Improving Hierarchical Adversarial Robustness of Deep Neural Networks

Avery Ma, Aladin Virmaux, Kevin Scaman, Juwei Lu

Keywords: Adversarial Robustness

Abstract: Do all adversarial examples have the same consequences? An autonomous driving system misclassifying a pedestrian as a car may induce a far more dangerous --and even potentially lethal-- behavior than, for instance, a car as a bus. In order to better tackle this important problematic, we introduce the concept of hierarchical adversarial robustness. Given a dataset whose classes can be grouped into coarse-level labels, we define hierarchical adversarial examples as the ones leading to a misclassification at the coarse level. To improve the resistance of neural networks to hierarchical attacks, we introduce a hierarchical adversarially robust (HAR) network design that decomposes a single classification task into one coarse and multiple fine classification tasks, before being specifically trained by adversarial defense techniques. As an alternative to an end-to-end learning approach, we show that HAR significantly improves the robustness of the network against $\ell_{\infty}$ and $\ell_{2}$bounded hierarchical attacks on CIFAR-100.

One-sentence Summary: We introduce the hierarchical adversarial examples, along with a way to improve hierarchical adversarial robustness of neural network.

Code Of Ethics: I acknowledge that I and all co-authors of this work have read and commit to adhering to the ICLR Code of Ethics

Reviewed Version (pdf): https://openreview.net/references/pdf?id=yYF71nFaIe