Beyond cross-entropy: learning highly separable feature distributions for robust and accurate classification

TL;DR

This paper introduces the GCCS loss, a novel training method that enhances both adversarial robustness and classification accuracy by learning highly separable feature distributions in a latent space.

Contribution

The paper proposes the Gaussian class-conditional simplex loss, a new approach that improves robustness and accuracy by mapping classes onto a simplex in latent space.

Findings

Outperforms state-of-the-art methods on challenging datasets.

Provides robustness against multiple adversarial attack types.

Achieves high classification accuracy with inherent adversarial defense.

Abstract

Deep learning has shown outstanding performance in several applications including image classification. However, deep classifiers are known to be highly vulnerable to adversarial attacks, in that a minor perturbation of the input can easily lead to an error. Providing robustness to adversarial attacks is a very challenging task especially in problems involving a large number of classes, as it typically comes at the expense of an accuracy decrease. In this work, we propose the Gaussian class-conditional simplex (GCCS) loss: a novel approach for training deep robust multiclass classifiers that provides adversarial robustness while at the same time achieving or even surpassing the classification accuracy of state-of-the-art methods. Differently from other frameworks, the proposed method learns a mapping of the input classes onto target distributions in a latent space such that the classes are linearly separable. Instead of maximizing the likelihood of target labels for individual samples, our objective function pushes the network to produce feature distributions yielding high inter-class separation. The mean values of the distributions are centered on the vertices of a simplex such that each class is at the same distance from every other class. We show that the regularization of the latent space based on our approach yields excellent classification accuracy and inherently provides robustness to multiple adversarial attacks, both targeted and untargeted, outperforming state-of-the-art approaches over challenging datasets.