On Adversarial Robustness: A Neural Architecture Search perspective

Devaguptapu, Chaitanya and Agarwal, Devansh and Mittal, Gaurav and Gopalani, Pulkit and Balasubramanian, Vineeth N (2021) On Adversarial Robustness: A Neural Architecture Search perspective. In: 18th IEEE/CVF International Conference on Computer Vision Workshops, ICCVW 2021, 11 October 2021 through 17 October 2021, Virtual, Online.

Text
Conference_on_Computer_Vision.pdf - Published Version
Available under License Creative Commons Attribution.
Download (1MB)

Abstract

Adversarial robustness of deep learning models has gained much traction in the last few years. Various attacks and defenses are proposed to improve the adversarial robustness of modern-day deep learning architectures. While all these approaches help improve the robustness, one promising direction for improving adversarial robustness is unexplored, i.e., the complex topology of the neural network architecture. In this work, we address the following question: "Can the complex topology of a neural network give adversarial robustness without any form of adversarial training?". We answer this empirically by experimenting with different hand-crafted and NAS-based architectures. Our findings show that, for small-scale attacks, NAS-based architectures are more robust for small-scale datasets and simple tasks than hand-crafted architectures. However, as the size of the dataset or the complexity of task increases, hand-crafted architectures are more robust than NAS-based architectures. Our work is the first large-scale study to understand adversarial robustness purely from an architectural perspective. Our study shows that random sampling in the search space of DARTS (a popular NAS method) with simple ensembling can improve the robustness to PGD attack by nearly 12%. We show that NAS, which is popular for achieving SoTA accuracy, can provide adversarial accuracy as a free add-on without any form of adversarial training. Our results show that leveraging the search space of NAS methods with methods like ensembles can be an excellent way to achieve adversarial robustness without any form of adversarial training. We also introduce a metric that can be used to calculate the trade-off between clean accuracy and adversarial robustness. Code and pre-trained models will be made available at https://github.com/tdchaitanya/nas-robustness © 2021 IEEE.

[error in script]

IITH Creators:

IITH Creators	ORCiD
Balasubramanian, Vineeth N	https://orcid.org/0000-0003-2656-0375

Item Type:

Conference or Workshop Item (Paper)

Uncontrolled Keywords:

Complex topology; Learning architectures; Learning models; Neural architectures; Neural network architecture; Neural-networks; Search spaces; Simple++; Small scale; Various attacks

Subjects:

Computer science

Divisions:

Department of Computer Science & Engineering

Depositing User:

. LibTrainee 2021

Date Deposited:

12 Sep 2022 07:06

Last Modified:

12 Sep 2022 07:06

URI:

http://raiithold.iith.ac.in/id/eprint/10536