Source-linked AI summary
APE-GAN: Adversarial Perturbation Elimination with GAN
Shiwei Shen, Guoqing Jin, Ke Gao, Yongdong Zhang
TL;DR
Adversarial examples expose a significant vulnerability in neural-network recognition, motivating defenses that remain effective across attack settings. The paper introduces APE-GAN, which removes adversarial perturbations before classification, and reports effectiveness across three benchmark datasets, with applicability independent of the target model used to construct the examples.
Problem
Adversarial examples can cause neural networks to misclassify inputs, while few existing methods provide significant defense against them.
Method
APE-GAN uses a trained GAN-based network to eliminate adversarial perturbations before feeding processed examples to classification networks.
Results
APE-GAN is reported effective on adversarial and benign inputs across three benchmark datasets and can handle examples without knowing their target model.
Takeaways & Limitations
The approach provides a defense framework intended to remove adversarial perturbations before recognition and has strong applicability across target models.
Takeaways & Limitations
The paper focuses on white-box attacks because transferability over large-scale datasets such as ImageNet was not yet well understood, and it identifies future defense combinations for Iterative Gradient Sign.
Abstract
from arXiv · showhide
Although neural networks could achieve state-of-the-art performance while recongnizing images, they often suffer a tremendous defeat from adversarial examples--inputs generated by utilizing imperceptible but intentional perturbation to clean samples from the datasets. How to defense against adversarial examples is an important problem which is well worth researching. So far, very few methods have provided a significant defense to adversarial examples. In this paper, a novel idea is proposed and an effective framework based Generative Adversarial Nets named APE-GAN is implemented to defense against the adversarial examples. The experimental results on three benchmark datasets including MNIST, CIFAR10 and ImageNet indicate that APE-GAN is effective to resist adversarial examples generated from five attacks.
1 Introduction
The paper frames adversarial examples as a significant vulnerability of neural networks and proposes APE-GAN to eliminate perturbations before classification. It reports applicability across varied inputs and benchmark datasets, while noting a white-box attack focus.
- Motivation: Adversarial examples use imperceptible, intentional perturbations that can cause neural networks to make false predictions.The paper also notes that such examples can transfer across models, enabling black-box attacks.
- Motivation: Adversarial examples create practical security risks, including the possibility of manipulating traffic-sign images to trigger unwanted self-driving actions.The paper describes this threat as significant and urgent.
- Research gap: Existing defenses include robust training strategies and adversarial-sample detection, but reported vulnerabilities leave defense against adversarial examples challenging.The paper discusses weaknesses in defensive distillation, adversarial training, and detection mechanisms.
- Proposed approach: APE-GAN learns to eliminate adversarial perturbations with a trained network before feeding processed examples into classification networks.The approach treats perturbation elimination as learning a mapping from adversarial examples to original examples and uses GANs to generate clean examples.
- Contributions: The implemented framework is evaluated on three benchmark datasets, and the paper reports effective resistance to adversarial examples.The supplied introduction passage does not provide numerical results.
- Applicability: The framework can tackle adversarial examples without knowing the target model used to construct them, while its training needs no target-model architecture or parameter knowledge.This supports the paper’s claim of strong applicability.
2 Related Work
The related-work material introduces the paper’s notation, attack categories, and classifier framework, while contrasting conventional robustness, adversarial training, and APE-GAN preprocessing.
- Notation: The notation defines X as a clean image, Xadv as an adversarial image, and f as the classifier mapping images to discrete labels.The same notation block defines true and fooling class labels as ytrue and yfool.
- Defense frameworks: Figure 2 contrasts standard deep learning, adversarial training, and APE-GAN’s strategy of removing perturbations before target-model classification.The figure describes adversarial training as using enhanced training data and APE-GAN as a preprocessing framework.
- Notation: The classifier cost function is written as J(X, y), while ϵ denotes the upper bound on the L∞ norm of the perturbation.The paper also defines ClipX,ϵ{A} as clipping A to an ϵ-neighborhood range.
- Attack types: The paper distinguishes non-targeted attacks, which seek incorrect classification, from targeted attacks, which seek a specified target class.Both attack types slightly modify an image before classification.
2.1 Methods Generating Adversarial Examples
The paper reviews six approaches for generating adversarial images, spanning L0, L2, and L∞ perturbation metrics and including optimization-, gradient-, and saliency-based attacks.
- L-BFGS formulates minimum-distortion generation as an optimization problem under the L2 distance metric.The constraint requires the classifier’s prediction to change, while λ trades perturbation amplitude against attack power.
- FGSM generates L∞ adversarial images by shifting all input pixels once in the gradient-sign direction.The perturbation amplitude is controlled by ϵ; the method is simpler and faster but has a lower attack success rate than more optimal methods.
- Iterative Gradient Sign extends FGSM by applying smaller gradient-sign steps repeatedly and clipping each intermediate result.The update uses step size α and constrains the intermediate result with ε.
- DeepFool iteratively applies minimal L2 perturbations using locally linear gradient approximations until the classifier’s decision hyperplane is crossed.It is described as a non-targeted, first-order attack distinct from L-BFGS.
- The reviewed attacks target L0, L2, or L∞ distance metrics, covering targeted and non-targeted adversarial-example generation.CW attacks represent all three metrics in the experiments, while the targeted attack seeks a specified target class.
- The targeted saliency-based attack greedily modifies the most influential pixel until the prediction changes to a target class.Pixel influence is measured using a saliency map derived from the model’s Jacobian matrix, under the L0 metric.
2.2 Generative Adversarial Nets
GAN combines a generator that estimates the data distribution with a discriminator that distinguishes real training samples from generated ones. Because standard GAN training can be unstable, the paper bases its model on DCGAN, which is described as more stable in most settings.
- A GAN contains a generator G that estimates the data distribution and a discriminator D that distinguishes training samples from fake samples.
- GAN training is expressed as a minimax value function V (G, D).
- GANs can be unstable to train, producing nonsensical generator outputs when maintaining balance between G and D is difficult.
- DCGAN uses convolutional networks and is described as stable to train in most settings.
- The paper implements its model based on DCGAN because of its stability.
3 Our Approach
APE-GAN frames adversarial-perturbation removal as mapping adversarial inputs back toward the clean-image manifold, using a GAN with generator and discriminator objectives. Its generator combines pixel-wise reconstruction with adversarial loss, while convolutional and deconvolutional layers support resolution-preserving reconstruction.
- 3 Our Approach: APE-GAN treats defense as learning a manifold mapping from adversarial examples to their corresponding original examples.The approach aims to eliminate perturbations before target-model recognition by recovering clean-image structure.
- 3 Our Approach: GAN training seeks consistency between the generated distribution and the data-generating distribution, matching the perturbation-elimination objective.The paper connects GAN global optimality with removing η so adversarial inputs become distributionally consistent with clean inputs.
- 3 Our Approach: The generator alters adversarial inputs with tiny changes, while the discriminator distinguishes clean images from reconstructed images.Adversarial training encourages reconstructed outputs to resemble original clean images closely enough to fool the discriminator.
- 3.2.1 Network Architecture: The networks use stride-2 convolutional layers for lower-resolution feature maps, followed by stride-2 deconvolutional layers to recover original resolution.The discriminator additionally uses convolutional layers, two dense layers, and a final sigmoid for sample classification.
- 3.2.2 Generator Loss: The generator loss combines pixel-wise mean squared error with adversarial loss to produce images without adversarial perturbations.The content term preserves image-level similarity, while adversarial loss encourages outputs to reside on the clean-image manifold.
4 Evaluation
APE-GAN is evaluated on MNIST, CIFAR10, and ImageNet against multiple adversarial attacks and benign inputs. Across these settings, perturbation elimination reduces adversarial error while preserving performance on clean and noisy inputs, without requiring target-model architecture or parameter knowledge.
- Target Models: L-BFGS, DeepFool, JSMA, FGSM, and CW attacks are evaluated across MNIST, CIFAR10, and ImageNet.CW includes CW-L0, CW-L2, and CW-L∞ variants.
- APE-GAN: APE-GAN is trained separately for MNIST, CIFAR10, and ImageNet using FGSM samples, with dataset-specific input sizes and training schedules.The ImageNet model uses 50,000 training images and resize operations for target-network inputs.
- APE-GAN: APE-GAN training requires no knowledge of the target model’s architecture or parameters.This supports evaluation across multiple target models on the three datasets.
- Effectiveness: APE-GAN significantly decreases error rates on adversarial inputs, including FGSM attacks with different ϵ values.The paper reports this pattern in Table 1 and Tables 3–4, with ImageNet examples shown in Figure 3.
- Strong Applicability: APE-GAN does not markedly increase clean-image error and can eliminate perturbations from both random Gaussian noise and FGSM inputs.Figure 4 contrasts clean, noisy, adversarial, and reconstructed MNIST images.
- Effectiveness: Overall, APE-GAN performs well on adversarial and benign inputs across the three benchmark datasets.The evaluation also reports applicability across different target models.
5 Discussion and Future Work
APE-GAN is presented as a preprocessing defense that can operate before classification and alongside other defenses. However, combining it with adversarial training does not significantly improve target-model robustness, although the combination provides notable defense against Iterative Gradient Sign.
- Discussion: APE-GAN preprocesses inputs before classification and can be combined with existing defenses such as adversarial training.Its preprocessing position avoids conflict with other defense mechanisms.
- Future Work: The combined defense provides notable protection against Iterative Gradient Sign, motivating research on additional defense combinations.The authors identify new combinations of defenses as future work.