Adversarial Diversity and Hard Positive Generation

Andras Rozsa; Ethan M. Rudd; Terrance E. Boult

Source-linked AI summary

Adversarial Diversity and Hard Positive Generation

Andras Rozsa, Ethan M. Rudd, Terrance E. Boult

arXiv:1605.01775v2May 5, 2016cs.CV

TL;DR

Deep networks can confidently misclassify inputs after small perturbations, and adversarial examples can transfer across networks. The paper introduces PASS, diverse hot/cold adversarial directions, and non-minimal hard positives for augmentation, finding improved robustness and accuracy with hard-positive fine-tuning. Its scope is bounded by not achieving state-of-the-art performance on MNIST or ImageNet.

Problem
Small perturbations can produce confident misclassifications, while adversarial examples may transfer across networks with different training conditions.
Method
The paper combines the perceptual PASS measure with hot/cold generation of multiple adversarial directions and non-minimal hard positives for data augmentation.
Results
Fine-tuning with diverse hard positives improves network robustness compared with training methods based on prior adversarial-example generation approaches.
Takeaways & Limitations
Amplified adversarial perturbations provide diverse training images, often with structurally meaningful artifacts rather than random-noise appearances.
Takeaways & Limitations
The approach did not achieve state-of-the-art performance on MNIST or ImageNet.

Abstract

from arXiv · show

State-of-the-art deep neural networks suffer from a fundamental problem - they misclassify adversarial examples formed by applying small perturbations to inputs. In this paper, we present a new psychometric perceptual adversarial similarity score (PASS) measure for quantifying adversarial images, introduce the notion of hard positive generation, and use a diverse set of adversarial perturbations - not just the closest ones - for data augmentation. We introduce a novel hot/cold approach for adversarial example generation, which provides multiple possible adversarial perturbations for every single image. The perturbations generated by our novel approach often correspond to semantically meaningful image structures, and allow greater flexibility to scale perturbation-amplitudes, which yields an increased diversity of adversarial images. We present adversarial images on several network topologies and datasets, including LeNet on the MNIST dataset, and GoogLeNet and ResidualNet on the ImageNet dataset. Finally, we demonstrate on LeNet and GoogLeNet that fine-tuning with a diverse set of hard positives improves the robustness of these networks compared to training with prior methods of generating adversarial images.

1 Introduction

The paper addresses adversarial examples that cause confident misclassification despite small perturbations and may transfer across networks. It proposes perceptual measurement, diverse hard-positive generation, and training-set augmentation to improve accuracy and robustness.

Small non-random perturbations can make correctly classified images misclassified, often with high confidence.
Adversarial examples can remain consistently misclassified across networks trained with different data, hyperparameters, depths, or activations.
The paper seeks representative adversarial examples that increase training-set diversity and generalization through data augmentation.
PASS quantifies adversarial images using a perceptual measure intended to align more closely with human perception than prior Lp norms.
The proposed approach generates diverse adversarial images and uses non-minimal hard positives to improve model accuracy and robustness during training.

2 Related Work

Prior work generated training perturbations, mined hard negatives, or optimized adversarial examples, but explicitly optimized training examples generally targeted the smallest perturbation causing misclassification. This paper instead amplifies diverse adversarial directions to create additional hard positives.

Perturbation-enhanced training has long used affine transformations and noise, including the InfiMNIST tool for generating MNIST examples.
Hard negative mining uses naturally occurring difficult examples to improve training in detection problems with many negatives.
Random perturbation-and-check methods can be computationally expensive because adversarial examples comprise only 2.199±0.132% of InfiMNIST.
L-BFGS and FGS generate adversarial examples through optimized pixel adjustments or input-loss gradients, respectively.
Other work also sought adversarial images whose internal representations approximate specified target images, extending analysis beyond output-layer errors.
Unlike prior optimization-based training, this paper amplifies adversarial perturbations across a diverse range to obtain additional hard positives.

3 PASS

PASS quantifies adversarial-image similarity by aligning a perturbed image with its original and then measuring structural similarity. It makes perceptual similarity an explicit threshold for defining adversarial images.

Perceptual motivation: PASS is intended to better reflect human perception because pixel-wise norms can rate visually similar images as substantially different.The paper motivates a psychometric measure that captures whether an image is a different view of the same input.
Alignment: The alignment stage seeks a homography that accounts for geometric, radiometric, and noise differences between the adversarial and original images.The method maximizes enhanced correlation coefficient between the transformed adversarial image and the original.
Similarity measurement: SSIM evaluates luminance, contrast, and structural similarity, addressing limitations of element-wise L2 and L∞ distances under geometric distortions.Regional SSIM combines these components and averages the result over all image pixels.
PASS construction: PASS combines homography alignment with SSIM to measure similarity between an adversarial image and its original.The alignment stage uses an enhanced correlation coefficient and a homography transform before similarity is measured.
Operational definition: An image is adversarial when it is misclassified while meeting a PASS threshold τ, which can vary by network and dataset.Hard positives also satisfy a PASS threshold but need not minimize dissimilarity.

4 Adversarial Example Generation

The paper develops adversarial-generation methods that produce diverse perturbation directions and hard positives beyond the closest adversarial examples. Fast Gradient Value uses raw loss gradients, while the hot/cold approach targets classes through intermediate features and supports multiple directions per image.

4.1 Fast Gradient Value: FGV uses the raw loss gradient rather than only its sign, preserving pixel-level gradient-magnitude differences.Pixels with larger gradients can therefore receive more substantial changes than under FGS.
4.1 Fast Gradient Value: FGS perturbations spread across nearly the entire image, whereas FGV produces more focused changes with higher PASS.FGS and FGV together provide only two adversarial examples per input image.
4.2 Hot/Cold Approach: The hot/cold method moves toward a selected target class while moving away from the original class using a constructed penultimate-layer feature vector.The target class receives a positive feature value, the original class a negative value, and other features are set to zero.
4.2 Hot/Cold Approach: Backpropagating the hot/cold feature vector to the image produces perturbations for both similar and dissimilar target classes.The method uses the magnitude of the target class's extracted feature and can backpropagate from intermediate layers.
4.2 Hot/Cold Approach: The hot/cold approach achieves PASS comparable to FGV while providing several targeted adversarial directions for each input image.Scaling a perturbation direction beyond the closest adversarial point generates additional hard positives.
4.3 Implementation Details: The implementation uses Caffe with a modified backward method to backpropagate directly from specified intermediate feature representations.This avoids creating separate truncated networks for each targeted layer.

5 Experiments

Experiments evaluate PASS and norm-based metrics, diverse hard-positive training, and adversarial augmentation on MNIST and ImageNet. Diverse, intermediate-PASS hard positives improve robustness and accuracy, with gains over FGS training and competitive per-image ImageNet improvements.

5.1 MNIST - Adversarial Metrics: PASS captures perceptual similarity differently from L2 and L∞ distances for MNIST adversarial images.FGV and hot/cold adversarials can have higher L∞ distances yet better PASS scores than FGS.
5.2 MNIST - Training with Hard Positives: Training on intermediate PASS values performs better than training only on the highest or lowest PASS ranges.Training with PASS scores in the 800-900 range still performs well when adversarial testing includes all ranges.
5.2 MNIST - Training with Hard Positives: Retraining with diverse hard positives improves LeNet/MNIST accuracy and robustness compared with FGS-generated adversarial training.The evaluation uses standard MNIST data and held-out adversarial examples spanning multiple adversarial types and networks.
5.2 MNIST - Training with Hard Positives: 28.18% lower MNIST test error and 14.85% adversarial-test error are reported for HC-D-9-1.05, the best-performing model.The reductions are measured against basic LeNet and FGS training, respectively; the adversarial-test error is the model’s lowest susceptibility.
5.2 MNIST - Training with Hard Positives: HC-D-9 and HC-D-9-1.05 are slightly, but not statistically, better than 1M InfiMNIST images, while FGV performs equally well using 3.7% as much data.The InfiMNIST-trained networks also perform poorly on adversarial examples.

6 Conclusion

The paper introduces PASS and diverse adversarial generation, including amplified hard positives with structural artifacts. Experiments support improved accuracy and adversarial robustness, while the reported performance does not reach state of the art on MNIST or ImageNet.

6 Conclusion: PASS quantifies the imperceptibility constraint for adversarial images, while diverse generation and amplified perturbations provide additional hard positives for training.Many generated perturbations exhibit structural artifacts rather than random-noise appearance.
6 Conclusion: The approach improves robustness and accuracy with fewer training images, but does not achieve state-of-the-art performance on MNIST or ImageNet.The paper reports substantially better MNIST results than prior adversarial-training or input-perturbation work on LeNet/MNIST.