Domain Invariant Adversarial Learning

TL;DR

This paper introduces DIAL, a novel adversarial training method that enforces domain-invariant features to improve the robustness and accuracy of neural networks against adversarial examples.

Contribution

The paper proposes a new adversarial training approach, DIAL, which enhances robustness and accuracy by learning domain-invariant features using a variant of DANN.

Findings

DIAL improves robustness against adversarial attacks.

DIAL enhances standard accuracy on natural examples.

The method is compatible with existing adversarial training techniques.

Abstract

The phenomenon of adversarial examples illustrates one of the most basic vulnerabilities of deep neural networks. Among the variety of techniques introduced to surmount this inherent weakness, adversarial training has emerged as the most effective strategy for learning robust models. Typically, this is achieved by balancing robust and natural objectives. In this work, we aim to further optimize the trade-off between robust and standard accuracy by enforcing a domain-invariant feature representation. We present a new adversarial training method, Domain Invariant Adversarial Learning (DIAL), which learns a feature representation that is both robust and domain invariant. DIAL uses a variant of Domain Adversarial Neural Network (DANN) on the natural domain and its corresponding adversarial domain. In the case where the source domain consists of natural examples and the target domain is the adversarially perturbed examples, our method learns a feature representation constrained not to discriminate between the natural and adversarial examples, and can therefore achieve a more robust representation. DIAL is a generic and modular technique that can be easily incorporated into any adversarial training method. Our experiments indicate that incorporating DIAL in the adversarial training process improves both robustness and standard accuracy.