PaperlayerView exact revision on arXiv

Source-linked AI summary

ComDefend: An Efficient Image Compression Model to Defend Adversarial Examples

Xiaojun Jia, Xingxing Wei, Xiaochun Cao, Hassan Foroosh

arXiv:1811.12673v3cs.CV

TL;DR

Deep neural networks are vulnerable to imperceptible adversarial perturbations that can fool classifiers. ComDefend preprocesses inputs with jointly learned compression and reconstruction CNNs, and experiments across multiple datasets and attacks report stronger defense performance than state-of-the-art methods. The approach leaves the classifier architecture unchanged while suppressing perturbations through image compression and reconstruction.

  • Problem

    Imperceptible perturbations can fool deep neural networks, creating a need for defenses that protect classifiers against adversarial attacks.

  • Method

    ComDefend jointly learns ComCNN and RecCNN to compress adversarial images, preserve structure, reconstruct clean images, and preprocess them before classification without modifying the deployed classifier.

  • Results

    ComDefend outperforms state-of-the-art defense methods and improves resilience across strong attacks, with reported CIFAR-10 accuracy increases from 35% to 83% for FGSM, 0% to 31% for BIM, 1% to 89% for DeepFool, and 0% to 87% for C&W.

  • Takeaways & Limitations

    ComDefend provides a preprocessing defense that can be used at test time or during training and test time while keeping the classifier unchanged.

Abstract

from arXiv · show

Deep neural networks (DNNs) have been demonstrated to be vulnerable to adversarial examples. Specifically, adding imperceptible perturbations to clean images can fool the well trained deep neural networks. In this paper, we propose an end-to-end image compression model to defend adversarial examples: \textbf{ComDefend}. The proposed model consists of a compression convolutional neural network (ComCNN) and a reconstruction convolutional neural network (ResCNN). The ComCNN is used to maintain the structure information of the original image and purify adversarial perturbations. And the ResCNN is used to reconstruct the original image with high quality. In other words, ComDefend can transform the adversarial image to its clean version, which is then fed to the trained classifier. Our method is a pre-processing module, and does not modify the classifier's structure during the whole process. Therefore, it can be combined with other model-specific defense models to jointly improve the classifier's robustness. A series of experiments conducted on MNIST, CIFAR10 and ImageNet show that the proposed method outperforms the state-of-the-art defense methods, and is consistently effective to protect classifiers against adversarial attacks.

1. Introduction

Adversarial perturbations can be imperceptible yet cause confident misclassification, motivating a preprocessing defense based on image compression. ComDefend combines compression and reconstruction CNNs to suppress perturbations while preserving and reconstructing image content.

  • Motivation: Imperceptible perturbations can cause deep networks to make incorrect, high-confidence predictions and create security concerns in real-world applications.
  • Existing defenses: Preprocessing defenses avoid retraining the classifier, but HGD requires many adversarial training images and PixelDefend can struggle when the image space is too large.
  • Proposed approach: ComDefend uses image compression to remove redundant information or disrupt adversarial perturbation structure while retaining dominant image information.
  • Proposed approach: ComCNN transforms images into compact representations, while RecCNN reconstructs the original image with high quality in a unified end-to-end framework trained on clean images.
  • Contributions: ComDefend is an end-to-end defense whose deployed classifier remains unchanged, enabling it to serve as a preprocessing module.
  • Contributions: The method jointly learns ComCNN and RecCNN weights, and Gaussian noise in the compact representation improves reconstruction quality and defense performance.
  • Results: ComDefend improves resilience across strong attacks and defeats state-of-the-art defense models, including the winner of the NIPS 2017 adversarial challenge.

2. Related work

Related work covers methods for generating adversarial examples and methods for defending against them. Attacks include gradient-based, iterative, geometric, and optimization-based approaches, while defenses modify training or preprocess inputs.

  • Scope: Related work is organized around adversarial-example attack methods and defensive methods that resist those attacks.
  • Attack methods: FGSM adds increments in the loss-gradient direction, while BIM extends FGSM through multiple iterative steps and is also called PGD.
  • Attack methods: DeepFool uses iterative classifier linearization and geometric formulas, whereas C&W optimizes for the smallest perturbations that cause targeted misclassification.
  • Defensive methods: Adversarial training adds generated adversarial images to the training set, while label smoothing replaces one-hot labels with soft targets.
  • Defensive methods: The cited defense literature includes training-data and feature-squeezing approaches, with one cited denoising method trained on 210k clean and adversarial images.

3. End-to-end image compression model

ComDefend compresses images into compact representations and reconstructs them to remove adversarial perturbations while preserving structure. Its jointly trained CNNs use Gaussian-noise training to improve binary-map reconstruction.

  • End-to-end design: ComDefend transforms adversarial inputs through compression and reconstruction to remove perturbations while preserving dominant image structure.The ComCNN extracts structural information and removes redundancy; the RecCNN reconstructs the image with fewer perturbations.
  • Network structure: ComDefend contains a 9-layer ComCNN and a 9-layer RecCNN connected in an end-to-end compression-reconstruction framework.The ComCNN produces a 12-bits pixel representation, while the RecCNN reconstructs the original image from that compact representation.
  • Learning algorithm: Gaussian noise restores binarized-map reconstruction quality to the level achieved with un-binarized maps.Figure 3 compares original images, compressed 12bits maps, and reconstructed images across the three settings.
  • Learning algorithm: The unified loss simultaneously updates ComCNN and RecCNN parameters to reconstruct clean images and resist noise attacks.The objective combines reconstruction error with a ComCNN compression penalty, and training is performed on clean images.
  • Noise-resistant representation: The sigmoid output uses gray levels rather than binary values, and binarization can lose structure information needed for reconstruction.The model therefore trains with random Gaussian noise so the compressed representation learns to use binary information more robustly.

4. Experimental results and analysis

The evaluation covers adversarial-example generation, hyperparameter selection, classification, comparisons with defensive methods, and performance analysis. The authors report strong performance against state-of-the-art attacks.

  • The experiments evaluate adversarial-example generation, neural-network hyperparameters, image classification, defense comparisons, and performance analysis.
  • The proposed method is reported to perform significantly well against state-of-the-art adversarial attacks.

4.1. Datasets for training and testing

ComDefend is trained on 50,000 clean CIFAR-10 images and evaluated on test images from CIFAR-10, Fashion-MNIST, and ImageNet, alongside ResNet classifiers.

  • ComDefend training uses 50,000 clean, unperturbed CIFAR-10 images.
  • Testing uses 10,000 CIFAR-10 images, 10,000 Fashion-MNIST images, and 1,000 random ImageNet images.
  • ResNet classifiers are trained on CIFAR-10, Fashion-MNIST, and ImageNet for evaluation.

4.2. Adversarial examples

The paper characterizes adversarial examples using L0, L2, and L∞ distances, which quantify differing aspects of perturbation magnitude.

  • L0 counts the pixels differing between a clean image and its adversarial example.
  • L2 measures the Euclidean distance between the clean image and adversarial example.
  • L∞ measures the maximum perturbation value in an adversarial example.

4.3. Selection of hyper parameters

The method selects Gaussian-noise and penalty parameters by measuring classifier accuracy, with performance varying non-monotonically across parameter values.

  • Gaussian noise parameter ϕ and penalty parameter λ are selected through experiments using image-classification accuracy.The selection accounts for information discarded by compression.
  • Classifier accuracy first increases and then decreases as ϕ increases when λ is fixed.For λ = 0.0001, accuracy increases across ϕ = 1.0 ∼20.0 and decreases across ϕ = 20.0 ∼50.0.
  • When ϕ is fixed, classifier accuracy first increases and then decreases as λ decreases.
  • The selected parameters are λ = 0.0001 and ϕ = 20.0, which obtain the best classifier performance.

4.4. Image classification with the proposed method

The proposed method compresses and reconstructs images before classification, improving ResNet-50 accuracy against several attacks at test time and during both training and testing.

  • Image classification with the proposed method: The method can be applied either only at test time or during both classifier training and testing.
  • Image compression at test time: At test time on CIFAR-10, accuracy rises from 35% to 83% for FGSM, 0% to 31% for BIM, 1% to 89% for DeepFool, and 0% to 87% for C&W.
  • Comparisons with other defensive methods: During training and testing, the method achieves nearly 90% accuracy against FGSM, DeepFool, and C&W on CIFAR-10.
  • Comparisons with other defensive methods: The method improves performance against FGSM, DeepFool, and C&W on Fashion-MNIST and ImageNet.
  • Comparisons with other defensive methods: Processing one ImageNet image takes 1.2 seconds with the proposed method versus 2.7 seconds for HGD.
  • Comparisons with other defensive methods: The method uses a smaller training dataset and less training time than HGD, and can be combined with other defensive methods.

4.5. Analysis for the proposed method

ComDefend encodes inputs into a compact representation intended to preserve clean-image information while suppressing adversarial perturbations. Its compressed space is described as reducing the likelihood of adversarial examples.

  • ComCNN encodes the input image into a compact representation where imperceptible perturbations do not affect the representation.The clean and adversarial images are intended to produce the same output representation during encoding.
  • The compressed space contains 32×32×24 ×24 ×24 images, making the classifier’s simulated image distribution easier to model.
  • The method reduces the gap between the classifier’s decision surface and the real sample-data surface, lowering the probability of adversarial examples.

5. Conclusion

ComDefend is an end-to-end image-compression defense that operates at test time or during both training and testing. It improves robustness across several attacks, including FGSM, DeepFool, C&W, and BIM, while processing images patch by patch.

  • ComDefend defends at test time by destroying the structure of adversarial perturbations in the input image.
  • During training and testing, ComDefend compresses the image space to reduce the search space available for constructing adversarial examples.
  • ComDefend achieves higher accuracy than state-of-the-art defenses against FGSM, DeepFool, and C&W attacks, while also improving performance against BIM.
  • Patch-by-patch processing takes less time than handling the entire input image at once.
Loading 1811.12673v3…