Source-linked AI summary
Local Gradients Smoothing: Defense against localized adversarial attacks
Muzammal Naseer, Salman H. Khan, Fatih Porikli
TL;DR
Localized adversarial attacks challenge DNN security by concentrating noise in specific regions while preserving salient objects. The paper introduces LGS, which estimates noisy regions in the gradient domain and smooths them before inference. LGS outperforms several defenses against localized attacks and is reported as especially resistant to BPDA.
Problem
Localized attacks such as LaVAN and Adversarial patch add adversarial noise within specific regions without affecting salient objects, challenging DNN security.
Method
LGS estimates the region with the highest likelihood of adversarial noise and performs gradient smoothing only in that region before DNN inference.
Results
LGS outperforms Digital Watermarking, JPEG compression, TVM, and Feature squeezing against localized attacks and shows the most resistance to BPDA.
Takeaways & Limitations
LGS provides a localized input transformation that preserves benign-example accuracy with minimal drop while improving defense against localized adversarial attacks.
Takeaways & Limitations
The paper recommends combining standalone defenses into a robust classification system, with LGS serving as the transformation stage before adversarially trained classification.
Abstract
from arXiv · showhide
Deep neural networks (DNNs) have shown vulnerability to adversarial attacks, i.e., carefully perturbed inputs designed to mislead the network at inference time. Recently introduced localized attacks, Localized and Visible Adversarial Noise (LaVAN) and Adversarial patch, pose a new challenge to deep learning security by adding adversarial noise only within a specific region without affecting the salient objects in an image. Driven by the observation that such attacks introduce concentrated high-frequency changes at a particular image location, we have developed an effective method to estimate noise location in gradient domain and transform those high activation regions caused by adversarial noise in image domain while having minimal effect on the salient object that is important for correct classification. Our proposed Local Gradients Smoothing (LGS) scheme achieves this by regularizing gradients in the estimated noisy region before feeding the image to DNN for inference. We have shown the effectiveness of our method in comparison to other defense methods including Digital Watermarking, JPEG compression, Total Variance Minimization (TVM) and Feature squeezing on ImageNet dataset. In addition, we systematically study the robustness of the proposed defense mechanism against Back Pass Differentiable Approximation (BPDA), a state of the art attack recently developed to break defenses that transform an input sample to minimize the adversarial effect. Compared to other defense mechanisms, LGS is by far the most resistant to BPDA in localized adversarial attack setting.
1. Introduction
Localized adversarial attacks add concentrated, visible noise to limited image regions, challenging DNN security while leaving salient objects unchanged. The paper proposes LGS to identify and smooth those regions, outperforming several defenses and resisting BPDA.
- Motivation: Localized attacks add large visible perturbations to few pixels or regions, unlike traditional attacks that modify each pixel imperceptibly.LaVAN and Adversarial patch preserve the original salient object while concentrating adversarial noise spatially.
- Results: Figure 1 shows LGS restoring correct class confidences for transformed LaVAN and Adversarial patch examples.The figure compares benign, adversarial, and LGS-transformed examples using Inception v3 confidence scores.
- Method: LGS estimates the region most likely to contain adversarial noise and applies gradient smoothing only there.The design targets high-frequency activity while limiting changes to image regions important for classification.
- Results: LGS significantly reduces gradient activity in targeted attack regions and is reported as the most resistant defense to BPDA.BPDA is specifically designed to bypass transformation-based defenses.
- Results: LGS outperforms Digital Watermarking, TVM, JPEG compression, and Feature squeezing against localized attacks.The comparison is conducted in the localized adversarial attack setting.
2. Related Work
Localized attacks include physical-world patches and smaller region-confined noise, while defenses modify either the DNN or the input. The paper positions LGS as providing better defense against localized attacks than prior techniques.
- Localized attacks: Adversarial patch creates scene-independent physical-world noise intended to work across camera angles, lighting conditions, and classifier types.The patch can be printed and placed in the classifier’s field of view in white-box or black-box settings.
- Localized attacks: Successful Adversarial patch attacks typically require a patch covering 10% of the image in about 90% of cases.LaVAN addresses this size limitation by covering as little as 2% of the image area.
- Defenses: Defense mechanisms either modify the DNN through adversarial training or gradient masking, or modify inputs with smoothing functions.JPEG compression, TVM, and feature squeezing are examples of input-transformation defenses.
- Comparison: The paper reports that its method provides better defense against localized attacks than previous techniques.The surrounding discussion compares localized-attack defenses across the related methods reviewed in the paper.
- Comparison: The paper evaluates LGS against LaVAN and Adversarial patch attacks alongside other defense methods.The experiments are presented as a comparison of effectiveness against both localized attack types.
3. Adversarial Attacks
Traditional adversarial examples optimize a classifier’s target-class likelihood under a perturbation budget, whereas localized attacks replace a small masked region with adversarial noise. Adversarial patch methods additionally optimize robustness across transformations and locations.
- Traditional attacks: Adversarial-example generation seeks a modified input x′ = x + δ that increases the likelihood of a target class under perturbation budget ϵ.The formulation treats x as an input sample and δ as adversarial noise.
- Traditional attacks: Traditional optimization changes every image pixel, producing well-camouflaged examples that smoothing defenses can reduce when ϵ is not too high.JPEG compression, TVM, and feature squeezing are cited as defenses for this setting.
- LaVAN: LaVAN confines adversarial noise to a small region, usually away from the salient object, using a spatial mask.Its masked formulation replaces the selected area with noise rather than adding noise throughout the image.
- LaVAN: LaVAN’s objective jointly moves optimization away from the source class and toward the target class.The resulting x′ is defined by the masked construction.
- Adversarial patch: Adversarial patch attacks use Expectation over Transformation to create printed patches robust to camera angles, rotations, and lighting conditions.The optimization averages classifier likelihood over training images, transformations, and image locations.
4. Defense: Local Gradients Smoothing
LGS identifies localized high-frequency regions in the gradient domain and suppresses them in the image while limiting structural loss through overlapping local windows.
- Gradient-based localization: Localized attacks create concentrated high-frequency changes that become prominent in image-gradient maps, motivating gradient-based noise localization.The method uses normalized gradient magnitude to identify regions likely to contain adversarial perturbations.
- Visualization: Figure 2 illustrates adversarial examples, pre-windowing gradient maps, window-search regions, and post-windowing gradient maps for LaVAN and adversarial patch attacks.The figure compares the gradient representations before and after the windowing operation.
- Gradient-based localization: The normalized gradient map is projected onto the input image to smooth high-frequency details in regions likely to contain adversarial noise.These regions are evaluated as unlikely to provide significant information for final classification.
- Local smoothing: Global smoothing can cause structural loss and reduce benign accuracy, so LGS restricts smoothing to locally detected high-activation regions.The local restriction is designed to minimize the effect on image structure and salient classification content.
- Local smoothing: LGS divides the gradient map into K overlapping blocks of size τ and filters them with threshold γ to estimate regions most likely to contain adversarial noise.The selected blocks are updated and collated to recreate the full gradient image.
5. Experiments
Experiments evaluate LGS and competing input-transformation defenses on ImageNet under LaVAN and adversarial-patch attacks, including computational cost and BPDA resilience. LGS processes estimated noisy regions locally and is reported as more effective against localized attacks and BPDA than several global defenses.
- Protocol: Experiments use Inception v3, white-box attacks, the 50k-image ImageNet-2012 validation set, and top-1 accuracy.LaVAN experiments use border noise locations and masks covering approximately 2%, 3%, or 4% of 299×299 images; adversarial-patch results use 95×95 noise covering approximately 10%.
- Compared defenses: LGS is compared with digital watermarking, median, Gaussian, and bilateral filtering, JPEG compression, TVM, and bit-depth reduction.The comparison includes both local and global input-processing defenses.
- Related defenses: JPEG compression reduces benign accuracy as compression increases and is reported as ineffective against localized attacks, with substantially weaker defense against BPDA.JPEG removes high-frequency components through DCT-based compression and quantization.
- Related defenses: Median filtering reduces localized adversarial effects with a reasonable benign-accuracy drop and outperforms Gaussian and bilateral filtering among the tested smoothing filters.Bit-depth reduction was not effective against localized attacks.
- BPDA resilience: LGS suppresses high-frequency noise and gradient activity in the estimated mask region, restricting BPDA's explorable space for localized attacks.The BPDA evaluation uses 1,000 ImageNet examples with matched target, location, mask size, and iteration settings across defenses.
6. Discussion and Conclusion
The paper presents LGS as a gradient-domain defense for localized attacks and situates it within a broader robust-classification pipeline. It reports stronger localized-attack performance than several alternatives, while emphasizing that standalone defenses remain difficult against continuously evolving attacks.
- Discussion and Conclusion: LGS estimates adversarial-noise regions from gradient-domain attack properties and smooths gradients only in those regions.The transformation is intended to reduce adversarial effects while minimally affecting salient objects.
- Discussion and Conclusion: Standalone defenses remain difficult against continuously evolving adversarial attacks, motivating a multi-stage robust classification system.The paper states that unlimited distortion can produce adversarial examples that bypass any defense system with 100% success rate, although such examples may be easier to detect.
- Discussion and Conclusion: The proposed robust-classification system separates detection, projection or transformation, and classification, with LGS occupying the transformation stage.The classification stage is described as using a DNN whose robustness is increased through adversarial training.
- Discussion and Conclusion: LGS outperforms digital watermarking, JPEG compression, feature squeezing, and TVM against localized attacks with minimal benign-accuracy loss.The method can also be combined with smoothing filters applied only to the estimated noisy region.