Exploring Model Robustness with Adaptive Networks and Improved Adversarial Training

Deep neural networks have achieved impressive performance on many machine learning tasks, which has led to growing interests in deploying these models in practical applications. However, recent studies have revealed that models trained on benign examples are susceptible to adversarial examples, examples crafted by an adversary to control model behavior at test time [4, 32, 12]. The adversarial perturbation overlaid on top of the benign examples is often small enough to be imperceptible to humans, yet can cause the model to misclassify the image. The existence of adversarial examples has raised security concerns for many high-stakes real-world applications such as street sign detection for autonomous vehicles. While initial works stated that digital adversarial examples built for sign-detection may not be a real threat since the camera can view the objects from different distances and angles [22], more recent attacks were proposed for making stronger adversarial examples that are invariant to various transformations by optimizing over the expected value of a set of predefined transformations [2]. In fact, this security concern has turned into an actual threat after a recent study showed that adversarial stickers are able to fool real-world self-driving cars [13].