Adversarial training has been successfully applied to build robust models at a certain cost. While the robustness of a model increases, the standard classification accuracy declines. This phenomenon is suggested to be an inherent trade-off. We propose a model that employs feature prioritization by a nonlinear attention module and L 2 feature regularization to improve the adversarial robustness and the standard accuracy relative to adversarial training. The attention module encourages the model to rely heavily on robust features by assigning larger weights to them while suppressing non-robust features. The regularizer encourages the model to extracts similar features for the natural and adversarial images, effectively ignoring the added perturbation. In addition to evaluating the robustness of our model, we provide justification for the attention module and propose a novel experimental strategy that quantitatively demonstrates that our model is almost ideally aligned with salient data characteristics. Additional experimental results illustrate the power of our model relative to the state of the art methods.
Summary: This paper argues that improved resistance to adversarial
attacks can be achieved by an implicit denoising method in which model
weights learned during adversarial training are encouraged to stay
close to a set of reference weights using the ell_2
penalty. Additionally, the authors claim that by introducing an
attention model which focuses the model training on more robust
features they can further improve performance. Some experiments are
provided.
Feedback: My main concerns with the paper are:
* The experimental section is fairly thin. There are at this point a
  large number of defense methods, of which Madry et al. is only one. In
  light of these, the experimental section should be expanded. The
  results should ideally be reported with error bars, which would help
  in gauging significance of the results.
* The differential impact of the two contributions is not entirely
  clear. The results in Table 1 suggest that implicit denoising can
  help, yet at the same time, Table 2 suggests that Black-box
  performance is better if we just use the attention model. Overall,
  this conflates the contributions unnecessarily and makes it hard to
  distingish their individual impact.
* The section on gradient maps is not clear. The authors argue that if
  the gradient map aligns with the image the model depends solely on
  the robust features. While this may be (somewhat more) intuitive in
  the context of simple GLMs, it's not clear why it should carry over
  to DNNs. I think it would help to make these intuitions much more
  precise. Secondly, even if this were the case, the methodology of
  using a neural net to classify gradient maps and from this derive a
  robustness metric raises precisely the kinds of robustness questions
  that the paper tries to answer. I.e.: how robust is the neural net
  classifying the gradient images, and how meaningful are it's
  predictions when gradient maps deviate from "clean" images.
Overall, I feel this paper has some potentially interesting ideas, but
needs additional work before it is ready for publication.