Random Projections for Improved Adversarial Robustness

TL;DR

This paper introduces two novel training methods using random projections to enhance neural network robustness against adversarial attacks, leveraging geometric properties and dimensionality reduction.

Contribution

The paper presents two new techniques, RP-Ensemble and RP-Regularizer, that improve adversarial robustness independently of attack type using random projections.

Findings

RP-Ensemble improves robustness through ensemble learning.

RP-Regularizer enhances robustness via regularization.

Both methods are attack-agnostic.

Abstract

We propose two training techniques for improving the robustness of Neural Networks to adversarial attacks, i.e. manipulations of the inputs that are maliciously crafted to fool networks into incorrect predictions. Both methods are independent of the chosen attack and leverage random projections of the original inputs, with the purpose of exploiting both dimensionality reduction and some characteristic geometrical properties of adversarial perturbations. The first technique is called RP-Ensemble and consists of an ensemble of networks trained on multiple projected versions of the original inputs. The second one, named RP-Regularizer, adds instead a regularization term to the training objective.