Perturbation Type Categorization for Multiple Adversarial Perturbation Robustness

Pratyush Maini, Xinyun Chen, Bo Li, Dawn Song

Research output: Contribution to journalConference articlepeer-review


Recent works in adversarial robustness have proposed defenses to improve the robustness of a single model against the union of multiple perturbation types. However, these methods still suffer significant trade-offs compared to the ones specifically trained to be robust against a single perturbation type. In this work, we introduce the problem of categorizing adversarial examples based on their perturbation types. We first theoretically show on a toy task that adversarial examples of different perturbation types constitute different distributions-making it possible to distinguish them. We support these arguments with experimental validation on multiple ℓp attacks and common corruptions. Instead of training a single classifier, we propose PROTECTOR, a two-stage pipeline that first categorizes the perturbation type of the input, and then makes the final prediction using the classifier specifically trained against the predicted perturbation type. We theoretically show that at test time the adversary faces a natural trade-off between fooling the perturbation classifier and the succeeding classifier optimized with perturbation-specific adversarial training. This makes it challenging for an adversary to plant strong attacks against the whole pipeline. Experiments on MNIST and CIFAR-10 show that PROTECTOR outperforms prior adversarial training-based defenses by over 5% when tested against the union of ℓ1, ℓ2, ℓ attacks. Additionally, our method extends to a more diverse attack suite, also showing large robustness gains against multiple ℓp, spatial and recolor attacks.

Original languageEnglish (US)
Pages (from-to)1317-1327
Number of pages11
JournalProceedings of Machine Learning Research
StatePublished - 2022
Event38th Conference on Uncertainty in Artificial Intelligence, UAI 2022 - Eindhoven, Netherlands
Duration: Aug 1 2022Aug 5 2022

ASJC Scopus subject areas

  • Artificial Intelligence
  • Software
  • Control and Systems Engineering
  • Statistics and Probability


Dive into the research topics of 'Perturbation Type Categorization for Multiple Adversarial Perturbation Robustness'. Together they form a unique fingerprint.

Cite this