Adv-4-Adv: Thwarting Changing Adversarial Perturbations via Adversarial Domain Adaptation

TL;DR

Adv-4-Adv introduces a novel adversarial training approach that uses adversarial domain adaptation to improve robustness against unseen adversarial attacks by learning domain-invariant features.

Contribution

It proposes a new adversarial training method that treats different attack types as domains and employs domain adaptation to enhance attack generalization.

Findings

Model trained with Adv-4-Adv generalizes better to unseen attacks.

Outperforms state-of-the-art methods on multiple datasets.

Effective against simple and advanced adversarial attacks.

Abstract

Whereas adversarial training can be useful against specific adversarial perturbations, they have also proven ineffective in generalizing towards attacks deviating from those used for training. However, we observe that this ineffectiveness is intrinsically connected to domain adaptability, another crucial issue in deep learning for which adversarial domain adaptation appears to be a promising solution. Consequently, we proposed Adv-4-Adv as a novel adversarial training method that aims to retain robustness against unseen adversarial perturbations. Essentially, Adv-4-Adv treats attacks incurring different perturbations as distinct domains, and by leveraging the power of adversarial domain adaptation, it aims to remove the domain/attack-specific features. This forces a trained model to learn a robust domain-invariant representation, which in turn enhances its generalization ability. Extensive evaluations on Fashion-MNIST, SVHN, CIFAR-10, and CIFAR-100 demonstrate that a model trained by Adv-4-Adv based on samples crafted by simple attacks (e.g., FGSM) can be generalized to more advanced attacks (e.g., PGD), and the performance exceeds state-of-the-art proposals on these datasets.