Parametric Noise Injection: Trainable Randomness to Improve Deep Neural Network Robustness against Adversarial Attack

Adnan Siraj Rakin; Zhezhi He; Deliang Fan

Source-linked AI summary

Parametric Noise Injection: Trainable Randomness to Improve Deep Neural Network Robustness against Adversarial Attack

Adnan Siraj Rakin, Zhezhi He, Deliang Fan

arXiv:1811.09310v1Nov 22, 2018cs.LGcs.CRcs.CV

TL;DR

DNNs can be fooled by visually imperceptible adversarial perturbations, motivating more robust training methods. The paper proposes trainable Gaussian noise injection within adversarial training and reports improved clean and perturbed-data accuracy across white-box and black-box attacks.

Problem
DNNs remain vulnerable to visually imperceptible adversarial examples, creating a need for defenses that improve robustness against varied attacks.
Method
PNI injects Gaussian noise with learnable layer-specific scaling into inputs, activations, or weights and optimizes it through adversarial training.
Results
PNI improves both clean-data and perturbed-data accuracy against multiple white-box and black-box attacks, including PGD, C & W, FGSM, transferable, and ZOO attacks.
Takeaways & Limitations
Trainable noise injection provides a broader learned alternative to manually configured noise levels for improving adversarial robustness.
Takeaways & Limitations
Directly optimizing the noise scaling coefficient can drive α toward a small near-zero value because model optimization tends to overfit the training data.

Abstract

from arXiv · show

Recent development in the field of Deep Learning have exposed the underlying vulnerability of Deep Neural Network (DNN) against adversarial examples. In image classification, an adversarial example is a carefully modified image that is visually imperceptible to the original image but can cause DNN model to misclassify it. Training the network with Gaussian noise is an effective technique to perform model regularization, thus improving model robustness against input variation. Inspired by this classical method, we explore to utilize the regularization characteristic of noise injection to improve DNN's robustness against adversarial attack. In this work, we propose Parametric-Noise-Injection (PNI) which involves trainable Gaussian noise injection at each layer on either activation or weights through solving the min-max optimization problem, embedded with adversarial training. These parameters are trained explicitly to achieve improved robustness. To the best of our knowledge, this is the first work that uses trainable noise injection to improve network robustness against adversarial attacks, rather than manually configuring the injected noise level through cross-validation. The extensive results show that our proposed PNI technique effectively improves the robustness against a variety of powerful white-box and black-box attacks such as PGD, C & W, FGSM, transferable attack and ZOO attack. Last but not the least, PNI method improves both clean- and perturbed-data accuracy in comparison to the state-of-the-art defense methods, which outperforms current unbroken PGD defense by 1.1 % and 6.8 % on clean test data and perturbed test data respectively using Resnet-20 architecture.

1 Introduction

DNNs are vulnerable to visually imperceptible adversarial perturbations, motivating regularized training defenses. The proposed PNI method injects trainable noise during adversarial training and improves clean and attacked accuracy across multiple attacks.

Motivation: Adversarial examples can cause drastic classification accuracy degradation despite visually imperceptible perturbations to natural images.The paper illustrates this vulnerability with an image classified as a hen instead of a cat.
Motivation: White-box attackers access network architecture and parameters, whereas black-box attackers access only the model’s input and output.White-box attacks can often achieve high success rates across applications.
Motivation: Inference-only defenses may fall short against new attacks, motivating training-time noise regularization for broader robustness.The paper positions regularized training as a more general approach for defending against a wide range of attacks.
Proposed approach: PNI injects trainable Gaussian noise at the input, activations, or weights during training and inference, with layer-specific noise levels embedded in adversarial training.The noise parameters are adjusted through the proposed training procedure.
Results: 1.1% higher clean-test accuracy and 6.8% higher PGD under-attack accuracy are reported for PNI on Resnet-20 versus vanilla adversarial training.The introduction also reports improved robustness under FGSM, C & W, and various black-box attacks.

2 Related works

Related work covers gradient-based and optimization-based adversarial attacks, adversarial training, and randomness-based defenses. PNI differs by learning layer-specific noise levels rather than configuring them manually.

Adversarial attacks: FGSM is a single-step gradient-sign attack, while PGD is its multi-step variant and a strong L∞ adversarial example generation algorithm.PGD iteratively updates perturbed data within a projection space bounded by x ± ϵ.
Adversarial attacks: FGSM perturbations are clipped to keep adversarial examples in [0, 1], with attack strength controlled by the perturbation constraint ϵ.The perturbation follows the gradient direction of the loss with respect to the input.
Adversarial attacks: C & W formulates adversarial-example generation as minimizing perturbation norm plus a loss term subject to valid input bounds.The paper evaluates an L2-norm-based C & W attack using ||δ||p=2 as the robustness metric.
Adversarial attacks: Transferable black-box attacks use adversarial examples generated on a substitute or source model to attack a target model.The attacker trains or uses a model that mimics the target model’s functionality.
Adversarial defenses: Adversarial training, particularly with PGD, is a leading defense because it can sustain state-of-the-art accuracy under strong attacks.PGD is described as universal among first-order adversaries.
Adversarial defenses: PNI learns different noise levels at different layers, addressing the practical difficulty of manually selecting noise levels and finding that weight noise can improve robustness further.Prior methods added noise during training and inference but manually configured its level.

3 Approach

PNI injects trainable Gaussian noise into network inputs, weights, or activations, with layer-wise scaling coefficients optimized alongside adversarial training. The approach balances clean and perturbed-data losses, while addressing the tendency of unconstrained noise optimization to collapse the noise scale toward zero.

Parametric Noise Injection: PNI injects Gaussian noise into input, weight, or inter-layer tensors, scaling the noise with learnable coefficients.The injected noise uses the tensor’s standard deviation and defaults to a shared layer-wise coefficient for each parametric layer.
Optimization: Noise scaling coefficients are treated as model parameters and optimized through back-propagation.For layer-wise sharing, gradient computation sums contributions across the tensor; Gaussian noise samples remain constant during each back-propagation pass.
Optimization: Momentum-based updates optimize α without weight decay, using α = 0.25 as the default initialization.The update uses momentum m, learning rate ϵ, and velocity V; weight decay is omitted because it drives learned noise scales toward zero.
Robust Optimization: Directly optimizing the noise scale can drive α toward a small value close to zero because model optimization tends to over-fit the training dataset.The paper therefore combines PNI with robust optimization, or adversarial training, to improve accuracy on perturbed data.
Robust Optimization: Adversarial training solves a min-max problem in which inner maximization generates perturbed inputs and outer minimization updates network parameters.The default inner solver is L∞ PGD, and perturbed inputs are generated using the model’s predicted result as the label to prevent label leaking.
Robust Optimization: The ensemble loss is a weighted sum of clean-data and adversarial-data losses, with wc = wa = 0.5 as the default configuration.Optimizing this loss updates both the network parameters and PNI’s noise scaling coefficient α.

4 Experiments

Experiments evaluate PNI on CIFAR-10 across white-box and black-box attacks, noise locations, network capacities, and competing defenses. The results show that adversarially trained PNI can improve robustness, but its effectiveness depends on optimization, injection location, and attack setting.

Experiment setup: PGD and FGSM configurations follow prior setups, while C&W, transferable PGD, and ZOO attacks evaluate additional robustness dimensions.PGD uses 40 and 7 steps on MNIST and CIFAR-10 respectively; C&W uses c = 0.01.
Optimization method: Vanilla training drives layerwise noise coefficients α toward negligible values, whereas adversarial training is required to optimize PNI for defense.The optimization treats noise scaling as part of a min-max problem.
Optimization method: Keeping PNI active during adversarial-example generation and parameter updates is critical; increasing α strengthens defense but can reduce clean-image accuracy.Without PNI during example generation, α can become large and fail to converge, with α = 5.856 reported in Table 1.
PNI location: PNI is evaluated on weights, activations, inputs, and hybrid locations, with PNI-W used as the default configuration.PNI-A-a and PNI-A-b inject noise at different convolutional or fully connected tensor locations, while PNI-A-b intrinsically includes input noise.
White-box robustness: Disabling PNI at test time significantly reduces PGD and FGSM defense accuracy while leaving clean-data accuracy at the same level.This observation motivates examining whether PNI provides robustness beyond attack-strength reduction or gradient obfuscation.
Black-box and C&W evaluation: PNI improves robustness against C&W, transferable, and ZOO attacks, but activation-only PNI-A-a fails to resist ZOO attack as effectively as PNI-W and PNI-W+A-a.For C&W, average required L2 distortion is used as a robustness indicator because attack success is expected to approach 100%.

5 Discussion

The discussion argues that PNI’s robustness gains are not primarily caused by gradient obfuscation: stronger and longer attacks still degrade accuracy, yet PNI remains superior to vanilla adversarial training. The method nevertheless becomes vulnerable under unbounded distortion.

Gradient obfuscation: PNI passes the listed gradient-obfuscation inspections, including attack-strength comparisons and behavior under increasing distortion bounds.The checklist is summarized in Table 7, while the experiments compare FGSM with PGD, black-box with white-box attacks, and increasing distortion bounds.
Attack-bound behavior: Increasing the distortion bound eventually reduces PNI accuracy to 0% under unbounded attacks, showing increased resistance rather than immunity.The authors report that increasing the distortion bound raises attack success and that unbounded attacks lead to 0% accuracy under attack.
Gradient obfuscation: As PGD attack steps increase, perturbed-data accuracy degrades and then saturates at Nstep = 40 for both vanilla adversarial training and PNI.This saturation is used to assess whether stochastic gradients are responsible for PNI’s improvement.
Gradient obfuscation: PNI continues to outperform vanilla adversarial training when PGD attack steps increase to 100, indicating stochastic gradients are not the dominant source of robustness improvement.The authors explicitly attribute this conclusion to the absence of eventual PNI breakdown as attack steps increase.

6 Conclusion

The paper presents trainable parametric noise injection integrated with adversarial training. Extensive experiments report higher clean-data and perturbed-data accuracy than state-of-the-art defense methods.

6 Conclusion: PNI trains noise intensity through min-max optimization during adversarial training.The technique makes noise intensity a learned component of the adversarial-training procedure.
6 Conclusion: PNI outperforms state-of-the-art defense methods on both clean-data accuracy and perturbed-data accuracy.The conclusion reports this result across the paper’s extensive experiments.