Source-linked AI summary
Defense against Adversarial Attacks Using High-Level Representation Guided Denoiser
Fangzhou Liao, Ming Liang, Yinpeng Dong, Tianyu Pang, Xiaolin Hu, Jun Zhu
TL;DR
Neural networks are vulnerable to adversarial examples that threaten security-sensitive applications. The paper introduces HGD, which trains denoisers against differences in target-model high-level outputs to address error amplification. HGD is reported as more robust and flexible than ensemble adversarial training, including first-place performance in the NIPS defense competition.
Problem
Neural networks can be misled by small adversarial perturbations, while residual noise can be amplified through the network and threaten security-sensitive applications.
Method
HGD trains an image denoiser using the difference between target-model high-level outputs for clean and denoised images rather than pixel-level reconstruction loss.
Results
HGD is more robust to white-box and black-box attacks than ensemble adversarial training, generalizes with less training data and time, transfers across target models, and won the NIPS defense competition.
Takeaways & Limitations
The reported findings support denoising as a simpler, transferable defense strategy than jointly learning classification and adversarial defense.
Takeaways & Limitations
HGD’s denoising ability depends on how representative its training set is; the authors used FGSM and iterative attacks and propose adding other attacks.
Abstract
from arXiv · showhide
Neural networks are vulnerable to adversarial examples, which poses a threat to their application in security sensitive systems. We propose high-level representation guided denoiser (HGD) as a defense for image classification. Standard denoiser suffers from the error amplification effect, in which small residual adversarial noise is progressively amplified and leads to wrong classifications. HGD overcomes this problem by using a loss function defined as the difference between the target model's outputs activated by the clean image and denoised image. Compared with ensemble adversarial training which is the state-of-the-art defending method on large images, HGD has three advantages. First, with HGD as a defense, the target model is more robust to either white-box or black-box adversarial attacks. Second, HGD can be trained on a small subset of the images and generalizes well to other images and unseen classes. Third, HGD can be transferred to defend models other than the one guiding it. In NIPS competition on defense against adversarial attacks, our HGD solution won the first place and outperformed other models by a large margin.
1. Introduction
Neural networks can be misled by small, transferable adversarial perturbations, creating security risks and motivating effective defenses. The paper proposes HGD, which guides denoising with target-model high-level outputs and reports stronger, more flexible defense than ensemble adversarial training.
- Adversarial examples use small perturbations to mislead neural networks and can transfer across models, enabling black-box attacks.
- Adversarial attacks threaten security-sensitive applications such as identity authentication and autonomous driving.
- Denoising reduces adversarial noise, but residual perturbations can be amplified in target-model top layers and cause wrong predictions.
- HGD trains an image denoiser using the difference between target-model top-level outputs for original and adversarial examples instead of pixel-level reconstruction loss.
- HGD achieves higher accuracy against white-box and black-box attacks, uses less training data and time, generalizes to unseen classes, and transfers across target models.
- HGD won first place in the NIPS adversarial defense competition by a large margin and had faster inference than other top-ranked methods.
2. Background and Related Work
The background defines adversarial examples and common attack settings, then reviews adversarial training, preprocessing, and gradient-masking defenses. These approaches target robustness through different combinations of perturbed-data training, input transformation, or reduced output sensitivity.
- 2. Background: The paper denotes clean images by x, adversarial examples by x∗, labels by y, and the target model by f.
- 2. Background: Adversarial examples are malicious inputs with small differences from clean images that cause incorrect classifications, measured here using L∞ perturbation magnitude.
- 2.1. Existing methods for adversarial attacks: L-BFGS generates targeted adversarial examples by jointly minimizing perturbation magnitude and loss toward a specified target class under pixel-value constraints.
- 2.1. Existing methods for adversarial attacks: FGSM computes a single input-gradient step and is more efficient than L-BFGS; variants use predicted labels or target classes to alter attack behavior.
- 2.1. Existing methods for adversarial attacks: Iterative FGSM repeats FGSM for n steps and usually produces higher classification error than FGSM.
- 2.1. Existing methods for adversarial attacks: Adversarial examples transfer across models, enabling black-box attacks; white-box attacks use the target model or a model ensemble containing it.
- 2.2. Existing defenses: Adversarial training augments training data with adversarially perturbed examples to improve target-model accuracy on adversarial inputs.
- 2.2. Existing defenses: Preprocessing defenses transform inputs to remove adversarial noise, including denoising auto-encoders, filters, and JPEG compression.
3. Methods
The paper develops denoisers for adversarial images, culminating in HGD, which guides denoising with high-level representations from the target classifier to address error amplification.
- Pixel guided denoiser: Denoising autoencoders reduce adversarial noise but may lose fine-scale information needed for reconstructing high-resolution ImageNet images.The paper therefore uses a convolutional DAE rather than the earlier multilayer-perceptron version evaluated on MNIST.
- Denoising U-net: DUNET extends DAE with lateral encoder–decoder connections and residual learning that predicts adversarial noise instead of reconstructing the whole image.The denoised image is formed by subtracting the predicted noise from the corrupted input.
- High-level representation guided denoiser: HGD replaces pixel-level reconstruction with an L1 loss between target-model representations activated by clean and denoised images.This design targets the high-level responses that can remain distorted after pixel-level denoising.
- High-level representation guided denoiser: FGD matches features from the target model’s top convolutional layer, whereas LGD matches logits immediately before the final softmax.The paper motivates the pair by contrasting richer convolutional supervision with logits that directly represent classification results.
- Training objectives: CGD instead uses the target model’s classification loss and requires ground-truth labels, unlike the unsupervised PGD and HGD variants.PGD is named for its pixel-level loss, while HGD uses target-model representations.
4. Experimental settings
Experiments use pretrained Inception v3 as the default target model and evaluate ImageNet defenses against white-box and black-box attacks, comparing HGD with ensemble adversarial training.
- Models and dataset: All experiments use ImageNet, with pretrained Inception v3 serving as the default target model for attack generation and denoiser training.The study also examines whether HGDs trained against Inception v3 defend other models.
- Baselines and optimization: The comparison targets ensemble adversarial training, identified as the state-of-the-art defense method for large images.Denoisers are optimized with Adam, trained for 20–30 epochs, and selected by lowest validation loss.
- Training data: 30K ImageNet training images are distorted using FGSM and IFGSM attacks against Inception v3, Inception-ResNet v2, and ResNet50 v2 individually or in ensembles.The training images contain 30 images per class.
- Validation data: The validation set contains 70K adversarial images generated from 10K ImageNet training images using the same attack-generation procedure.The source set contributes 10 images per class.
- Test data: WhiteTestSet and BlackTestSet each contain 40K images derived from the same clean 10K-image ImageNet validation subset.White-box attacks target Inception v3, whereas black-box attacks use holdout Inception v4; both use perturbation levels ϵ ∈ {4, 16}.
5. Results
HGD improves robustness against white-box and black-box attacks while using less training data and time than adversarial training. Its high-level guidance suppresses layerwise error amplification and transfers across models and unseen classes.
- 5.1. PGD and the error amplification effect: PGD perturbations are progressively amplified through the target model and become much larger than random perturbations at the top layer.At the top layer, PGD perturbation is close to adversarial perturbation, where classification depends on top-level features.
- 5.1. PGD and the error amplification effect: LGD strongly suppresses error amplification, producing final-layer perturbations much lower than PGD and adversarial perturbations and close to random perturbation.This comparison is reported using layerwise perturbation levels of denoised and perturbed images.
- HGD methods significantly outperform PGD and ensV3 against all tested attack types, while LGD decreases clean-image accuracy by only 0.5%.LGD is selected as the default HGD method because it balances clean and adversarial accuracy.
- 30K clean images and fewer than 30 training epochs train HGD, compared with 1.2M images and about 200 epochs for ensV3.HGD uses 210K adversarial images after constructing its training set from 30K clean images.
- 5.3. Transferability of HGD: IncV3-guided LGD significantly improves ResNet robustness and achieves performance very close to ResNet-guided LGD.This result supports transferability of HGD across target models.
- 5.3. Transferability of HGD: HGD can defend against attacks on 250 classes that were never included in training.The evaluation uses 750 classes for training and the remaining 250 classes for validation and testing.
- 5.4. HGD as an anti-adversarial transformer: HGD may increase pixel-level noise because LGD adds favorable perturbations rather than suppressing total image noise.The proposed defense reduces adversarial noise while transforming inputs into examples that are easier for the target model to classify.
- 5.5. Results in NIPS adversarial defenses competition: The competition solution ranked first among 107 teams, significantly outperforming other methods and running faster than the other top methods.The solution used four defended models whose logits were averaged for classification.
6. Conclusion
The paper concludes that HGD uses top-layer error to guide image denoising and is robust against both white-box and black-box attacks. It reports simple training, good generalization, flexibility, and future gains from broader attack coverage.
- HGD uses error in the neural network’s top layers as the loss function for training an image denoiser.
- HGD is reported to be robust against both white-box and black-box adversarial attacks.
- HGD has a simple training procedure, good generalization, and high flexibility.
- The denoising ability of HGD depends on how representative its training attack set is.The current experiments used FGSM and iterative attacks.
- The authors suggest that incorporating attacks from transformation networks could improve HGD’s performance.