Countering Adversarial Images using Input Transformations

Chuan Guo; Mayank Rana; Moustapha Cisse; Laurens van der Maaten

Source-linked AI summary

Countering Adversarial Images using Input Transformations

Chuan Guo, Mayank Rana, Moustapha Cisse, Laurens van der Maaten

arXiv:1711.00117v3Oct 31, 2017cs.CV

TL;DR

Adversarial examples threaten the reliability of image-classification systems, motivating defenses that remain effective when attackers have substantial model information. The paper evaluates input transformations before classification and finds that total variation minimization and image quilting provide the strongest reported protection, especially with transformed-image training.

Problem
Existing image-classification models can be fooled by small, adversarially designed perturbations, creating a robustness problem for security-sensitive deployments.
Method
The paper evaluates model-agnostic input transformations, including bit-depth reduction, JPEG compression, total variation minimization, and image quilting, before convolutional-network classification.
Results
The best defenses eliminate 60% of strong gray-box attacks and 90% of strong black-box attacks across four major attack methods.
Takeaways & Limitations
Total variation minimization and image quilting are strongest in practice, particularly when networks are trained on similarly transformed images.
Takeaways & Limitations
The study focuses exclusively on image classification, leaving extensions to semantic segmentation and speech recognition for future work.

Abstract

from arXiv · show

This paper investigates strategies that defend against adversarial-example attacks on image-classification systems by transforming the inputs before feeding them to the system. Specifically, we study applying image transformations such as bit-depth reduction, JPEG compression, total variance minimization, and image quilting before feeding the image to a convolutional network classifier. Our experiments on ImageNet show that total variance minimization and image quilting are very effective defenses in practice, in particular, when the network is trained on transformed images. The strength of those defenses lies in their non-differentiable nature and their inherent randomness, which makes it difficult for an adversary to circumvent the defenses. Our best defense eliminates 60% of strong gray-box and 90% of strong black-box attacks by a variety of major attack methods

1 INTRODUCTION

The paper addresses adversarial-example vulnerability by developing model-agnostic input transformations that remove perturbations while preserving classification information. Total variance minimization and image quilting are especially effective because they are non-differentiable and randomized.

1 INTRODUCTION: The study develops model-agnostic transformations intended to remove adversarial perturbations, preserve classification information, and remain effective when attackers know the defense strategy.The explored transformations include cropping and rescaling, bit-depth reduction, JPEG compression, total variance minimization, and image quilting.
1 INTRODUCTION: The transformations counter iterative FGSM, DeepFool, and Carlini-Wagner attacks, including gray-box settings where model architecture and parameters are public.The paper reports effectiveness against four major attack methods overall.
1 INTRODUCTION: 60% of gray-box attacks and 90% of black-box attacks are eliminated by the best defenses.The attacks perturb pixel values by 8% on average.
1 INTRODUCTION: The strongest defenses are total variance minimization and image quilting because they are non-differentiable and inherently random.These properties make it difficult for adversaries to circumvent the defenses.

2 PROBLEM DEFINITION

The paper formalizes non-targeted adversarial examples and evaluates defenses in black-box and gray-box settings. Its defenses transform inputs before classification, ideally making the transformed model difficult to attack.

2 PROBLEM DEFINITION: A non-targeted adversarial example changes the classifier’s prediction while remaining within a specified dissimilarity threshold.The image space is X = [0, 1]^H×W×C, and the threshold is denoted ρ.
2 PROBLEM DEFINITION: Attack success rate is the proportion of predictions altered by an attack and is evaluated against normalized L2-dissimilarity.A strong attack has high success rate at low normalized L2-dissimilarity.
2 PROBLEM DEFINITION: In black-box attacks, adversaries lack direct model access and may transfer adversarial examples from separately trained models.The gray-box setting gives access to architecture and parameters but not the defense strategy.
2 PROBLEM DEFINITION: Transformation defenses classify adversarial inputs through h(g(x′)), where g is ideally complex, non-differentiable, and potentially stochastic.This design makes attacking the defended prediction model difficult even when h and g are known.

3 ADVERSARIAL ATTACKS

The paper examines gradient-based, boundary-based, and optimization-based adversarial attacks, including FGSM variants, DeepFool, and Carlini-Wagner’s L2 attack. These attacks differ in their update mechanisms and distance objectives.

3 ADVERSARIAL ATTACKS: FGSM generates an adversarial example by adding the sign of the input-gradient loss scaled by ϵ.The loss is differentiable, and ϵ controls perturbation magnitude.
3 ADVERSARIAL ATTACKS: Iterative FGSM repeatedly applies the FGSM update until the classifier’s prediction changes.Both FGSM variants approximately minimize Chebyshev distance.
3 ADVERSARIAL ATTACKS: The study excludes targeted attacks and clips generated adversarial examples to the image space X.Figure 1 presents images from all four attacks at five normalized L2-dissimilarity levels.
3 ADVERSARIAL ATTACKS: DeepFool projects the input onto a linearized decision boundary for multiple iterations to minimize Euclidean distance.Its multiclass variant projects onto the nearest class boundaries, which suits piecewise-linear ReLU networks.
3 ADVERSARIAL ATTACKS: Carlini-Wagner’s L2 attack optimizes a differentiable classification surrogate together with an L2 penalty.The parameter λ_f trades off perturbation norm against the hinge loss for predicting a different class.

4 DEFENSES

The defenses transform inputs to alter adversarial perturbations while preserving enough image information for classification. Total variation minimization and image quilting use reconstruction or patch synthesis to disrupt perturbations, with distinct effects on image structure.

The defenses alter image structure through cropping-rescaling, bit-depth reduction, JPEG compression, total variation minimization, and image quilting.Cropping-rescaling changes perturbation positioning, while test-time prediction averaging can use random image transformations.
TOTAL VARIANCE MINIMIZATION: Total variation minimization randomly selects pixels and reconstructs a simple image consistent with those retained pixels.The reconstruction is obtained by minimizing total variation while remaining similar to the perturbed input at selected locations.
TOTAL VARIANCE MINIMIZATION: Total variation minimization encourages removal of small adversarial perturbations by penalizing fine-scale image variation.The objective is convex in the reconstructed image, and the implementation uses p = 2 with a split Bregman solver.
TOTAL VARIANCE MINIMIZATION: In Figure 2, adversarial perturbations nearly disappear from the background after total variation minimization, although non-homogeneous regions also change.The authors expect limited negative effects from changes that were not adversarially designed.
Figure 3 contrasts training on regular versus transformed images while testing on transformed adversarial images, with dashed arrows identifying the adversary's and classifier's models.
IMAGE QUILTING: Image quilting synthesizes images from clean-image patches, selecting uniformly among nearest-neighbor patches for corresponding adversarial patches.The resulting image is intended to contain pixels not modified by the adversary, while quilting introduces quantization errors.

5 EXPERIMENTS

The experiments evaluate image-transformation defenses against four adversarial attacks across gray-box and black-box settings on ImageNet. Training models on transformed images substantially improves defense effectiveness, with quilting especially effective against strong attacks.

Experimental setup: The study evaluates five image transformations against four attacks on ImageNet using ResNet-50 and normalized L2-dissimilarity to measure attack strength.Experiments cover gray-box test-time defenses, black-box settings with transformed training and testing, ensembling and model transfer, and gray-box attacks against transformation-robust networks.
Test-time transformations: 40−60% of adversarial images are classified correctly by ensembling 30 predictions over random crops, while total variation minimization and quilting classify 30−40% correctly.The highest clean-image accuracy expected in this experiment is 76%; quilting accuracy hardly deteriorates as adversary strength increases but substantially reduces accuracy on non-adversarial images.
Training and test-time transformations: Training convolutional networks on images transformed in the same way at training and test time dramatically improves all transformation defenses.The image-quilting defense successfully defends against 80−90% of all four attacks even when normalized L2-dissimilarity approaches 0.08.
Ensembling and model transfer: About 71% accuracy is achieved by the best black-box defense, combining cropping, TVM, quilting, and model transfer; attacks reduce its accuracy by at most 6%.Ensembling defenses provides 1−2% gains, while transferring attacks to different convolutional architectures can improve accuracy by 2−3%.
Gray-box evaluation: Up to 50% of adversarial images are classified correctly in the gray-box setting when networks use cropping-rescaling, total variation minimization, or quilting defenses.Bit-depth reduction and JPEG compression are weak defenses in this setting, whereas the other three defenses remain fairly robust.
Comparison with prior work: 51.51% accuracy is obtained against DeepFool gray-box attacks by combining cropping, TVM, and quilting, compared with 1.84% for ensemble adversarial training.Transformation-based defenses are reported as 18−24× more robust than ensemble adversarial training against DeepFool attacks, while ensemble adversarial training performs better on FGSM.

6 DISCUSSION

The discussion identifies transformed-image training, non-differentiability, and randomness as central to effective defenses against adversarial attacks. It also highlights cross-attack advantages over adversarial training while limiting the study to image classification.

Training the convolutional network on similarly transformed images helps remove adversarial perturbations while preserving visual content.
A strong input-transformation defense should be non-differentiable and randomized because these properties hinder an adversary’s ability to incorporate the transformation into an attack.
Total variance minimization and image quilting are difficult to differentiate through because they involve complex minimization, discrete patch selection, or graph-cut optimization.
Randomized defenses require an adversary to find a perturbation that changes predictions across the defense’s entire output distribution.
Transformation-based defenses generalize across attack methods because they are model-agnostic, whereas adversarial training focuses on a particular attack and remains differentiable.
The study focuses exclusively on image classification and leaves extensions to semantic segmentation, speech recognition, combined defenses, and new circumventing attacks for future work.