PaperlayerView exact revision on arXiv

Source-linked AI summary

advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorch

Gavin Weiguang Ding, Luyu Wang, Xiaomeng Jin

arXiv:1902.07623v1cs.LGcs.CRcs.CVstat.ML

TL;DR

Adversarial robustness research needs implementations spanning attacks, defenses, and robust training. advertorch addresses this with modular PyTorch reference implementations and GPU execution, while requiring version and hyperparameter reporting for benchmarks.

  • Problem

    Adversarial robustness research spans attacks, defenses, and robust training, creating a need for tools supporting these research directions.

    Source: §1 · p. 1

  • Method

    advertorch provides modular attacks, defenses, and robust-training implementations built around PyTorch’s dynamic computational graphs.

    Source: §1 · p. 1, §2.1 · p. 2, §3 · pp. 3–4

  • Results

    The toolbox provides concise reference implementations with simple APIs and fast GPU-powered execution for adversarial robustness research.

    Source: §1 · p. 1

  • Takeaways & Limitations

    advertorch supports research workflows requiring reusable attack components, composable defenses, and adversarial-training reference implementations.

    Source: §2.1 · p. 2, §2.3 · p. 3, §3 · pp. 3–4

    Benchmark results require reporting the advertorch MAJOR.MINOR version and detailed hyperparameters, including attack settings.

    Source: §4 · p. 4

Abstract

from arXiv · show

advertorch is a toolbox for adversarial robustness research. It contains various implementations for attacks, defenses and robust training methods. advertorch is built on PyTorch (Paszke et al., 2017), and leverages the advantages of the dynamic computational graph to provide concise and efficient reference implementations. The code is licensed under the LGPL license and is open sourced at https://github.com/BorealisAI/advertorch .

1 Introduction

advertorch is a PyTorch toolbox for adversarial robustness research spanning attacks, defenses, and robust training. It emphasizes concise, efficient implementations and aims to support research across these directions.

  • Adversarial robustness research addresses attacks, detection, defenses for trained models, and robust training.Source: §1 · p. 1
  • advertorch provides tools for research in the adversarial robustness directions described above, with the current version covering attacks, defenses, and robust training.Source: §1 · p. 1
  • The toolbox aims for simple consistent APIs, concise PyTorch reference implementations, and fast GPU-powered execution.Source: §1 · p. 1
  • The report covers attack design and implementations, defenses and robust training, and versioning.Source: §1 · p. 1

2 Attacks

advertorch organizes attacks around reusable components and implements gradient-based, other, and BPDA-enhanced attacks. Its component decoupling supports more versatile objectives without changing the underlying perturbation implementation.

  • The toolbox includes gradient-based attacks, other attacks such as SinglePixelAttack and LocalSearchAttack, and a BPDA wrapper.Source: §2.1 · p. 2, §2 · p. 2, §2.2 · p. 3
  • Each attack separates prediction, loss calculation, and perturbation into three core components.Source: §2.1 · p. 2

Gradient-Based Attacks

  • For untargeted LinfPGDAttack, the classifier predicts logits, loss_fn computes gradients from predict(x) and y, and perturb modifies the input.Source: §2.1 · p. 2
  • Decoupled predict and loss_fn components let attacks reuse the same perturbation routine across classification and feature-matching objectives.Source: §2.1 · p. 2
  • Multi-objective attacks can target labels and feature representations together by using tuple-valued targets and predictions without changing the perturbation implementation.Source: §2.1 · p. 2

BPDA Wrapper

  • BPDAWrapper preserves a defense’s forward pass while replacing its backward pass with a specified substitute, such as the identity function.Source: §2.3 · p. 3

3 Defenses and Robust Training

advertorch includes modular preprocessing defenses and reference implementations for robust training. Its defenses are PyTorch modules, while training support includes adversarial and provably robust approaches.

Preprocessing-based Defenses

  • The current version implements JPEG filtering, bit squeezing, median smoothing, and several linear smoothing filters.Source: §3 · p. 3
  • Preprocessing defenses are implemented as PyTorch modules that can be combined dynamically.Source: §3 · p. 3

Robust Training

  • Adversarially augmented and provably robust training are described as effective methods against worst-case perturbations.Source: §3 · p. 3
  • Because robust-training algorithms are not standardized and vary in ways that hinder modularization, advertorch provides representative reference implementations.Source: §3 · pp. 3–4
  • The current training example implements Madry et al.’s adversarial training on MNIST.Source: §3 · p. 4

4 Versioning and Reporting Benchmark Results

advertorch uses Semantic Versioning to distinguish incompatible changes, backward-compatible functionality, and bug fixes. Benchmark reports should include the version and detailed attack hyperparameters for reproducibility.

  • advertorch follows MAJOR.MINOR.PATCH Semantic Versioning.Source: §4 · p. 4
  • MAJOR denotes incompatible API changes, MINOR adds backward-compatible functionality, and PATCH fixes backward-compatible bugs.Source: §4 · p. 4
  • Benchmark reports should state the MAJOR.MINOR version and detailed hyperparameters.Source: §4 · p. 4
  • For untargeted LinfPGDAttack, reporting should include the loss, perturbation bound, iteration count, step size, and random initialization status.Source: §4 · p. 4

Related papers

Loading 1902.07623v1…