{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/cascade-adversarial-machine-learning","title":"Cascade Adversarial Machine Learning Regularized with a Unified Embedding","arxiv_id":"1708.02582","date":"2017-08-08","proceeding":"ICLR 2018 1","authors":["Taesik Na","Jong Hwan Ko","Saibal Mukhopadhyay"],"abstract":"Injecting adversarial examples during training, known as adversarial\ntraining, can improve robustness against one-step attacks, but not for unknown\niterative attacks. To address this challenge, we first show iteratively\ngenerated adversarial images easily transfer between networks trained with the\nsame strategy. Inspired by this observation, we propose cascade adversarial\ntraining, which transfers the knowledge of the end results of adversarial\ntraining. We train a network from scratch by injecting iteratively generated\nadversarial images crafted from already defended networks in addition to\none-step adversarial images from the network being trained. We also propose to\nutilize embedding space for both classification and low-level (pixel-level)\nsimilarity learning to ignore unknown pixel level perturbation. During\ntraining, we inject adversarial images without replacing their corresponding\nclean images and penalize the distance between the two embeddings (clean and\nadversarial). Experimental results show that cascade adversarial training\ntogether with our proposed low-level similarity learning efficiently enhances\nthe robustness against iterative attacks, but at the expense of decreased\nrobustness against one-step attacks. We show that combining those two\ntechniques can also improve robustness under the worst case black box attack\nscenario.","url_abs":"http://arxiv.org/abs/1708.02582v3","url_pdf":"http://arxiv.org/pdf/1708.02582v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"cascade-adversarial-machine-learning","repo_url":"https://github.com/taesikna/cascade_adv_training","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"tf","reach":{"status":"unanswered"}}],"tasks":[{"task_slug":"machine-learning","task_name":"BIG-bench Machine Learning"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/1708.02582","atlas_url":"https://app.syntology.ai/?focus=1708.02582","mcp":null,"developers":"https://syntology.ai/developers"},"arxiv_metadata":null,"syntology_extracted_results":null}