Source-linked AI summary
Towards Deep Neural Network Architectures Robust to Adversarial Examples
Shixiang Gu, Luca Rigazio
TL;DR
The paper addresses the vulnerability of DNNs to small adversarial perturbations and studies how their structure, preprocessing, and training affect robustness. It evaluates denoising approaches and proposes end-to-end Deep Contractive Networks with a contractive smoothness penalty. The proposed framework propagates contractivity through the network without significant loss in final accuracy, while denoising alone can make a stacked model vulnerable to smaller-distortion attacks.
Problem
Small, often imperceptible perturbations can cause DNN misclassification, and preprocessing cannot make adversarial examples disappear because attacks can be found through added functions.
Method
The paper studies adversarial-example structure, denoising preprocessing, and end-to-end Deep Contractive Networks that propagate input invariance through layer-wise contractive penalties.
Results
Deep Contractive Networks propagate contractivity through deep architectures without significant loss in final accuracies, while denoising autoencoders can remove adversarial noise but stacked networks remain attackable.
Takeaways & Limitations
Robustness is addressed through training objectives that learn flat, invariant regions around training data rather than through preprocessing or topology alone.
Takeaways & Limitations
The paper leaves the performance loss of layer-wise penalties versus global contractive objectives for further study and proposes evaluating non-Euclidean adversarial examples.
Abstract
from arXiv · showhide
Recent work has shown deep neural networks (DNNs) to be highly susceptible to well-designed, small perturbations at the input layer, or so-called adversarial examples. Taking images as an example, such distortions are often imperceptible, but can result in 100% mis-classification for a state of the art DNN. We study the structure of adversarial examples and explore network topology, pre-processing and training strategies to improve the robustness of DNNs. We perform various experiments to assess the removability of adversarial examples by corrupting with additional noise and pre-processing with denoising autoencoders (DAEs). We find that DAEs can remove substantial amounts of the adversarial noise. How- ever, when stacking the DAE with the original DNN, the resulting network can again be attacked by new adversarial examples with even smaller distortion. As a solution, we propose Deep Contractive Network, a model with a new end-to-end training procedure that includes a smoothness penalty inspired by the contractive autoencoder (CAE). This increases the network robustness to adversarial examples, without a significant performance penalty.
1 INTRODUCTION
The introduction frames adversarial examples as a vulnerability arising from DNN behavior and asks how much perturbation is needed to cause misclassification. It motivates training procedures that increase the distortion required for successful attacks.
- 1 INTRODUCTION: Small, often imperceptible input perturbations can make otherwise high-performing DNNs misclassify examples.The introduction identifies adversarial examples as a deployment vulnerability, including when an attacker knows the network parameters.
- 1 INTRODUCTION: Earlier recursive SVM approaches avoid nonconvex optimization but perform below state-of-the-art DNNs, possibly because they lack end-to-end training.This provides related-work context for the paper’s emphasis on end-to-end robustness training.
- 1 INTRODUCTION: Adversarial examples are unavoidable in feed-forward models, so the practical objective is increasing the noticeability of the smallest successful perturbation.The paper defines robustness in terms of how much noise is needed to make an otherwise correct example misclassify.
- 1 INTRODUCTION: The paper investigates training procedures that make adversarial examples require higher distortion.This frames robustness as a training-objective problem rather than solely a topology or preprocessing problem.
- 1 INTRODUCTION: Denoising autoencoders can remove substantial adversarial structure, but stacking one with the classifier enables new attacks with even smaller distortion.The result motivates end-to-end architectures that incorporate input invariance with respect to the final output.
2 FRAMEWORK
The framework generates targeted adversarial examples by optimizing perturbation size together with classification loss under valid-input constraints. For dataset-level evaluation, it fixes the optimization constant and targets a 99% mean prediction error rate.
- 2.1 GENERATING ADVERSARIAL EXAMPLES: The adversarial noise r is approximated by minimizing c|r|2 + L(x + r, l) subject to x + r ∈ [0, 1]m.The classifier, continuous loss, original image, target label, and valid pixel range are defined before optimization.
- 2.1 GENERATING ADVERSARIAL EXAMPLES: The procedure uses a constant c for each dataset and model architecture instead of performing a per-example line search.This simplification is intended to speed macro-scale evaluation while retaining quantitative analysis.
- 2.1 GENERATING ADVERSARIAL EXAMPLES: 99% mean prediction error is used as the target while minimizing aggregate perturbation over a sufficiently large data subset.The criterion is applied to f(x_i + r_i) across the evaluation subset.
- 2. FRAMEWORK: Experiments use MNIST architectures with L2 weight decay λ = 10^-3 outside convolutional layers.The ConvNet contains two convolutional layers, one fully connected layer, and one softmax layer.
3 RECOVERING FROM ADVERSARIAL EXAMPLES
The section tests whether additional corruption and autoencoder preprocessing can recover performance on adversarial examples. These approaches recover substantial errors, but stacked networks remain vulnerable, motivating end-to-end training objectives that increase adversarial distortion.
- Noise injection: Additional Gaussian noise and blurring are evaluated as preprocessing strategies for recovering from adversarial examples.Gaussian noise is applied at the input layer or input plus hidden layers, while blurring is applied only at the input layer.
- Noise injection: More than 50% of adversarial examples are recovered for ConvNet with an 11-pixel Gaussian blur, at the cost of a 3% clean-data test-error increase.
- Noise injection: Gaussian noise with σ = 0.1 applied across input and hidden layers recovers more than 35% of adversarial examples with a similarly small clean-data performance loss.
- Autoencoder: Autoencoders recover at least 90% of adversarial errors across source models, but stacking an autoencoder with its classifier produces new adversarial examples with significantly smaller distortion.The stacked-network result is reported in the cross-model autoencoder evaluation and accompanying figure.
- Discussion: Adversarial noise is robust to local additive perturbations, while low-pass filtering and autoencoders indicate predominantly high-frequency, simple, exploitable structure.These observations motivate training procedures and objectives that propagate input invariance toward final outputs end-to-end.
4 DEEP CONTRACTIVE NETWORK
Deep Contractive Networks extend contractive autoencoders to feed-forward networks by penalizing layer-wise sensitivity to input perturbations. Experiments report increased adversarial distortion and preserved final accuracy, while acknowledging computational and capacity trade-offs.
- 4 DEEP CONTRACTIVE NETWORK: Deep Contractive Networks generalize contractive autoencoders to feed-forward networks by imposing a layer-wise contractive penalty.The penalty approximately minimizes network-output variance with respect to input perturbations, promoting flatness around training points.
- 4 DEEP CONTRACTIVE NETWORK: The contractive objective adds a Jacobian-based penalty that trades off reconstruction or prediction loss against sensitivity to input perturbations.The Frobenius norm measures the Jacobian of a representation with respect to the input, and λ controls the trade-off.
- 4 DEEP CONTRACTIVE NETWORK: A layer-wise approximation makes contractivity computationally efficient and compatible with standard backpropagation, but does not guarantee global optimality and limits network capacity.The approximation greedily propagates input invariance through the deep network.
- 4 DEEP CONTRACTIVE NETWORK: The experiments train contractively penalized models to nearly match the accuracy of corresponding original models before evaluating adversarial examples.Adversarial examples are generated using the procedure defined earlier in the paper.
- 4 DEEP CONTRACTIVE NETWORK: Contractive penalties increase the minimum adversarial distortion, and Deep Contractive Networks are more robust than standard networks trained with Gaussian input noise.Adding Gaussian input noise can further increase the minimum adversarial distortion.
- 4 DEEP CONTRACTIVE NETWORK: The reported results show contractivity propagated through the deep architecture without significant loss in final accuracies.The paper also identifies layer-wise penalties versus global contractive objectives as a subject for further evaluation.
- 4 DEEP CONTRACTIVE NETWORK: The framework also connects supervised learning with unsupervised representation learning by incorporating DAE and CAE penalties into standard DNNs.The paper presents these penalties as practical regularizers and efficient ways to learn local input-space generalization.
5 CONCLUSIONS
The paper finds that denoising autoencoders can remove adversarial noise, but stacking one with the original network increases sensitivity to new attacks. It therefore proposes Deep Contractive Networks, which learn invariant features through an appropriate training procedure and objective.
- Denoising autoencoders can remove adversarial noise, but the resulting stacked network is even more sensitive to new adversarial examples.This suggests that adversarial sensitivity is more related to the training procedure and objective function than to model topology.
- Deep Contractive Networks explicitly learn invariant features at each layer to make networks learn flat, invariant regions around training data.