No Feature Is An Island: Adaptive Collaborations Between Features Improve Adversarial Robustness

Yufeng Zhang, Yunan Zhang, ChengXiang Zhai

Keywords: robustness, adversarial attack, defense, representation learning, cooperative game, feature selection, adversarial robustness, reliable machine learning

Abstract: To classify images, neural networks extract features from raw inputs and then sum them up with fixed weights via the fully connected layer. However, the weights are fixed despite the input types. Such fixed prior limits networks' flexibility in adjusting feature reliance, which in turn enables attackers to flip networks' predictions by corrupting the most brittle features whose value would change drastically by minor perturbations. Inspired by the analysis, we replace the original fixed fully connected layer by dynamically calculating the posterior weight for each feature according to the input and connections between them. Also, a counterfactual baseline is integrated to precisely characterize the credit of each feature's contribution to the robustness and generality of the model. We empirically demonstrate that the proposed algorithm improves both standard and robust error against several strong attacks across various major benchmarks. Finally, we theoretically prove the minimal structure requirement for our framework to improve adversarial robustness in a fairly simple and natural setting.

One-sentence Summary: We find dynamic feature weighting can improve adversarial robustness and formulate our algorithm as a cooperative game.

Code Of Ethics: I acknowledge that I and all co-authors of this work have read and commit to adhering to the ICLR Code of Ethics

Reviewed Version (pdf): https://openreview.net/references/pdf?id=MFHvx8j26