3 ms·
This is called "adversarial training" and is ineffective because of transferability. Also the space of adversarial examples is thought to be large (especially a
by mholt 10y ago
This is called "adversarial training" and is ineffective because of transferability. Also the space of adversarial examples is thought to be large (especially as dimensionality increases), making robust adversarial training intractable in practice. See https://arxiv.org/abs/1312.6199 https://arxiv.org/abs/1312.6199 and https://arxiv.org/abs/1510.05328 https://arxiv.org/abs/1510.05328
- amelius 10y agoInteresting, what do you mean by transferability?
- mholt 10y agoTraining a model on adversarial examples essentially is a type of "gradient masking." (https://blog.openai.com/adversarial-example-research/ https://blog.openai.com/adversarial-example-research/) A model trained on one set of adversarial examples in an attempt to harden it against all adversarial examples is still vulnerable to adversarial examples produced from a totally separate model that performs the same task.