PaperlayerView exact revision on arXiv

Source-linked AI summary

Mitigating Adversarial Effects Through Randomization

Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, Alan Yuille

arXiv:1711.01991v3cs.CV

TL;DR

CNNs are vulnerable to adversarial examples, where imperceptible input perturbations can cause failures. The paper uses random resizing and random padding at inference time, achieving strong defense results against single-step and iterative attacks, including a 0.924 normalized challenge score when combined with adversarial training.

  • Problem

    CNNs can fail on adversarial examples created by adding visually imperceptible perturbations to clean images.

  • Method

    The method applies random resizing and random padding as inference-time randomization layers before CNN classification.

  • Results

    0.924 normalized score ranked the combined method No.2 among 107 defense teams, versus 0.773 and No.56 for adversarial training alone.

  • Takeaways & Limitations

    Randomization improves robustness, especially against iterative attacks, while requiring no retraining, few additional computations, and compatibility with other defenses.

  • Takeaways & Limitations

    The strongest attack over all possible defense patterns is computationally infeasible, so evaluation uses target models to generate adversarial examples.

Abstract

from arXiv · show

Convolutional neural networks have demonstrated high accuracy on various tasks in recent years. However, they are extremely vulnerable to adversarial examples. For example, imperceptible perturbations added to clean images can cause convolutional neural networks to fail. In this paper, we propose to utilize randomization at inference time to mitigate adversarial effects. Specifically, we use two randomization operations: random resizing, which resizes the input images to a random size, and random padding, which pads zeros around the input images in a random manner. Extensive experiments demonstrate that the proposed randomization method is very effective at defending against both single-step and iterative attacks. Our method provides the following advantages: 1) no additional training or fine-tuning, 2) very few additional computations, 3) compatible with other adversarial defense methods. By combining the proposed randomization method with an adversarially trained model, it achieves a normalized score of 0.924 (ranked No.2 among 107 defense teams) in the NIPS 2017 adversarial examples defense challenge, which is far better than using adversarial training alone with a normalized score of 0.773 (ranked No.56). The code is public available at https://github.com/cihangxie/NIPS2017_adv_challenge_defense.

1 INTRODUCTION

CNNs perform well across vision tasks but can be fooled by imperceptible perturbations. The paper proposes inference-time randomization to improve robustness while retaining clean-image performance and requiring little additional computation.

  • Motivation: CNNs support many vision tasks but are extremely vulnerable to small, visually imperceptible perturbations that can cause classification, detection, and segmentation failures.These adversarial examples pose a security danger for deployed machine-learning systems.
  • Motivation: Iterative attacks may overfit network parameters, motivating random image transformations that can disrupt attack-specific perturbation structure.Random transformations also obscure the specific inference transformation from attackers.
  • Proposed approach: The proposed defense applies random resizing and random padding at inference time to mitigate adversarial effects.The method operates through randomization layers added before the original CNN.
  • Findings: Randomization makes networks more robust to adversarial images, especially iterative attacks in white-box and black-box settings, while hardly hurting clean-image performance.The introduction attributes this result to experiments in Section 4.2.
  • Advantages: The method requires no additional training or fine-tuning, adds very few computations, and is compatible with different network structures and defense methods.These properties support using randomization layers as a basic defense module.
  • Challenge result: 0.924 normalized score ranked the combined method No.2 among 107 defense teams, versus 0.773 and No.56 for adversarial training alone.The comparison comes from the NIPS 2017 adversarial examples defense challenge.

2 RELATED WORK

Prior work developed methods for generating adversarial examples and for reducing their effects. These defenses include defensive distillation and adversarial training using adversarial images.

  • Adversarial-example generation: Earlier research generated adversarial examples by adding visually imperceptible perturbations that cause CNNs to predict incorrect labels with high confidence.The cited approaches include optimization-based generation and the fast gradient sign method.
  • Adversarial defense: Defensive distillation was reported to defend networks against adversarial examples.This work represents one line of research focused on reducing adversarial effects rather than generating attacks.
  • Adversarial defense: Adversarial training improves robustness by incorporating adversarial images into training batches, with ensemble-based training further improving robustness.These methods train models using adversarial examples generated from trained models or ensembles.

3 APPROACH

The approach generates adversarial examples by constrained loss maximization, then defends classifiers by applying random resizing and random padding before classification. The randomization layers require no retraining and can be combined with adversarial training.

  • Adversarial example generation: Adversarial examples add a constrained perturbation to each image while maximizing the network loss.The perturbation must remain visually similar to the original image under a norm constraint.
  • Adversarial example generation: The experiments use FGSM as a single-step attack and DeepFool and C&W as iterative attacks.DeepFool crosses the decision boundary iteratively, while C&W is evaluated with the l2-norm.
  • Randomization-based defense: The defense adds random resizing and random padding to the beginning of classification networks without retraining or fine-tuning.The transformed image is passed to the original CNN for classification.
  • Randomization layers: Random resizing changes the image to a randomly selected nearby spatial size before padding.For the Inception-ResNet example, height and width are controlled within [299, 331).
  • Randomization layers: Random padding surrounds the resized image with zeros placed randomly on the four sides, producing multiple possible padding patterns.The padded image is then used for classification.
  • Randomization layers + adversarial training: Randomization layers can be combined with adversarial training to address both single-step and iterative attacks.The paper motivates this combination because randomization is effective against iterative attacks, whereas adversarial training can improve robustness to single-step attacks.

4 EXPERIMENTS

Experiments evaluate the defense across networks, attack scenarios, and randomization settings using correctly classified ImageNet images. The setup distinguishes attacks that do and do not account for the defense's randomized transformations.

  • Experiment setup: The test set contains 5000 ImageNet validation images correctly classified by all considered networks.Each image has size 299 × 299 × 3.
  • Experiment setup: Four publicly available ImageNet networks are evaluated without retraining or fine-tuning.The models include Inception-v3, 101-layer ResNet-v2, Inception-ResNet-v2, and an ensemble-adversarially-trained Inception-ResNet-v2.
  • Defense models: Defense models append random resizing and random padding to the original networks, with resizing sampled from [299, 331) and padding to 331 × 331 × 3.This configuration creates 12528 possible patterns for a single image, and accuracy is averaged over three independent runs.
  • Attack scenarios: The strongest attack over all possible randomization patterns is considered computationally infeasible, so experiments use target models instead.The target models use predefined randomization parameters, while defense models generate parameters randomly at test time.
  • Attack scenarios: The attack scenarios include vanilla attacks without randomization layers, single-pattern attacks, and ensemble-pattern attacks.The latter two scenarios assume attackers know the randomization layers but use one pattern or an ensemble of predefined patterns.
  • Clean-image evaluation: Adding randomization layers causes very little accuracy drop on clean, non-adversarial images.Table 1 reports top-1 classification accuracy for networks with and without the layers.

4.2 CLEAN IMAGES

Randomization layers cause negligible degradation on clean-image accuracy and substantially mitigate both single-step and iterative adversarial attacks, including when attackers target one known pattern.

  • Clean-image performance: Randomization layers introduce negligible performance degradation on clean images.Inception-ResNet-v2 shows 0.7% degradation, while Inception-v3 shows 2.7% degradation.
  • Vanilla attacks: Randomization layers significantly mitigate adversarial effects for both single-step and iterative attacks under vanilla attacks.The defense model retains 94.3% top-1 accuracy for FGSM-ϵ with ens-adv-Inception-ResNet-v2, while iterative attacks have almost no impact after randomization.
  • Vanilla attacks: Randomization layers effectively mitigate adversarial effects across attacks and network architectures in the vanilla attack scenario.The cited table caption highlights ens-adv-Inception-ResNet-v2 as performing particularly well across attacks.
  • Single-pattern attacks: Under single-pattern attacks, randomization remains effective against iterative attacks but is less effective against stronger single-step attacks with larger ϵ.Adversarially trained models defend against the stronger single-step attacks in this scenario.

4.5 ENSEMBLE-PATTERN ATTACK SCENARIO

Ensemble-pattern attacks are stronger because they account for multiple randomization patterns, yet randomization still improves defense accuracy; padding and one-pixel resizing independently disrupt adversarial transferability.

  • Ensemble-pattern attacks: Randomization layers increase top-1 accuracy under all attacks and networks, even in the strong ensemble-pattern scenario.The table caption identifies this scenario as a strong test of the proposed defense.
  • Attack strength: Ensemble-pattern adversarial examples reduce adversarially trained defense accuracy by around 8% relative to vanilla and single-pattern scenarios for single-step attacks.Other defense models experience larger drops.
  • Attack strength: For iterative attacks, C&W examples are stronger than DeepFool, reducing Inception-v3 accuracy to 62.9% versus 81.3%.More advanced architectures and ensemble adversarial training improve accuracy against C&W.
  • Padding and resizing: Creating different one-pixel padding patterns effectively mitigates adversarial effects.The experiment restricts random padding to four patterns and ensembles three patterns for the target model.
  • Padding and resizing: Resizing images by only one pixel effectively destroys adversarial-example transferability for both single-step and iterative attacks.The resizing experiment changes images from 330 × 330 × 3 to 331 × 331 × 3.

5 NIPS 2017 ADVERSARIAL EXAMPLES DEFENSE CHALLENGE

In the NIPS 2017 defense challenge, the randomized, adversarially trained model achieved a high normalized score and substantially outperformed adversarial training alone.

  • Evaluation protocol: The challenge evaluated defenses on 5000 adversarial images generated across all attacks, awarding one point per correctly classified image.The test images were 299 × 299 × 3 and used ImageNet 1000-class labels.
  • Evaluation protocol: The normalized score aggregates performance over all attacks using an indicator for whether each prediction is correct.A denotes the attack set and M the total number of generated adversarial examples.
  • Submission model: The submitted model averaged predictions over 30 randomization patterns and used a resizing range of [310, 331) with random horizontal flipping.These changes were made to increase classification accuracy.
  • Challenge result: 0.924 normalized score ranked the randomized ens-adv-Inception-ResNet-v2 model No.2 among 107 defense models.The model was evaluated against 156 different attacks.
  • Challenge result: 0.773 normalized score ranked ensemble adversarial training alone No.56 among 107 defense models.This provides the challenge comparison baseline for the randomized model.

6 CONCLUSION

The paper concludes that inference-time randomization mitigates adversarial effects, especially for iterative attacks, while remaining compatible with architectures and other defenses.

  • Conclusion: Adversarial examples rarely transfer between different randomization patterns, especially for iterative attacks.The conclusion attributes the reported defense behavior to the evaluated randomization mechanism.
  • Conclusion: Randomization layers are compatible with different network structures and adversarial defense methods.The authors propose them as a basic module for adversarial-example defense.
  • Conclusion: 0.924 normalized score ranked No.2 among 107 defense models, compared with 0.773 ranked No.56 for adversarial training alone.The result comes from the NIPS 2017 adversarial examples defense challenge.

APPENDIX A OTHER RANDOMIZATION METHODS

The appendix evaluates four training-time image randomization methods and finds that they preserve clean-image accuracy but are weaker defenses than random resizing and padding. Combining them with the proposed layers produces slight additional gains, while their standalone evaluation is not extended to other attack scenarios.

  • Methods: The four additional methods—random brightness, saturation, hue, and contrast—are evaluated as data augmentation during standard network training.Brightness, saturation, and hue parameters are randomly sampled within specified ranges, with normalized pixels clipped to [0, 1].
  • Clean images: These methods hardly hurt top-1 accuracy on the 5000 clean images, and combining them with random resizing and padding causes only a very small accuracy drop.The combined variants are denoted by “++”.
  • Adversarial images: Under the vanilla attack scenario, each additional method is much less effective than the proposed randomization layers.This comparison is reported for random brightness, saturation, hue, and contrast.
  • Scope: Because the additional methods are weaker under vanilla attacks, the appendix does not further evaluate them under single-pattern or ensemble-pattern attacks.Their combination with the proposed layers is presented as a slightly stronger defense mechanism.
  • Combined defenses: Combining each additional method with the proposed layers slightly improves performance over the proposed layers alone.The combined variants are identified as brightness++, saturation++, hue++, and contrast++.

APPENDIX B RANDOMIZATION LAYERS WITH SMALLER SIZE

The appendix tests random resizing to smaller dimensions followed by random padding to the original target shape. The layers remain effective, but perform slightly worse than the larger-size configuration because downscaling loses image information.

  • Configuration: Random resizing samples sizes from [267, 299), then random padding restores each image to 299 × 299 × 3.This setting creates the same 12,528 patterns per image as the paper’s configuration.
  • Results: The smaller-size randomization layers still work well on clean images and adversarial examples generated under the vanilla attack scenario.Both image types are evaluated using the appendix experiment setup.
  • Comparison: The smaller-size configuration is slightly worse than resizing within [299, 331) and padding to 331 × 331 × 3.The reported explanation is that resizing smaller loses certain information from the original image.

APPENDIX C RANDOMIZATION LAYERS WITH MULTIPLE ITERATIONS

The appendix examines how repeated randomized transformations affect defense accuracy across clean images and three attack scenarios. More iterations generally help, but the benefit depends on the attack setting and is negligible for one ensemble-pattern case.

  • Setup: The experiment uses ens-adv-Inception-ResNet-v2 with randomization layers and evaluates iteration counts of 1, 5, 10, 20, and 30.The same trend is reported as observable for other defense models.
  • Iteration effects: Increasing iterations can slightly improve top-1 accuracy on clean images and adversarial examples from vanilla and single-pattern attacks.The evaluation covers 5000 clean test images and adversarial examples from all three attack scenarios.
  • Iteration effects: Increasing iterations provides nearly no improvement against single-step attacks in the ensemble-pattern scenario.This is the specific case where repeated inference shows little benefit.
  • Evaluation: Figures 3–5 report top-1 accuracy for clean images, vanilla attacks, single-pattern attacks, and ensemble-pattern attacks.The figures organize results by the evaluated image or attack scenario.
Loading 1711.01991v3…