72
0

Adversarially Robust Deep Learning with Optimal-Transport-Regularized Divergences

Abstract

We introduce the ARMORDARMOR_D methods as novel approaches to enhancing the adversarial robustness of deep learning models. These methods are based on a new class of optimal-transport-regularized divergences, constructed via an infimal convolution between an information divergence and an optimal-transport (OT) cost. We use these as tools to enhance adversarial robustness by maximizing the expected loss over a neighborhood of distributions, a technique known as distributionally robust optimization. Viewed as a tool for constructing adversarial samples, our method allows samples to be both transported, according to the OT cost, and re-weighted, according to the information divergence. We demonstrate the effectiveness of our method on malware detection and image recognition applications and find that, to our knowledge, it outperforms existing methods at enhancing the robustness against adversarial attacks. ARMORDARMOR_D yields the robustified accuracy of 98.29%98.29\% against FGSMFGSM and 98.18%98.18\% against PGD40PGD^{40} on the MNIST dataset, reducing the error rate by more than 19.7%19.7\% and 37.2%37.2\% respectively compared to prior methods. Similarly, in malware detection, a discrete (binary) data domain, ARMORDARMOR_D improves the robustified accuracy under rFGSM50rFGSM^{50} attack compared to the previous best-performing adversarial training methods by 37.0%37.0\% while lowering false negative and false positive rates by 51.1%51.1\% and 57.53%57.53\%, respectively.

View on arXiv
@article{birrell2025_2309.03791,
  title={ Adversarially Robust Learning with Optimal Transport Regularized Divergences },
  author={ Jeremiah Birrell and Reza Ebrahimi },
  journal={arXiv preprint arXiv:2309.03791},
  year={ 2025 }
}
Comments on this paper