@techreport{Zheng2020,
abstract = {Adversarial training is an effective defense method to protect classification models against adversarial attacks. However, one limitation of this approach is that it can require orders of magnitude additional training time due to high cost of generating strong adversarial examples during training. In this paper, we first show that there is high transferability between models from neighboring epochs in the same training process, i.e., adversarial examples from one epoch continue to be adversarial in subsequent epochs. Leveraging this property, we propose a novel method, Ad-versarial Training with Transferable Adversarial Examples (ATTA), that can enhance the robustness of trained models and greatly improve the training efficiency by accumulating adversarial perturbations through epochs. Compared to state-of-the-art adversarial training methods, ATTA enhances adversarial accuracy by up to 7.2{\%} on CIFAR10 and requires 12 ∼ 14× less training time on MNIST and CIFAR10 datasets with comparable model robustness.},
author = {<NAME> and <NAME> and <NAME> <NAME> <NAME>},
file = {:Users/ziqizhang/Documents/Mendeley/Zheng et al/Zheng et al. - 2020 - Efficient Adversarial Training with Transferable Adversarial Examples.pdf:pdf},
pages = {1181--1190},
title = {{Efficient Adversarial Training with Transferable Adversarial Examples}},
year = {2020}
}
@article{Zheng2020a,
abstract = {Deep Neural Networks (DNNs) are known to be vulnerable to adversarial attacks. Currently, there is no clear insight into how slight perturbations cause such a large difference in classification results and how we can design a more robust model architecture. In this work, we propose a novel interpretability method, InterpretGAN, to generate explanations for features used for classification in latent variables. Interpreting the classification process of adversarial examples exposes how adversarial perturbations influence features layer by layer as well as which features are modified by perturbations. Moreover, we design the first diagnostic method to quantify the vulnerability contributed by each layer, which can be used to identify vulnerable parts of model architectures. The diagnostic results show that the layers introducing more information loss tend to be more vulnerable than other layers. Based on the findings, our evaluation results on MNIST and CIFAR10 datasets suggest that average pooling layers, with lower information loss, are more robust than max pooling layers for the network architectures studied in this paper.},
archivePrefix = {arXiv},
arxivId = {2007.08716},
author = {<NAME> and <NAME> and <NAME> <NAME>},
eprint = {2007.08716},
file = {:Users/ziqizhang/Documents/Mendeley/Zheng et al/Zheng et al. - 2020 - Understanding and Diagnosing Vulnerability under Adversarial Attacks.pdf:pdf},
month = {jul},
title = {{Understanding and Diagnosing Vulnerability under Adversarial Attacks}},
url = {http://arxiv.org/abs/2007.08716},
year = {2020}
}
