This document discusses approaches to training deep neural networks to be robust against adversarial examples. It frames adversarial robustness as a minimax game between the network and an attacker. It presents projected gradient descent (PGD) and the Fast Gradient Sign Method (FGSM) as ways to solve the inner maximization problem during training. Experiments show that adversarially trained models can achieve increased robustness compared to standard networks.

1. Towards Deep Learning Models Resistant to Adversarial Attacks.

2. 1. Introduction
Introduction

3. Introduction
In particular, resistance to adversarially chosen inputs is becoming a crucial design goal

4. Introduction

5. Introduction
How can we train deep neural networks that
are robust to adversarial inputs?

6. 2. An Optimization View on Adversarial Robustness
An Optimization View on Adversarial Robustness

7. An Optimization View on Adversarial Robustness
Adversarial attack problem
Inner maximization problem
Outer minimization problem
Min max game
Saddle point problem

8. An Optimization View on Adversarial Robustness
PGD (projected gradient descent )
FGSM (Fast Gradient Sign Method)
Inner maximization problem

9. 3. Towards Universally Robust Networks
Towards Universally Robust Networks

10. Towards Universally Robust Networks

11. Towards Universally Robust Networks
Blue : loss on a standard network
Red : adversarially trained model

12. 4. Network Capacity and Adversarial Robustness
Network Capacity and Adversarial Robustness

13. Network Capacity and Adversarial Robustness

14. Experiments

15. 5. Experiments
Experiments

16. Experiments

18. references
Towards Deep Learning Models Resistant to Adversarial Attacks, Aleksander
Madry, Aleksandar Makelov; ICLR, 2018,
Explaining and Harnessing Adversarial Examples, Ian J. Goodfellow, Jonathon
Shlens, Christian Szegedy, ICLR, 2015,