Source-linked AI summary
Deflecting Adversarial Attacks with Pixel Deflection
Aaditya Prakash, Nick Moran, Solomon Garber, Antonella DiLillo, James Storer
TL;DR
CNN classifiers can be misled by small, imperceptible perturbations, threatening critical applications. The paper combines pixel deflection with wavelet-based denoising to defend against these attacks, and experiments show effective recovery against state-of-the-art attacks while preserving clean-image accuracy.
Problem
Small, imperceptible adversarial perturbations can cause CNNs used in critical systems to misclassify images.
Method
The defense nondifferentiably redistributes pixels from local neighborhoods and applies adaptive wavelet soft-thresholding to reduce adversarial effects.
Results
The combined transformations effectively defend against state-of-the-art attacks and do not significantly decrease accuracy on non-adversarial images.
Takeaways & Limitations
The method provides a computationally efficient defense for large natural images without retraining or modifying the CNN.
Takeaways & Limitations
The evaluation excludes attacks such as Projected Gradient Descent and One Pixel Attack because they do not scale well to large images.
Abstract
from arXiv · showhide
CNNs are poised to become integral parts of many critical systems. Despite their robustness to natural variations, image pixel values can be manipulated, via small, carefully crafted, imperceptible perturbations, to cause a model to misclassify images. We present an algorithm to process an image so that classification accuracy is significantly preserved in the presence of such adversarial manipulations. Image classifiers tend to be robust to natural noise, and adversarial attacks tend to be agnostic to object location. These observations motivate our strategy, which leverages model robustness to defend against adversarial perturbations by forcing the image to match natural image statistics. Our algorithm locally corrupts the image by redistributing pixel values via a process we term pixel deflection. A subsequent wavelet-based denoising operation softens this corruption, as well as some of the adversarial changes. We demonstrate experimentally that the combination of these techniques enables the effective recovery of the true class, against a variety of robust attacks. Our results compare favorably with current state-of-the-art defenses, without requiring retraining or modifying the CNN.
1. Introduction
CNNs support critical applications but can be fooled by small, imperceptible perturbations. The paper proposes a nondifferentiable pixel-deflection and wavelet-denoising defense that preserves clean-image accuracy while recovering classifications under attacks.
- Small, carefully crafted, imperceptible perturbations can cause CNNs to misclassify natural images.
- Differentiable image transformations can be circumvented by differentiating through both the transformation and the CNN.
- Pixel deflection randomly replaces pixels with nearby pixels, while adaptive wavelet soft-thresholding reduces adversarial effects.
- The transformations defend against state-of-the-art attacks without significantly reducing accuracy on non-adversarial images.
2. Adversarial Attacks
The paper examines white-box adversarial attacks that create nearby misclassified images using gradient-based or optimization-based procedures. Its evaluation targets attacks that scale to large natural images, excluding methods that do not scale well beyond small-image datasets.
- White-box attacks exploit known model parameters, commonly using gradients or optimization to alter image pixels.
- An adversarial example is close to the original image but receives a different classifier prediction.
- FGSM applies a single gradient-sign step, whereas IGSM iteratively applies gradient-sign updates within an L∞ neighborhood.
- L-BFGS minimizes L2 distance while constraining the generated image's class label, and Deep Fool seeks the smallest perturbation crossing a linearized boundary.
- The experiments use L2 for C&W because it makes the loss differentiable, while success with L0 and L∞ beyond CIFAR and MNIST is limited.
- Projected Gradient Descent and One Pixel Attack are excluded because they do not scale well to large images.
3. Defenses
Transformation-based defenses aim to restore an adversarial image's original classification, but many reduce accuracy on clean images. The paper motivates a transformation designed to address both robustness and clean-image preservation.
- A defense can transform an input so the classifier's output matches the original image's classification.
- Ensemble adversarial training expands decision boundaries around training examples, while distillation matches a larger network's softmax outputs.
- Most transformation-based defenses lose clean-image accuracy because their transformations can change the classifier's prediction.
4. Related Work
Prior transformation defenses often degrade clean images or rely on object coordinates, motivating a stochastic method that uses semantic information without requiring ground-truth bounding boxes. The paper combines spatially informed randomness with wavelet denoising.
- Transformation defenses have been limited by degraded non-adversarial image quality and resulting accuracy loss.
- Image quilting searches clean patches and augments reconstruction with total-variation minimization, whereas this method uses semantic maps without optimization.
- Foveation-based defense crops around ground-truth object coordinates, but adversarial perturbations can remain inside the object bounding box.
- The proposed stochastic method does not require a ground-truth bounding box and is not restricted to modifying one input region.
- Unlike random-crop ensembling, the method spatially defines perturbation probability and then denoises with a wavelet-based transform.
5. Pixel Deflection
Pixel deflection introduces localized artificial noise by replacing pixels with nearby values, exploiting classifiers’ robustness to natural noise while disrupting adversarial perturbations. Experiments show that this transformation can recover correct classifications without substantially affecting clean-image predictions.
- Pixel Deflection: The method relies on classifier robustness to natural noise and locally redistributes pixel values to counter adversarial changes.Alternative neighborhood sampling from a Gaussian centered on each pixel was less effective.
- Pixel Deflection: Pixel deflection randomly replaces selected pixels with pixels sampled from a small square neighborhood.The transform takes an image and neighborhood size as input and returns an image with the same dimensions.
- Pixel Deflection: 1% pixel changes do not alter clean-image classification, while pixel deflection recovers a significant portion of correct classifications for adversarial images.The 1% perturbation level is ten times the amount used in the experiments.
- Distribution of Attacks: Adversarial attacks distribute perturbations across the image without regard to object location, motivating spatially selective pixel updates.The approach explores making update probability inversely proportional to the likelihood that a pixel contains an object.
6. Targeted Pixel Deflection
Targeted pixel deflection uses approximate object localization to resample background pixels while preserving contextual information needed for classification. A robust activation map aggregates class evidence to reduce sensitivity to adversarial changes in the predicted class.
- 6. Targeted Pixel Deflection: Targeted pixel deflection preferentially drops background pixels while preserving enough context to protect classification.This addresses the limitations of requiring ground-truth object coordinates and completely masking the background.
- Robust Activation Map: Figure 4 compares standard and robust activation maps under adversarial inputs.The comparison concerns how adversarial presence changes the two types of activation maps.
- Robust Activation Map: Class activation maps provide approximate semantic object localization, but they lack pixel-level precision.The method uses a variant of class activation maps to localize salient objects for unlabeled inputs at inference time.
- Robust Activation Map: 38% of adversarial images are predicted as the clean image’s second-highest class, motivating aggregation across the top-k class activation maps.The second-highest class is often a synonym or close relative of the main class.
- Robust Activation Map: The robust activation map exponentially averages top-k class maps and normalizes the result to [0, 1] to reduce mis-localization from an incorrect top-1 class.For ImageNet-1000, the method uses k = 5 and generates one combined map per image.
7. Wavelet Denoising
Wavelet denoising is used to reduce pixel-deflection and adversarial noise while preserving natural-image structure. Adaptive soft thresholding, especially BayesShrink, is selected because it preserves perceptual features better than hard thresholding and outperforms SUREShrink experimentally.
- Motivation: Wavelet denoising targets noise from pixel deflection and adversarial attacks by detecting departures from natural-image frequency statistics.Adversarial perturbations may occupy different frequencies from pixel-drop noise, motivating multi-resolution analysis.
- Motivation: JPEG compression can recover correct classifications on some adversarial images but reduces clean-image accuracy, including an 8% loss reported in prior work.Fixed JPEG quantization removes both noise and some signal.
- Thresholding: Soft thresholding reduces all wavelet coefficients above the threshold and preserves better PSNR than hard thresholding, which can over-blur images.Hard thresholding sets coefficients below the threshold to zero; soft thresholding also subtracts the threshold from larger magnitudes.
- Adaptive Thresholding: BayesShrink selects image- and sub-band-specific thresholds by modeling wavelet coefficients with a Generalized Gaussian Distribution and minimizing expected mean square error.The resulting threshold adapts to the amount of noise in each image and is intended to preserve perceptual features of natural images.
- Adaptive Thresholding: BayesShrink removed artificial noise while preserving natural-image features within a suitable β range, whereas SUREShrink performed worse in the authors’ experiments.Comparative results are reported in Table 6.
8. Method
The defense first applies targeted pixel deflection to alter adversarial inputs, then softens the resulting corruption through color-space conversion and wavelet denoising. Its procedure uses activation-guided random pixel replacement followed by BayesShrink-based reconstruction.
- Pixel Deflection: The method begins by corrupting adversarial noise through targeted pixel deflection guided by a robust activation map.The activation map determines how pixel locations are selected for deflection.
- Pixel Deflection: At each iteration, the algorithm samples a pixel, compares its normalized activation value with a uniform random value, and conditionally deflects it.The process is repeated K times.
- Wavelet Denoising: The image is converted to Y CbCr space before wavelet processing to decorrelate channels in a perceptually meaningful representation.The authors associate this representation with denoising advantages similar to wavelets.
- Wavelet Denoising: The defense applies a discrete wavelet transform, soft-thresholds coefficients with BayesShrink, and computes the inverse transform.The implementation uses db1 wavelets, with similar results obtained using db2 and haar wavelets.
- Wavelet Denoising: After inverse wavelet reconstruction, the image is converted back to RGB for classification.
9. Experimental Design
The experiments evaluate the defense on correctly classified ImageNet validation images using a pretrained ResNet-50 and adversarial attacks constrained by normalized RMSE budgets. The study also tunes three defense hyper-parameters and releases its implementation code.
- Dataset and Classifier: The evaluation uses 1000 randomly selected ImageNet validation images and a pretrained ResNet-50 classifier.The selected images achieve 76% Top-1 accuracy with the classifier before adversarial processing.
- Dataset and Classifier: 76% Top-1 accuracy is obtained on the selected clean images, matching the single-model single-crop accuracy reported for ResNet-50.
- Evaluation Protocol: The experiments exclude images misclassified without adversarial noise because unmodified originals cannot measure pixel-level attack or defense effects.Only images correctly classified in the absence of adversarial noise are retained.
- Evaluation Protocol: The attack models use CleverHans parameters targeting the highest possible misclassification score under normalized RMSE (|L2|) budgets of 0.02–0.04.
- Reproducibility: The authors state that their implementation code will be publicly released.
- Hyper-parameter Selection: The defense has three hyper-parameters—σ, r, and K—which are tuned by linear search on a reduced set of 300 ImageNet validation images.They control BayesShrink, pixel-deflection window size, and the number of deflections, respectively.
10. Results & Discussion
The defense is evaluated on untargeted white-box attacks using Top-1 recovery, destruction rate, cross-classifier comparisons, and ablations of its transformation components. Results indicate strong recovery against several attacks, while comparisons remain constrained by differing norms, perturbation strengths, and evaluation setups.
- Evaluation setup: Majority voting over ten stochastic runs is reported as Ens-10, and clean-image accuracy is 100% because initially misclassified images were excluded.The experiments use untargeted white-box attacks and report Top-1 accuracy.
- Ablation studies: The method uses σ = 0.04, window size 10, and 100 deflections in the reported table configurations.These are the listed parameters for the transformation and denoising experiments.
- Comparison with prior defenses: 98% recovery is achieved on C&W with |L2| of 0.04 on ResNet-50, compared with 97.1% on ResNet-101 and 98.8% on ens-adv-Inception-ResNet-v2 reported by Xie et al.The compared systems use different classifiers, perturbation reporting, and crop ensembles, limiting direct comparability.
- Evaluation setup: Destruction Rate measures the fraction of adversarially misclassified images correctly classified after transformation, with 1 meaning complete recovery.The metric is used to compare defenses fairly across attacks.
- Comparison with prior defenses: Top-5 accuracy is unsuitable for defense evaluation because the defense must exactly recover the correct classification, although adversarial and original classes often remain in each other’s top-5 predictions.Nearly 40% of the time, the adversarial class was the second-most-probable class for the original image.
- Ablation studies: BayesShrink performs better than other tested soft-thresholding techniques on wavelet coefficients after pixel deflection.VisuShrink is faster but less broadly applicable, while SUREShrink is less suited to denoising in these results.
11. Conclusion
The paper concludes that computationally efficient pixel deflection combined with soft wavelet denoising defends against state-of-the-art attacks while using robust activation maps to protect regions of interest. Future work targets image-adaptive hyperparameters and integrating activation maps with wavelet denoising.
- Conclusion: Pixel deflection combined with soft wavelet denoising provides an effective defense against state-of-the-art adversarial attacks.The transformation is described as computationally efficient.
- Conclusion: Most attacks are agnostic to semantic content, so inversely weighting pixel deflection by robust activation maps protects regions of interest.The weighting reduces deflection probability in regions identified as robustly activated.
- Conclusion: Ongoing work seeks to adapt hyperparameters to individual image features and integrate robust activation maps with wavelet denoising.These are stated directions for improving the technique.