Improved robustness to adversarial examples using Lipschitz regularization of the loss

TL;DR

This paper enhances adversarial training by incorporating Lipschitz regularization, leading to significant robustness improvements and verifiable guarantees against adversarial attacks in image classification.

Contribution

It introduces a novel augmentation of adversarial training with Lipschitz regularization, providing improved robustness and theoretical guarantees.

Findings

11% robustness improvement over state-of-the-art in CIFAR-10

Verifiable average and worst-case robustness guarantees

Interpretation of adversarial training as Total Variation Regularization

Abstract

We augment adversarial training (AT) with worst case adversarial training (WCAT) which improves adversarial robustness by 11% over the current state-of-the-art result in the $\ell_2$ norm on CIFAR-10. We obtain verifiable average case and worst case robustness guarantees, based on the expected and maximum values of the norm of the gradient of the loss. We interpret adversarial training as Total Variation Regularization, which is a fundamental tool in mathematical image processing, and WCAT as Lipschitz regularization.