PaperlayerView exact revision on arXiv

Source-linked AI summary

Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models

Pouya Samangouei, Maya Kabkab, Rama Chellappa

arXiv:1805.06605v2cs.CVcs.LGstat.ML

TL;DR

Deep neural classifiers are vulnerable to small adversarial perturbations that cause misclassification. Defense-GAN models unperturbed images with a generative model and projects inputs toward that learned distribution before classification, showing consistent defense across attack strategies while requiring careful training and tuning.

  • Problem

    Small adversarial perturbations can cause legitimate images to be misclassified while remaining imperceptible to human recognition.

  • Method

    Defense-GAN trains a GAN to model unperturbed images and projects inputs onto the generator’s range before classification.

  • Results

    Defense-GAN consistently provides adequate defense across commonly considered black-box and white-box attack strategies on two benchmark computer vision datasets.

  • Takeaways & Limitations

    The method can defend classification models without assuming a particular attack model or modifying the classifier structure or training procedure.

  • Takeaways & Limitations

    Defense-GAN depends on a well-trained, expressive GAN, and its effectiveness also depends critically on tuning L and R, potentially without attack knowledge.

Abstract

from arXiv · show

In recent years, deep neural network approaches have been widely adopted for machine learning tasks, including classification. However, they were shown to be vulnerable to adversarial perturbations: carefully crafted small perturbations can cause misclassification of legitimate images. We propose Defense-GAN, a new framework leveraging the expressive capability of generative models to defend deep neural networks against such attacks. Defense-GAN is trained to model the distribution of unperturbed images. At inference time, it finds a close output to a given image which does not contain the adversarial changes. This output is then fed to the classifier. Our proposed method can be used with any classification model and does not modify the classifier structure or training procedure. It can also be used as a defense against any attack as it does not assume knowledge of the process for generating the adversarial examples. We empirically show that Defense-GAN is consistently effective against different attack methods and improves on existing defense strategies. Our code has been made publicly available at https://github.com/kabkabm/defensegan

1 INTRODUCTION

Deep neural networks can be misled by small, human-imperceptible perturbations, while existing defenses may depend on specific attack models. Defense-GAN projects inputs onto a GAN generator’s range before classification to reduce adversarial effects.

  • Small adversarial perturbations can cause legitimate images to be misclassified despite leaving human recognition largely unchanged.
  • Existing defenses modify training data, classifier training, or inputs, but some are ineffective against new attacks.
  • Defense-GAN targets both white-box and black-box attacks without assuming a particular attack model.
  • Defense-GAN projects input images onto the range of a GAN generator before passing them to the classifier.The generator maps a low-dimensional latent vector to the high-dimensional input space and models the data distribution.
  • The framework expects legitimate samples to lie near the generator range and adversarial samples to lie farther away, allowing projection to reduce adversarial perturbations.

2 RELATED WORK AND BACKGROUND INFORMATION

The paper reviews black-box and white-box attack models, representative defenses, and GANs as the foundation for Defense-GAN. These methods differ in attacker knowledge, perturbation construction, training strategy, and assumptions about data distributions.

  • Attack models: The paper evaluates untargeted white-box FGSM, RAND+FGSM, and CW attacks, with CW described as optimization-based and highly effective.
  • Attack models: FGSM sets δ = ϵ · sign(∇xJ(x, y)), while RAND+FGSM first adds a small random perturbation before applying FGSM.
  • Attack models: Black-box attackers lack classifier parameters and may train substitute models using queried labels, whereas white-box attackers know the architecture, parameters, and defenses.
  • Defense mechanisms: Adversarial training augments the dataset with attack-generated examples, but transfers less well when the attacker uses a different strategy.
  • Defense mechanisms: Defensive distillation smooths the classifier and reduces local gradient amplitudes to hinder adversarial-example generation.
  • Defense mechanisms: MagNet uses auto-encoder reformers to move adversarial examples closer to the manifold of natural examples.
  • GAN background: GANs train generator G and discriminator D adversarially, with G mapping latent vectors from R^k to samples in R^n.
  • GAN background: WGANs use the Wasserstein distance, and this work adopts them because their training methods are more stable.

3 PROPOSED DEFENSE-GAN

Defense-GAN projects inputs onto the range of a generator trained on legitimate data before classification, aiming to reduce adversarial noise without changing the classifier. The approach uses reconstruction optimization and is presented as compatible with different classifiers and attack models.

  • Defense-GAN algorithm: Defense-GAN projects an input image onto the range of a GAN generator before passing the resulting reconstruction to the classifier.The projection minimizes reconstruction error using gradient descent.
  • Motivation: The generator is trained on legitimate, unperturbed training samples so its reconstructions are intended to reduce adversarial noise.The method expects adversarial perturbations to differ from the generator’s learned data distribution.
  • Motivation: Under ideal conditions, adding reconstruction should preserve performance on legitimate samples because they should be recovered almost exactly.This expectation assumes sufficient generator capacity and convergence toward the data distribution.
  • Defense-GAN algorithm: L gradient-descent steps with R random restarts approximate the highly non-convex projection optimization.The random initializations are used to search for a suitable latent representation.
  • Design properties: Defense-GAN can be added before any classifier without modifying its structure, and it does not assume a specific attack model.The classifier may use original images, reconstructions, or a combination during training; retraining is not expected to be necessary when the GAN is representative enough.
  • Design properties: The defense is highly non-linear, making gradient-based white-box attacks difficult because attackers must differentiate through the gradient-descent loop.The stated mechanism requires propagating gradients across L optimization steps.

4 EXPERIMENTS

Experiments evaluate Defense-GAN across black-box and white-box attacks, parameter settings, datasets, and attack detection. Defense-GAN generally reduces attack impact, while reconstruction settings and attack strength materially affect performance.

  • Experimental setup: The experiments compare Defense-GAN with adversarial training and MagNet across FGSM, RAND+FGSM, and CW attacks under black-box and white-box threat models.Defense-GAN-Rec and Defense-GAN-Orig use reconstructed and original images, respectively, for classifier training.
  • Black-box attacks: FGSM black-box attacks reduced classifier accuracy by up to 70%, while Defense-GAN variants performed consistently across classifier and substitute-model combinations.Defense-GAN generally achieved higher accuracy than MagNet, whereas adversarial training degraded with incorrect ϵ and varied substantially across architectures.
  • Black-box attacks: F-MNIST defenses performed noticeably worse than MNIST under FGSM with ϵ = 0.3 because the perturbation represented very high noise.At this magnitude, F-MNIST images became difficult to classify even for humans.
  • Effect of L and R: Increasing GD iterations improved clean-image performance but eventually reduced attacked-image accuracy because minimizing reconstruction MSE retained adversarial components.Increasing random restarts had an extremely pronounced effect by sampling different local minima of the non-convex MSE.
  • Attack strength and detection: Higher ϵ made FGSM more successful, including an approximately 37% F-MNIST performance drop between ϵ = 0.1 and 0.3, while larger perturbations were easier to detect.Detection used reconstruction MSE and ROC/AUC analysis; detection was especially effective with large L and R but difficult at very small ϵ and low false-positive rates.
  • White-box attacks: Under white-box attacks, Defense-GAN significantly outperformed adversarial training and MagNet, including when attackers knew the defense and random initializations.For classifier A on MNIST, accuracy dropped from 0.997 to 0.988 under FGSM, whereas the comparison at L = 25 dropped to 0.947.
  • White-box attacks: Larger GD iteration counts increased robustness against GD-based white-box attacks because attackers must propagate gradients through the unrolled reconstruction loop.This robustness increases inference-time complexity.

5 CONCLUSION

Defense-GAN is presented as a GAN-based defense against black-box and white-box adversarial attacks. Its effectiveness depends on GAN expressiveness and careful tuning of key hyperparameters.

  • Defense-GAN uses GANs to enhance classifier robustness against black-box and white-box adversarial attacks.
  • The method does not assume a particular attack model and was effective against most commonly considered attack strategies.
  • Defense-GAN provided adequate defense on two benchmark computer vision datasets, while other methods had shortcomings on at least one attack type.
  • Defense-GAN depends on the GAN’s expressiveness and generative power, so poor GAN training or tuning can reduce performance on original and adversarial examples.
  • Hyperparameters L and R are critical to defense effectiveness and may be difficult to tune without knowledge of the attack.

Appendices

The appendix proof analyzes the WGAN objective through its optimal discriminator and shows that minimizing the resulting expression requires matching the data and generator densities.

  • The proof begins from the WGAN min-max loss and considers the optimal discriminator for a fixed generator.
  • Substituting the optimal discriminator into the objective yields the expression analyzed in the subsequent proof steps.
  • On X = {x | p_data(x) ≥ p_g(x)}, minimizing the expression requires setting p_data(x) = p_g(x).
  • Because both probability density functions integrate to 1, any remaining strict inequality outside X creates a contradiction unless its Lebesgue measure is zero.

B DIFFICULTY OF GD-BASED WHITE-BOX ATTACKS ON DEFENSE-GAN

White-box attacks on Defense-GAN can propagate gradients through the generator and classifier, but differentiating the reconstruction optimization becomes increasingly expensive as the iteration count grows.

  • A white-box attacker can treat Defense-GAN’s generator and classifier as one feedforward network for gradient propagation.
  • The reconstruction objective is L(x, z) = ||G(z) − x||2, minimized over the latent variable z.
  • The reconstructed latent code z∗ is obtained recursively through gradient-descent updates over the optimization steps.
  • Differentiating z∗ with respect to x requires L recursive chain rules and high-dimensional Jacobian tensors, becoming increasingly prohibitive for large L.

C NEURAL NETWORK ARCHITECTURES

The appendices document the neural-network architectures used for classifiers, substitute models, GANs, and the MagNet baseline, along with shorthand for their layers and activations.

  • Tables 5 and 6 describe the architectures used for classifier or substitute networks and GANs, respectively.
  • Table 7 gives the encoder architecture used for the MagNet baseline.
  • Conv denotes convolutional layers with specified feature maps, filter size, and stride.
  • ConvT denotes the transpose or gradient of Conv, while FC denotes a fully connected layer with a specified number of outputs.
  • Dropout denotes a layer with probability p, and ReLU and LeakyReLU denote the rectified and leaky rectified linear activations.
  • Architectures F and E share the architectures of B and D, respectively, with dropout layers removed.

D QUALITATIVE EXAMPLES

The qualitative and parameter-sweep results examine how Defense-GAN reconstructions and classification accuracy vary with iterations, random restarts, and attack strength on MNIST and F-MNIST.

  • D QUALITATIVE EXAMPLES: Figures 6 and 7 compare original, FGSM-adversarial, and Defense-GAN reconstruction images across iterations, random restarts, and perturbation strengths.Figure 6 varies L and R, while Figure 7 varies ϵ with L = 50 and R = 15.
  • D QUALITATIVE EXAMPLES: Tables 8 and 9 measure Model F accuracy on MNIST and F-MNIST while varying iterations L with R = 10 under FGSM black-box attack.Both tables use ϵ = 0.3.
  • D QUALITATIVE EXAMPLES: Tables 10 and 11 measure Model F accuracy on MNIST and F-MNIST while varying random restarts R with L = 100 under FGSM black-box attack.Both tables use ϵ = 0.3.
  • D QUALITATIVE EXAMPLES: Figure 8 reports MNIST classification accuracy under an FGSM white-box attack with ϵ = 0.3 as iterations L varies while R = 10.The figure compares different models using Defense-GAN.

F ADDITIONAL RESULTS ON WHITE-BOX ATTACKS

Additional white-box experiments evaluate Defense-GAN for CelebA gender classification and compare it with other defenses across several attacks.

  • F ADDITIONAL RESULTS ON WHITE-BOX ATTACKS: The CelebA experiment uses more than 200,000 center-cropped, resized RGB face images for gender classification.Images are resized to 64 × 64, and the generator adds a ConvT(128, 5 × 5, 1) layer relative to the Table 6 architecture.
  • F ADDITIONAL RESULTS ON WHITE-BOX ATTACKS: Table 12 compares classifier accuracies under FGSM, RAND+FGSM, and CW white-box attacks across multiple defense strategies.Defense-GAN uses L = 200 and R = 2 in this experiment.
  • F ADDITIONAL RESULTS ON WHITE-BOX ATTACKS: The listed comparison includes Defense-GAN, adversarial training, and another defense label, enabling evaluation across defense strategies.The supplied table text identifies the comparison setting but does not provide the accuracy values.

G TIME COMPLEXITY

Defense-GAN reconstruction cost is driven mainly by gradient-descent iterations, while random restarts affect runtime less when parallel resources are available, creating a robustness–accuracy–time tradeoff.

  • G TIME COMPLEXITY: Reconstruction complexity scales with the number of gradient-descent iterations used to estimate z∗ multiplied by gradient-computation time.The same complexity statement is given both generally and as a concise formulation.
  • G TIME COMPLEXITY: Random restarts have less effect on running time because independent restarts can run in parallel when sufficient resources are available.This parallelism reduces the practical runtime impact of increasing R.
  • G TIME COMPLEXITY: Table 13 reports average reconstruction time in seconds for MNIST and F-MNIST across different values of L and R.The reported setting uses one NVIDIA GeForce GTX TITAN X GPU.
  • G TIME COMPLEXITY: The experiments identify a tradeoff among running time, defense robustness, and classification accuracy.The authors state that the running times are not prohibitive for most applications.
Loading 1805.06605v2…