Source-linked AI summary
Defense against Universal Adversarial Perturbations
Naveed Akhtar, Jian Liu, Ajmal Mian
TL;DR
Universal adversarial perturbations can fool classifiers on unseen images while remaining quasi-imperceptible, creating a practical security concern. The paper adds a pre-input Perturbation Rectifying Network and separate detector, trained with real and synthetic perturbations, and reports up to 97.5% success against unseen perturbations with cross-network generalization. The framework also leaves targeted classifiers unmodified, though stronger attacks may threaten an exposed end-to-end wrapper.
Problem
Universal adversarial perturbations can fool classifiers on arbitrary images, including real-world scenes, and require dedicated defenses for practical deployment.
Method
The framework uses a pre-input Perturbation Rectifying Network, a separate detector based on PRN image transformations, and efficiently generated synthetic perturbations for training.
Results
Up to 97.5% success rate was achieved against unseen perturbations on unseen images, with PRN defense generalizing across network models.
Takeaways & Limitations
The framework can defend already deployed target classifiers without modifying them and can keep its rectifier and detector components secretive.
Takeaways & Limitations
Because the PRN and targeted network are end-to-end differentiable, stronger attacks may compromise the joint network if the PRN is not kept secretive.
Abstract
from arXiv · showhide
Recent advances in Deep Learning show the existence of image-agnostic quasi-imperceptible perturbations that when applied to `any' image can fool a state-of-the-art network classifier to change its prediction about the image label. These `Universal Adversarial Perturbations' pose a serious threat to the success of Deep Learning in practice. We present the first dedicated framework to effectively defend the networks against such perturbations. Our approach learns a Perturbation Rectifying Network (PRN) as `pre-input' layers to a targeted model, such that the targeted model needs no modification. The PRN is learned from real and synthetic image-agnostic perturbations, where an efficient method to compute the latter is also proposed. A perturbation detector is separately trained on the Discrete Cosine Transform of the input-output difference of the PRN. A query image is first passed through the PRN and verified by the detector. If a perturbation is detected, the output of the PRN is used for label prediction instead of the actual image. A rigorous evaluation shows that our framework can defend the network classifiers against unseen adversarial perturbations in the real-world scenarios with up to 97.5% success rate. The PRN also generalizes well in the sense that training for one targeted network defends another network with a comparable success rate.
1. Introduction
Universal adversarial perturbations are image-agnostic, quasi-imperceptible changes that can fool classifiers across images and models, motivating a dedicated defense. The framework combines pre-input rectification, perturbation detection, and synthetic training perturbations, achieving up to 97.5% success on unseen cases.
- Universal adversarial perturbations can fool neural networks on arbitrary images while remaining quasi-imperceptible and generalizing across network models.
- Their image-agnostic, cross-model nature enables on-the-fly attacks in hostile deployment environments, including modified real-world scenes.
- The framework learns a Perturbation Rectifying Network as pre-input layers, defending deployed target networks without modifying them.
- Synthetic image-agnostic perturbations are computed efficiently to train the rectifier, complementing perturbations obtained from real examples.
- A separate detector analyzes the Discrete Cosine Transform of image rectifications to identify adversarial perturbations.
- 97.5% success rate was achieved against unseen perturbations on unseen images, while the PRN generalized across network models.
2. Related work
Earlier adversarial-robustness research primarily generated image-specific attacks and pursued defenses through adversarial training or transformations. Universal perturbations introduced a distinct image-agnostic threat, for which no dedicated defense had yet been established.
- Early work established quasi-imperceptible adversarial perturbations and linked network vulnerability to properties including linearity and possible over-fitting.
- DeepFool computes image-specific perturbations iteratively, while adversarial training was reported to improve robustness against generated examples.
- Other defenses used foveation, distillation, adversarial training, compression, pixel localization, or late-stage ReLU-based detection.
- Universal perturbations differ from prior image-specific attacks because one image-agnostic perturbation can affect neural-network predictions across images.
- Before this work, no dedicated technique existed for defending networks against universal adversarial perturbations.
3. Problem formulation
Universal adversarial perturbations are image-agnostic, constrained-norm vectors that fool a classifier on a substantial fraction of images while remaining quasi-imperceptible. The defense therefore combines a detector with a rectifier that transforms perturbed inputs without modifying the targeted classifier.
- Universal adversarial perturbations: A universal adversarial perturbation ρ is an image-agnostic vector that changes classifier predictions with probability at least δ under a norm bound ξ.The classifier operates on clean images sampled from a distribution, and ρ is added to those images.
- Universal adversarial perturbations: The norm radius ξ controls perturbation magnitude, while δ controls the fooling ratio; this work uses δ ≥0.8 with ℓ2 and ℓ∞ constraints.The selected radii are ξ = 2, 000 for ℓ2 and ξ = 10 for ℓ∞, approximately 4% of the corresponding mean image norms.
- Scope: The work focuses on singly universal perturbations, which target a given classifier rather than satisfying the constraint for every classifier.Perturbations that work for any classifier are described separately as doubly universal.
- Defense formulation: The framework seeks a detector D to identify whether an unseen input is perturbed and a rectifier R to transform perturbed images into inputs suitable for classification.The rectifier is learned so the targeted classifier’s clean-image performance remains the reference objective.
4. Proposed approach
The proposed defense trains a Perturbation Rectifying Network before a frozen targeted classifier, supplements real perturbations with efficiently generated synthetic ones, and detects attacks using PRN input-output differences. Detected inputs are classified through the rectified output, while the external-wrapper design preserves the deployed classifier and supports cross-model defense.
- Perturbation Rectifying Network: The PRN is attached before the targeted classifier and trained using clean and perturbed images while the classifier parameters remain frozen.This makes the defense applicable to an already deployed network without modifying its parameters.
- Deployment: The external wrapper avoids targeted-network modification and can keep the PRN and detector secret, reducing exposure to potential counter-counter attacks.The approach is presented as complementary to adversarial training and architectural defenses.
- Training data: Synthetic perturbations are generated by random walks in directions from normalized existing perturbations, subject to norm-based constraints, and added to the real perturbation set.The construction uses a positive-orthant subspace condition and targets expected ℓ2 magnitude plus an ℓ∞ threshold when applicable.
- Training data: Training the PRN with both real and synthetic perturbations consistently helped early convergence and improved performance in the experiments.The synthetic perturbations generally had lower fooling ratios than the original perturbations but remained acceptable for augmentation.
- Perturbation detection: The detector learns a binary classifier from Discrete Cosine Transform features of the difference between each PRN input and output.For a test image, the detector is evaluated first; detected perturbations are routed through the PRN before classification.
5. Experiments
The experiments evaluate the framework on three ImageNet classifiers using unseen images and perturbations, across ℓ2 and ℓ∞ settings and two testing protocols. Results show strong defense, including 96.4% defense rate for CaffeNet and cross-architecture generalization, while detector performance varies with network architecture.
- Evaluation setup: The evaluation defends CaffeNet, VGG-F, and GoogLeNet using the ILSVRC 2012 validation set of 50,000 images.The network choice reflects computational feasibility, while the framework is stated to apply to other networks.
- Evaluation setup: Testing uses 10,000 unseen images and five unseen perturbations, with clean and perturbed queries mixed at equal probability.Protocol-A uses all test images; Protocol-B restricts evaluation to images correctly classified when clean.
- Evaluation considerations: Unnecessary rectification of clean images can reduce the targeted network’s classification accuracy by 1–2%.The PRN-restoration metric accounts for rectification of both clean and perturbed images.
- Evaluation setup: The study compares matched and mismatched ℓ2/ℓ∞ train-test perturbation types under Protocol-A and Protocol-B.The right half of the results summarizes training on one perturbation type and testing on the other.
- Results: GoogLeNet is defended very successfully, but ℓ∞ perturbation detection is more challenging there than for CaffeNet and VGG-F.For GoogLeNet, the corresponding ℓ2 norm of ℓ∞ perturbations averaged about 2,400, versus about 2,850 for CaffeNet and VGG-F.
- Results: 96.4% defense rate is reported for CaffeNet against ℓ2 perturbations under Protocol-A.Under the stated metric and protocol, this represents recovery to 96.4% of original clean-image performance when queries are equally likely to be clean or perturbed.
6. Conclusion
The framework detects and rectifies universal adversarial perturbations while preserving the targeted classifier, and it is demonstrated across multiple network architectures.
- The framework both detects universal adversarial perturbations and rectifies perturbed images for reliable label prediction.
- Its rectifier is a Perturbation Rectifying Network, while its detector is an SVM trained on image transformations produced by the PRN.
- The defense supports already deployed targeted networks without modifying them and can keep its rectifier and detector components secretive.
- The cross-network defense summaries evaluate testing perturbations generated on one network against training perturbations associated with networks specified in the table header.
- The framework's efficacy is demonstrated against universal adversarial perturbations on CaffeNet, VGG-F, and GoogLeNet.