanding of this seldominvestigated compositional setting. We prove theoretically that no linearclassifier can achieve more than trivial accuracy against a composite adversaryin a simple statistical setting, illustrating its difficulty. We theninvestigate how state-of-the-art $\ell_{\infty}$ defenses can be adapted tothis novel threat model and study their performance against compositionalattacks. We find that our newly proposed TRADES$_{\text{All}}$ strategyperforms the strongest of all. Analyzing its logit's Lipschitz constant for RTtransformations of different sizes, we find that TRADES$_{\text{All}}$ remainsstable over a wide range of RT transformations with and without $\ell_\infty$perturbations.

A Closer Look at Robustness to L-infinity and Spatial Perturbations and their Composition