Adversarial Training Method Research Articles

A Gradual Adversarial Training Method for Semantic Segmentation

Deep neural networks (DNNs) have achieved great success in various computer vision tasks. However, they are susceptible to artificially designed adversarial perturbations, which limit their deployment in security-critical applications. In this paper, we propose a gradual adversarial training (GAT) method for remote sensing image segmentation. Our method incorporates a domain-adaptive mechanism that dynamically modulates input data, effectively reducing adversarial perturbations. GAT not only improves segmentation accuracy on clean images but also significantly enhances robustness against adversarial attacks, all without necessitating changes to the network architecture. The experimental results demonstrate that GAT consistently outperforms conventional standard adversarial training (SAT), showing increased resilience to adversarial attacks of varying intensities on both optical and Synthetic Aperture Radar (SAR) images. Compared to the SAT defense method, GAT achieves a notable defense performance improvement of 1% to 12%.

A3GT: An Adaptive Asynchronous Generalized Adversarial Training Method

Adversarial attack methods can significantly improve the classification accuracy of deep learning models, but research has found that although most deep learning models with defense methods still show good classification accuracy in the face of various adversarial attack attacks, the improved robust models have a significantly lower classification accuracy when facing clean samples compared to themselves without using defense methods. This means that while improving the model’s adversarial robustness, it is necessary to find a defense method to balance the accuracy of clean samples (clean accuracy) and the accuracy of adversarial samples (robust accuracy). Therefore, in this work, we propose an Adaptive Asynchronous Generalized Adversarial Training (A3GT) method, which is an improvement over the existing Generalist method. It employs an adaptive update strategy without the need for extensive experiments to determine the optimal starting iteration for global updates. The experimental results show that compared with other advanced methods, A3GT can achieve a balance between clean sample classification accuracy and robust classification accuracy while improving the model’s adversarial robustness.

Malicious Participants and Fake Task Detection Incorporating Gaussian Bias

Mobile crowdsensing (MCS) is a combination of crowdsourcing ideas and mobile sensing devices, designed to enable rational allocation of resources at scale. However, the MCS platform is highly vulnerable to injection attacks from malicious participants and fake tasks that interfere with platform service capabilities and sensing activities. To this end, the participant and task submission process is modeled as a multivariate time series, and a detection model for malicious participants and fake tasks (MP-FTD) with a Gaussian prior on the attentional mechanism and a two-stage adversarial training process is proposed. The attention mechanism was corrected using Gaussian bias, and then the corrected attention mechanism was used to obtain the correlation discrepancies between the data. Using the adversarial training method of Generative Adversarial Networks (GAN), the output of the correlation discrepancy reconstruction phase is transformed into a focus score, to amplify the reconstruction error in the output of the focus score reconstruction phase, and to improve the differentiation between the injected data and normal data of malicious attackers. The detection of these malicious attackers will effectively improve the robustness of the sensing platform. Experiments on six real-world datasets showed that the average F1-score reached 93.44%, outperforming the current baseline method, and resulting in an average 12.07% improvement in participant assignment accuracy and an average 12.25% improvement in task assignment accuracy in task assignment experiments.

Adversarial training for signal modulation classification based on Ulam stability theory

The modulation classification of radar, communication, and other radiation source signals under complex electromagnetic conditions is an important task in the field of military electronic countermeasures. Deep learning is an important tool for automatic modulation classification (AMC) tasks. However, AMC models based on deep neural networks are easily attacked by adversarial methods such as gradient attacks, and even under small perturbations, the model may exhibit significant differences in prediction. To address adversarial attacks, we proposed a Ulam stability adversarial training method, which could improve the robust accuracy and the natural accuracy of the adversarial training model. We introduced a class of Jensen type Ulam stability theorem, which transforms the Jensen condition into a special class of stability preserving regularization terms for adversarial training models, enhancing the model's adversarial robustness. More importantly, our method provided a framework for improving the stability of adversarial training, which can be combined with existing adversarial training methods to effectively enhance their adversarial defense capabilities. In the experimental section, we compared four types of adversarial training methods on three types of modulation recognition datasets, and the results showed that Ulam adversarial training improved robust accuracy by an average of 4.8% and natural accuracy by an average of 2.2% on three datasets. The difference between the best and final accuracies of the models decreased by an average of 4.5%.

Robust and transferable end-to-end navigation against disturbances and external attacks: an adversarial training approach

Purpose This paper aims to facilitate the research and development of resilient navigation approaches, explore the robustness of adversarial training to different interferences and promote their practical applications in real complex environments. Design/methodology/approach In this paper, the authors first summarize the real accidents of self-driving cars and develop a set of methods to simulate challenging scenarios by introducing simulated disturbances and attacks into the input sensor data. Then a robust and transferable adversarial training approach is proposed to improve the performance and resilience of current navigation models, followed by a multi-modality fusion-based end-to-end navigation network to demonstrate real-world performance of the methods. In addition, an augmented self-driving simulator with designed evaluation metrics is built to evaluate navigation models. Findings Synthetical experiments in simulator demonstrate the robustness and transferability of the proposed adversarial training strategy. The simulation function flow can also be used for promoting any robust perception or navigation researches. Then a multi-modality fusion-based navigation framework is proposed as a light-weight model to evaluate the adversarial training method in real-world. Originality/value The adversarial training approach provides a transferable and robust enhancement for navigation models both in simulation and real-world.

Deep learning-based magnetic resonance imaging analysis for chronic cerebral hypoperfusion risk.

Chronic cerebral hypoperfusion (CCH) is a frequently encountered clinical condition that poses a diagnostic challenge due to its nonspecific symptoms. To enhance the diagnosis of CCH and non-CCH through Magnetic Resonance Imaging (MRI), offering support in clinical decision-making and recommendations to ultimately elevate diagnostic accuracy and optimize patient treatment outcomes. In the retrospective research, we collected 204 routine brain magnetic resonance imaging (MRI) from March 1 to September 10 2022, as training and testing cohorts. And a validation cohort with 108 samples was collected from November 14 2022 to August 4 2023. MRI sequences were processed to obtain T1-weighted (T1WI) and T2-weighted (T2WI) sequence images for each patient. We propose CCH-Network (CCHNet), an end-to-end deep learning model, integrating convolution and Transformer modules to capture local and global structural information. Our novel adversarial training method improves feature knowledge capture, enhancing both generalization ability and efficiency in predicting CCH risk. We assessed the classification performance of the proposed model CCHNet by comparing it with existing state-of-the-art deep learning algorithms, including ResNet34, DenseNet121, VGG16, Convnext, ViT, Coat, and TransFG. To better validate model performance, we compared the results of the proposed model with eight neurologists to evaluate their consistency. CCHNet achieved an AUC of 91.6% (95% CI: 86.8-99.1), with an accuracy (ACC) of 85.0% (95% CI: 75.6-95.2). It demonstrated a sensitivity (SE) of 80.0% (95% CI: 71.6-95.6) and a specificity (SP) of 90.0% (95% CI: 82.3-97.8) in the testing cohort. In the validation cohort, the model demonstrated an AUC of 86.0% (95% CI: 80.3-93.0), an ACC of 84.2% (95% CI: 70.2-93.6), a SE of 83.3% (95% CI: 68.3-95.5), and a SP of 84.7% (95% CI: 70.3-96.8). The model improved the diagnostic performance of MRI with high SE and SP, providing a promising method for the diagnosis of CCH.

Sliced Wasserstein adversarial training for improving adversarial robustness

Recently, deep-learning-based models have achieved impressive performance on tasks that were previously considered to be extremely challenging. However, recent works have shown that various deep learning models are susceptible to adversarial data samples. In this paper, we propose the sliced Wasserstein adversarial training method to encourage the logit distributions of clean and adversarial data to be similar to each other. We capture the dissimilarity between two distributions using the Wasserstein metric and then align distributions using an end-to-end training process. We present the theoretical background of the motivation for our study by providing generalization error bounds for adversarial data samples. We performed experiments on three standard datasets and the results demonstrate that our method is more robust against white box attacks compared to previous methods.

Comprehensive Overview of GAN Technology: Architecture, Training, and Applications

Abstract: Generative Adversarial Networks (GANs) is a groundbreaking artificial intelligence technology that transforms generative modeling through the implementation of a novel adversarial training framework. GANs are made up of two neural networks, the generator and the discriminator, which compete in a minimax game in order to generate counterfeit samples of data and distinguish between real and fake data. This adversarial training method results in the creation of highly proficient generative models capable of producing data that is identical to real-world samples. GANs have been shown to have significant outcomes in a variety of programs, consisting of synthesizing images, style transfer, medical visualization, and natural language processing. However, GANs encounter difficulties with problems like mode collapse and operational irregularities. Presently, research is aimed at tackling these problems and strengthening GAN frameworks and training approaches. GANs’ adaptability and perspective contribute to an intriguing technology for a wide range of sectors and artistic activities, with consequences for artificial intelligence growth and generative modeling breakthroughs. GANs incorporate the potential of competitive training with their capacity to generate extremely realistic data in a variety of domains. We will begin by looking at the fundamental concepts, and underlying principles that reinforce GANs, and their general architecture, investigate their different possible uses, and discuss the obstacles and potential developments in this instantly transforming field.

Perturbation-Invariant Adversarial Training for Neural Ranking Models: Improving the Effectiveness-Robustness Trade-Off

Neural ranking models (NRMs) have shown great success in information retrieval (IR). But their predictions can easily be manipulated using adversarial examples, which are crafted by adding imperceptible perturbations to legitimate documents. This vulnerability raises significant concerns about their reliability and hinders the widespread deployment of NRMs. By incorporating adversarial examples into training data, adversarial training has become the de facto defense approach to adversarial attacks against NRMs. However, this defense mechanism is subject to a trade-off between effectiveness and adversarial robustness. In this study, we establish theoretical guarantees regarding the effectiveness-robustness trade-off in NRMs. We decompose the robust ranking error into two components, i.e., a natural ranking error for effectiveness evaluation and a boundary ranking error for assessing adversarial robustness. Then, we define the perturbation invariance of a ranking model and prove it to be a differentiable upper bound on the boundary ranking error for attainable computation. Informed by our theoretical analysis, we design a novel perturbation-invariant adversarial training (PIAT) method for ranking models to achieve a better effectiveness-robustness trade-off. We design a regularized surrogate loss, in which one term encourages the effectiveness to be maximized while the regularization term encourages the output to be smooth, so as to improve adversarial robustness. Experimental results on several ranking models demonstrate the superiority of PITA compared to existing adversarial defenses.

Can Perturbations Help Reduce Investment Risks? Risk-aware Stock Recommendation via Split Variational Adversarial Training

In the stock market, a successful investment requires a good balance between profits and risks. Based on the learning to rank paradigm, stock recommendation has been widely studied in quantitative finance to recommend stocks with higher return ratios for investors. Despite the efforts to make profits, many existing recommendation approaches still have some limitations in risk control, which may lead to intolerable paper losses in practical stock investing. To effectively reduce risks, we draw inspiration from adversarial learning and propose a novel Split Variational Adversarial Training (SVAT) method for risk-aware stock recommendation. Essentially, SVAT encourages the stock model to be sensitive to adversarial perturbations of risky stock examples and enhances the model’s risk awareness by learning from perturbations. To generate representative adversarial examples as risk indicators, we devise a variational perturbation generator to model diverse risk factors. Particularly, the variational architecture enables our method to provide a rough risk quantification for investors, showing an additional advantage of interpretability. Experiments on several real-world stock market datasets demonstrate the superiority of our SVAT method. By lowering the volatility of the stock-recommendation model, SVAT effectively reduces investment risks and outperforms state-of-the-art baselines by more than 30% in terms of risk-adjusted profits. All the experimental data and source code are available at https://drive.google.com/drive/folders/14AdM7WENEvIp5x5bV3zV_i4Aev21C9g6?usp=sharing .

Domain Adaptation of Anchor-Free object detection for urban traffic

Modern detectors are mostly trained under single and limited conditions. However, object detection faces various complex and open situations in autonomous driving, especially in urban street scenes with dense objects and complex backgrounds. Due to the shift in data distribution, modern detectors cannot perform well in actual urban environments. Using domain adaptation to improve detection performance is one of the key methods to extend object detection from limited situations to open situations. To this end, this article proposes a Domain Adaptation of Anchor-Free object detection (DAAF) for urban traffic. DAAF is a cross-domain object detection method that performs feature alignment including two aspects. On the one hand, we designed a fully convolutional adversarial training method for global feature alignment at the image level. Meanwhile, images can generally be decomposed into structural information and texture information. In urban street scenes, the structural information of images is generally similar. The main difference between the source domain and the target domain is texture information. Therefore, during global feature alignment, this paper proposes a method called texture information limitation (TIL). On the other hand, in order to solve the problem of variable aspect ratios of objects in urban street scenes, this article uses an anchor-free detector as the baseline detector. Since the anchor-free object detector can obtain neither explicit nor implicit instance-level features, we adopt Pixel-Level Adaptation (PLA) to align local features instead of instance-level alignment for local features. The size of the object has the greatest impact on the final detection effect, and the object scale in urban scenes is relatively rich. Guided by the differentiation of attention mechanisms, a multi-level adversarial network is designed to perform feature alignment of the output space at different feature levels called Scale Information Limitation (SIL). We conducted cross-domain detection experiments by using various urban streetscape autonomous driving object detection datasets, including adverse weather conditions, synthetic data to real data, and cross-camera adaptation. The experimental results indicate that the method proposed in this article is effective.

Smoothness Enforcing Projected Gradient Descent Adversarial Training

Abstract The paper proposes a novel adversarial training method based on a smoothness enforcing framework called Smoothness Enforcing Adversarial Training (SEAT). It is known that the traditional adversarial training methods suffer from prohibitive computational overhead and mismatched class distributions. To this end, our method is combined with smoothness enforcing methods in adversarial training iterations to achieve better robustness and generalization. SEAT reuses gradient information computed when updating model parameters. Meanwhile, random initialization and output smearing are integrated into the process to optimize the mismatched problems with better generalization performance. Furthermore, the temporal ensembling serves as an implicit self-ensemble of the adversarial information which benefits from a longer memory. In different iterations, the smoothness constraints are imposed to enforce smoothness. Unlike existing adversarial training methods, our method is free from arbitrarily complicated distributions and expensive generation of adversarial examples. Extensive experiments validate the effectiveness of SEAT in comparison with state-of-the-art adversarial training methods.

Physics-Constrained Adversarial Training for Neural Networks in Stochastic Power Grids

The growth in distributed energy resources (DERs) is an important step toward solving the global climate crisis. However, many DERs, such as wind and solar power, are random and intermittent, causing the data in power grids to be perturbed with high uncertainty. Such perturbations degrade the performance of data-driven algorithms introduced in power grids for sensing and control. Existing approaches can strengthen machine learning models against well-designed malicious attacks. However, such physics-agnostic efforts fail to ensure the robustness to natural perturbations in power grids, that occur due to varying loads and changes in control inputs. This paper proposes a novel physics-constrained adversarial training method for robustifying neural networks for the crucial problem of locating edge-faults in power grids. Our approach relies on first deriving analytical physical laws that are satisfied by state perturbations in realistic grids, and then using the descriptive sets during adversarial training. Compared to state of the art methods, our perturbation-robust neural networks have higher robust accuracy as well as training efficiency. Also, we demonstrate that the proposed approach achieves a tighter upper bound of robust risks than traditional efforts. The numerical experimental results in the IEEE 68-bus benchmark system validate our adversarial training in two scenarios when loads and control inputs vary randomly. The proposed method shows superior performance in accuracy and efficiency for different perturbed datasets. In addition, we testify the influence of different inputs on the robustness.

Adversarial training of multi-scale channel attention network for enhanced robustness in bearing fault diagnosis

For bearing fault diagnosis problems in extremely noisy environments, this paper proposes an innovative universal adversarial training method. This method dynamically introduces noise into the training data, adaptively optimizing the model’s robustness. It applies to any neural network without incurring additional computational overhead in the reasoning process. Additionally, we introduce the multi-scale channel attention network (MSCAN). This network employs stacked convolutional kernels of varying sizes to extract features at different scales from the input signal. The incorporation of the channel attention mechanism allocates distinct weights to features of different scales, further enhancing the network’s representational capacity. Moreover, an automated machine learning-based automated tuning approach is employed to optimize the model training process, aiding in improving inference accuracy. Compared to existing designs, MSCAN exhibits exceptional accuracy. Through adversarial training, it maintains a 99.44% accuracy rate on the Case Western Reserve University dataset under strong −3 dB noise conditions. On the Paderborn University dataset at 0 dB, this adversarial training significantly improves the testing accuracy of various models by an average of 36.42%.

Improvements to adversarial training for text classification tasks

Although deep learning models show powerful performance, they are still easily deceived by adversarial samples. Some methods for generating adversarial samples have the drawback of high time loss, which is problematic for adversarial training, and the existing adversarial training methods are difficult to adapt to the dynamic nature of the model, so it is still challenging to study an efficient adversarial training method. In this paper, we propose an adversarial training method, the core of which is the improved adversarial sample generation method AGFAT for adversarial training and the improved dynamic adversarial training method AGFAT-DAT. AGFAT uses a word frequency-based approach to identify significant words, filter replacement candidates, and use an efficient semantic constraint module as a means to reduce the time of adversarial sample generation; AGFAT-DAT is a dynamic adversarial training approach that uses a cyclic attack on the model after adversarial training and generates adversarial samples for adversarial training again. It is demonstrated that the proposed method can significantly reduce the generation time of adversarial samples, and the adversarial-trained model can also effectively defend against other types of word-level adversarial attacks.

GReAT: A Graph Regularized Adversarial Training Method

GReAT: A Graph Regularized Adversarial Training Method

InfoAT: Improving Adversarial Training Using the Information Bottleneck Principle.

Adversarial training (AT) has shown excellent high performance in defending against adversarial examples. Recent studies demonstrate that examples are not equally important to the final robustness of models during AT, that is, the so-called hard examples that can be attacked easily exhibit more influence than robust examples on the final robustness. Therefore, guaranteeing the robustness of hard examples is crucial for improving the final robustness of the model. However, defining effective heuristics to search for hard examples is still difficult. In this article, inspired by the information bottleneck (IB) principle, we uncover that an example with high mutual information of the input and its associated latent representation is more likely to be attacked. Based on this observation, we propose a novel and effective adversarial training method (InfoAT). InfoAT is encouraged to find examples with high mutual information and exploit them efficiently to improve the final robustness of models. Experimental results show that InfoAT achieves the best robustness among different datasets and models in comparison with several state-of-the-art methods.

Contrastive semi-supervised adversarial training method for hyperspectral image classification networks

Contrastive semi-supervised adversarial training method for hyperspectral image classification networks

Adv-4-Adv: Thwarting changing adversarial perturbations via adversarial domain adaptation

Whereas adversarial training can be useful against specific adversarial perturbations, they have also been proven ineffective in generalizing towards attacks deviating from those used for training. However, we observe that this ineffectiveness is intrinsically connected to domain adaptability, another crucial issue in deep learning for which adversarial domain adaptation appears to be a promising solution. Consequently, we propose Adv-4-Adv as a novel adversarial training method that aims to retain robustness against unseen adversarial perturbations. Essentially, Adv-4-Adv treats attacks incurring different perturbations as distinct domains, and by leveraging the power of adversarial domain adaptation, it aims to remove the domain/attack-specific features. This forces a trained model to learn a robust domain-invariant representation, which in turn enhances its generalizability. Extensive evaluations on Fashion-MNIST, SVHN, CIFAR-10, and CIFAR-100 demonstrate that a model trained by Adv-4-Adv based on examples crafted by simple attacks (e.g., FGSM) can be generalized to more advanced attacks (e.g., PGD), and the performance exceeds state-of-the-art proposals on these datasets.

Improving model robustness of traffic crash risk evaluation via adversarial mix-up under traffic flow fundamental diagram

Recent state-of-art crash risk evaluation studies have exploited deep learning (DL) techniques to improve performance in identifying high-risk traffic operation statuses. However, it is doubtful if such DL-based models would remain robust to real-world traffic dynamics (e.g., random traffic fluctuations.) as DL models are sensitive to input changes, where small perturbations could lead to wrong predictions. This study raises the critical robustness issue for crash risk evaluation models and investigates countermeasures to enhance it. By mixing up crash and non-crash samples under the traffic flow fundamental diagram, traffic flow adversarial examples (TF-AEs) were generated to simulate real-world traffic fluctuations. With the developed TF-AEs, model accuracy decreased by 8% and sensitivity dropped by 18%, indicating weak robustness of the baseline model (a convolutional neural network, CNN-based crash risk evaluation model). Then, a coverage-oriented adversarial training method was proposed to improve model robustness in highly imbalanced crash and non-crash situations and various crash risk transition patterns. Experiments showed that the proposed method was effective to improve model robustness as it could prevent 76.5% accuracy drops and 98.9% sensitivity drops against TF-AEs. Finally, the evaluation model outputs’ stability and limitations of the current study are discussed.