Maximum Mean Discrepancy Test is Aware of Adversarial Attacks (2020-10-22T00:00:00.000000Z)

TL;DR

It is verified that the MMD test is aware of adversarial attacks, which lights up a novel road for adversarial data detection based on two-sample tests.

Abstract

The maximum mean discrepancy (MMD) test could in principle detect any distributional discrepancy between two datasets. However, it has been shown that the MMD test is unaware of adversarial attacks -- the MMD test failed to detect the discrepancy between natural and adversarial data. Given this phenomenon, we raise a question: are natural and adversarial data really from different distributions? The answer is affirmative -- the previous use of the MMD test on the purpose missed three key factors, and accordingly, we propose three components. Firstly, the Gaussian kernel has limited representation power, and we replace it with an effective deep kernel. Secondly, the test power of the MMD test was neglected, and we maximize it following asymptotic statistics. Finally, adversarial data may be non-independent, and we overcome this issue with the wild bootstrap. By taking care of the three factors, we verify that the MMD test is aware of adversarial attacks, which lights up a novel road for adversarial data detection based on two-sample tests.

Authors

Tongliang Liu

8 papers

Masashi Sugiyama

11 papers

Bo Han

6 papers

TL;DR

Abstract

Authors

References77 items

On the Convergence and Robustness of Adversarial Training

Understanding the Interaction of Adversarial Training with Noisy Labels

How does the Combined Risk Affect the Performance of Unsupervised Domain Adaptation Approaches?

Once-for-All Adversarial Training: In-Situ Tradeoff between Robustness and Accuracy for Free

Geometry-aware Instance-reweighted Adversarial Training

Multisource Heterogeneous Unsupervised Domain Adaptation via Fuzzy Relation Neural Networks

Dual-Path Distillation: A Unified Framework to Improve Black-Box Attacks

A One-Step Approach to Covariate Shift Adaptation

Clarinet: A One-step Approach Towards Budget-friendly Unsupervised Domain Adaptation

Label-Noise Robust Domain Adaptation

Rethinking Importance Weighting for Deep Learning under Distribution Shift

Improving Adversarial Robustness Requires Revisiting Misclassified Examples

Adversarial Weight Perturbation Helps Robust Generalization

Adversarial Robustness: From Self-Supervised Pre-Training to Fine-Tuning

Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks

Attacks Which Do Not Kill Training Make Adversarial Learning Stronger

Learning Deep Kernels for Non-Parametric Two-Sample Tests

Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbations

Domain Adaptation As a Problem of Inference on Graphical Models

Square Attack: a query-efficient black-box adversarial attack via random search

Two-sample Testing Using Deep Learning

Hilbert-Based Generative Defense for Adversarial Examples

Understanding Adversarial Attacks on Deep Learning Based Medical Image Analysis Systems

Open Set Domain Adaptation: Theoretical Bound and Algorithm

Unbiased estimators for the variance of MMD estimators

Butterfly: A Panacea for All Difficulties in Wildly Unsupervised Domain Adaptation

Data-Driven Approach to Multiple-Source Domain Adaptation

Theoretically Principled Trade-off between Robustness and Accuracy

Learning deep kernels for exponential family densities

A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks

Semi-supervised Deep Kernel Learning: Regression with Unlabeled Data by Minimizing Predictive Variance

Fully Distributed Sequential Hypothesis Testing: Algorithms and Asymptotic Analyses

Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality

Demystifying MMD GANs

CuRTAIL: ChaRacterizing and Thwarting AdversarIal Deep Learning

Towards Deep Learning Models Resistant to Adversarial Attacks

A Linear-Time Kernel Goodness-of-Fit Test

Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods

Two-Sample Tests for Large Random Graphs Using Network Statistics

Detecting Adversarial Samples from Artifacts

On the (Statistical) Detection of Adversarial Examples

On Detecting Adversarial Perturbations

Adversarial Examples Detection in Deep Networks with Convolutional Filter Statistics

Generative Models and Model Criticism via Optimized Maximum Mean Discrepancy

Revisiting Classifier Two-Sample Tests

Towards Evaluating the Robustness of Neural Networks

Adversarial examples in the physical world

Domain Adaptation with Conditional Transferable Components

Wide Residual Networks

Interpretable Distribution Features with Maximum Testing Power

Fast Two-Sample Testing with Analytic Representations of Probability Measures

DeepDriving: Learning Affordance for Direct Perception in Autonomous Driving

Explaining and Harnessing Adversarial Examples

Feature Cross-Substitution in Adversarial Classification

Deep neural networks are easily fooled: High confidence predictions for unrecognizable images

A Wild Bootstrap for Degenerate Kernel Tests

Intriguing properties of neural networks

A New Graph-Based Two-Sample Test for Multivariate and Object Data

Dependent wild bootstrap for degenerate U- and V-statistics

Optimal kernel choice for large-scale two-sample tests

A Kernel Two-Sample Test

Least-squares two-sample test

Relative Density-Ratio Estimation for Robust Distribution Comparison

The security of machine learning

The Dependent Wild Bootstrap

Security analysis of online centroid anomaly detection

Hilbert Space Embeddings and Metrics on Probability Measures

A Kernel Statistical Test of Independence

Integrating structured biological data by Kernel Maximum Mean Discrepancy

Measuring Statistical Dependence with Hilbert-Schmidt Norms

On U-statistics and v. mise’ statistics for weakly dependent processes

Limiting behavior of U-statistics for stationary, absolutely regular processes

Arguments for Fisher's Permutation Test

Exploiting MMD and Sinkhorn Divergences for Fair and Transferable Representation Learning

Decision Boundary Analysis of Adversarial Examples

Visualizing Data using t-SNE