Stable Neural ODE with Lyapunov-Stable Equilibrium Points for Defending Against Adversarial Attacks
Stable Neural ODE with Lyapunov-Stable Equilibrium Points for Defending Against Adversarial Attackss.
Qiyu Kang, Yang Song, Qinxu Ding, Wee Peng Tay
Environment settings
- OS: Ubuntu 18.04
- GPU: RTX 2080 Ti, RTX a5000, RTX 3090
- Cuda: 11.1 or 10.2
- Python: >=3.6
- PyTorch: >= 1.6.0
- Torchvision: >= 0.7.0
Empirical Evaluations
Compatibility of SODEF
In this section, we show compatibility of SODEF using TRADES:
We append our SODEF after TRADES net to improve the model robustness against adversarial attacks. TRADES works as the feature extractor as in our paper. Please note TRADES weights are kept fixed during the training. We use the pretrained model provided by TRADES Repo.
| Attack / Model | TRADES ℒ∞ | TRADES+SODEF ℒ∞ | TRADES ℒ2 | TRADES+SODEF ℒ2 |
|---|---|---|---|---|
| Clean | 85.48 | 85.18 | 85.48 | 85.18 |
| APGDCE | 56.08 | 70.90 | 61.74 | 74.35 |
| APGDDLRT | 53.70 | 64.15 | 59.22 | 68.55 |
| FABT | 54.18 | 82.92 | 60.31 | 83.15 |
| Square | 59.12 | 62.21 | 72.65 | 76.02 |
| AutoAttack | 53.69 | 57.76 | 59.42 | 67.75 |
Tab 1. Classification accuracy (%) using TRADES (w/ and w/o SODEF) under
AutoAttack on adversarial CIFAR10 examples with ℒ2 norm
(ϵ = 0.5) and ℒ∞ norm (ϵ = 8/255).
Transfer attack:
Classification accuracy for adv examples generated from original pretrained model using AA ℒ∞ (ϵ = 8/255) attacks : 61.94%.
cd trades_r
python sodef_eval_ode.py
cd trades_r
sodef_eval_transfer.ipynb
Notification
More test code and models will be uploaded soon after packing.
We currenly only upload the test code for SODEF. Please understand we have strict protocols for code release as this research is partially funded by corporate funding. We will upload the training code as soon as permission is granted.
