Recent work has proposed novel data augmentation methods to improve the adversarial robustness of deep neural networks. In this paper, we re-evaluate such methods through the lens of different metrics that characterize the augmented manifold, finding contradictory evidence. Our extensive empirical analysis involving 5 data augmentation methods, all tested with an increasing probability of augmentation, shows that: (i) novel data augmentation methods proposed to improve adversarial robustness only improve it when combined with classical augmentations (like image flipping and rotation), and even worsen adversarial robustness if used in isolation; and (ii) adversarial robustness is significantly affected by the augmentation probability, conversely to what is claimed in recent work. We conclude by discussing how to rethink the development and evaluation of novel data augmentation methods for adversarial robustness. Our open-source code is available at https://github.com/eghbalz/rethink_da_for_ar.
%0 Journal Article
%1 EGHBALZADEH2024119838
%A Eghbal zadeh, Hamid
%A Zellinger, Werner
%A Pintor, Maura
%A Grosse, Kathrin
%A Koutini, Khaled
%A Moser, Bernhard A.
%A Biggio, Battista
%A Widmer, Gerhard
%D 2024
%J Information Sciences
%K deep-learning mappings neural-networks
%P 119838
%R https://doi.org/10.1016/j.ins.2023.119838
%T Rethinking data augmentation for adversarial robustness
%U https://www.sciencedirect.com/science/article/pii/S0020025523014238
%V 654
%X Recent work has proposed novel data augmentation methods to improve the adversarial robustness of deep neural networks. In this paper, we re-evaluate such methods through the lens of different metrics that characterize the augmented manifold, finding contradictory evidence. Our extensive empirical analysis involving 5 data augmentation methods, all tested with an increasing probability of augmentation, shows that: (i) novel data augmentation methods proposed to improve adversarial robustness only improve it when combined with classical augmentations (like image flipping and rotation), and even worsen adversarial robustness if used in isolation; and (ii) adversarial robustness is significantly affected by the augmentation probability, conversely to what is claimed in recent work. We conclude by discussing how to rethink the development and evaluation of novel data augmentation methods for adversarial robustness. Our open-source code is available at https://github.com/eghbalz/rethink_da_for_ar.
@article{EGHBALZADEH2024119838,
abstract = {Recent work has proposed novel data augmentation methods to improve the adversarial robustness of deep neural networks. In this paper, we re-evaluate such methods through the lens of different metrics that characterize the augmented manifold, finding contradictory evidence. Our extensive empirical analysis involving 5 data augmentation methods, all tested with an increasing probability of augmentation, shows that: (i) novel data augmentation methods proposed to improve adversarial robustness only improve it when combined with classical augmentations (like image flipping and rotation), and even worsen adversarial robustness if used in isolation; and (ii) adversarial robustness is significantly affected by the augmentation probability, conversely to what is claimed in recent work. We conclude by discussing how to rethink the development and evaluation of novel data augmentation methods for adversarial robustness. Our open-source code is available at https://github.com/eghbalz/rethink_da_for_ar.},
added-at = {2024-01-23T19:14:04.000+0100},
author = {Eghbal zadeh, Hamid and Zellinger, Werner and Pintor, Maura and Grosse, Kathrin and Koutini, Khaled and Moser, Bernhard A. and Biggio, Battista and Widmer, Gerhard},
biburl = {https://www.bibsonomy.org/bibtex/25dbc01e623a6c17002e86d890d9562c8/scch},
doi = {https://doi.org/10.1016/j.ins.2023.119838},
interhash = {f364f55c4f8f30ac49ecf5eafbca88fe},
intrahash = {5dbc01e623a6c17002e86d890d9562c8},
issn = {0020-0255},
journal = {Information Sciences},
keywords = {deep-learning mappings neural-networks},
pages = 119838,
timestamp = {2024-01-23T19:14:04.000+0100},
title = {Rethinking data augmentation for adversarial robustness},
url = {https://www.sciencedirect.com/science/article/pii/S0020025523014238},
volume = 654,
year = 2024
}