Source-linked AI summary
Feature Denoising for Improving Adversarial Robustness
Cihang Xie, Yuxin Wu, Laurens van der Maaten, Alan Yuille, Kaiming He
TL;DR
Adversarial perturbations can create substantial noise in convolutional-network features, motivating architectures that denoise features during adversarial training. These models improve reported white-box and black-box robustness, while feature noise remains difficult to quantify across changing architectures.
Problem
Small image perturbations can cause incorrect predictions and produce substantial, semantically irrelevant noise in convolutional-network feature maps.
Method
The paper trains convolutional architectures end-to-end on adversarial samples with feature-denoising blocks using non-local means or other filters.
Results
55.7% ImageNet accuracy is reported under 10-iteration PGD attacks versus 27.9% for prior art, with 42.6% under 2000-iteration PGD and 50.6% against 48 unknown CAAD 2018 attackers.
Takeaways & Limitations
Feature denoising improves adversarial robustness across white-box and black-box settings, and multiple filter types support it as a useful architectural design principle.
Takeaways & Limitations
Feature noise is difficult to measure quantitatively when architectures or training methods change because feature magnitudes and distributions also change.
Abstract
from arXiv · showhide
Adversarial attacks to image classification systems present challenges to convolutional networks and opportunities for understanding them. This study suggests that adversarial perturbations on images lead to noise in the features constructed by these networks. Motivated by this observation, we develop new network architectures that increase adversarial robustness by performing feature denoising. Specifically, our networks contain blocks that denoise the features using non-local means or other filters; the entire networks are trained end-to-end. When combined with adversarial training, our feature denoising networks substantially improve the state-of-the-art in adversarial robustness in both white-box and black-box attack settings. On ImageNet, under 10-iteration PGD white-box attacks where prior art has 27.9% accuracy, our method achieves 55.7%; even under extreme 2000-iteration PGD white-box attacks, our method secures 42.6% accuracy. Our method was ranked first in Competition on Adversarial Attacks and Defenses (CAAD) 2018 --- it achieved 50.6% classification accuracy on a secret, ImageNet-like test dataset against 48 unknown attackers, surpassing the runner-up approach by ~10%. Code is available at https://github.com/facebookresearch/ImageNet-Adversarial-Training.
1. Introduction
Adversarial perturbations that are small in pixel space can create substantial, semantically irrelevant feature-map noise. The paper responds with end-to-end-trained feature-denoising architectures and reports strong white-box and black-box robustness.
- Small pixel-space perturbations produce substantial noise in feature maps, activating regions unrelated to semantically informative image content.
- End-to-end-trained convolutional architectures use feature-denoising blocks to reduce feature-map perturbations on adversarially generated samples.
- Non-local means gives the best reported performance, while mean, median, and bilateral filters also improve adversarial robustness.
- 55.7% classification accuracy is reported on ImageNet under 10-iteration PGD attacks, compared with 27.9% for prior art using the same protocol.
- 42.6% accuracy is achieved under 2000-iteration PGD attacks, while 50.6% accuracy is achieved against 48 unknown attackers in CAAD 2018.
2. Related Work
Prior defenses include adversarial training, logit pairing, pixel denoising, and image preprocessing. The paper distinguishes its approach by applying denoising directly to learned features and by targeting defenses that remain effective against white-box attacks.
- Adversarial training generates adversarial images during training and represents the state-of-the-art defense against white-box attacks.
- Adversarial logit pairing encourages clean and adversarial predictions to be similar, treating clean logits as a noise-free reference.
- The paper applies denoising directly to features, contrasting with pixel denoising guided by high-level features.
- Non-differentiable image preprocessing can be circumvented in white-box settings when attackers approximate its gradients.
3. Feature Noise
The paper interprets adversarial examples as producing unconstrained feature-level perturbations that resemble noise and alter model responses. It introduces denoising blocks to suppress these activations, while noting that feature noise is difficult to quantify across changing architectures.
- Although adversarial perturbations are constrained by pixel-level norms, convolutional networks impose no corresponding constraint at the feature level.
- Feature maps from adversarial images show activations in regions without relevant visual content, which the paper associates with altered predictions.
- Feature denoising operations suppress much of this feature-map noise and make responses focus on visually meaningful content.
- Quantitatively measuring feature noise is difficult because changing architecture or training alters feature magnitudes and distributions.
- A denoising block wraps operations such as non-local means or other filters with a 1×1 convolution and an identity skip connection.
4. Denoising Feature Maps
The paper inserts learned denoising blocks into intermediate convolutional features, using operations such as non-local means and local filters within residual architectures. These blocks are trained end-to-end to balance noise suppression with signal retention.
- Denoising Block: Denoising blocks process intermediate feature layers, transform the denoised representation with a 1×1 convolution, and add it back through a residual connection.The residual path and learned 1×1 convolution help preserve useful signals while adjusting the denoising tradeoff.
- Denoising Operations: The study evaluates four denoising-operation instantiations within its denoising blocks.The operations include non-local means and simpler local filtering alternatives.
- Denoising Operations: Non-local means computes each denoised feature from a feature-dependent weighted mean over all spatial locations.The weighting function depends on the input features, while a normalization function scales the result.
- Denoising Operations: Gaussian non-local means uses embedded features and normalized weights equivalent to softmax-based self-attention.The embeddings are produced by 1×1 convolutions, and the softmax interpretation follows the non-local formulation.
- Denoising Operations: Dot-product non-local means uses f(x_i, x_j) = x_i^T x_j and C(x) = N, requiring no extra parameters in its denoising operation.Unlike the Gaussian version, embedding x is unnecessary for the dot-product version, which nevertheless improves adversarial robustness.
- Denoising Operations: Mean, median, and bilateral filters are also evaluated, and experiments show that mean and median denoising blocks improve adversarial robustness.Mean filtering reduces noise but smooths structures, while median filtering operates over a local region separately for each channel.
5. Adversarial Training
Adversarial training generates perturbed images during training and updates networks using those examples. The implementation uses PGD attacks, adversarial-only minibatches, and distributed synchronized SGD to manage the resulting computational cost.
- Adversarial Training: Adversarial training updates networks using adversarially perturbed images generated from the current model parameters.PGD is used as the white-box attacker during training.
- PGD Attacker: PGD iteratively updates image pixels using loss gradients and projects each result into an L∞-bounded region around the clean image.The maximum per-pixel perturbation is constrained by ϵ.
- Distributed Training: Each minibatch is first attacked with PGD, after which one SGD update is performed using only the perturbed images.Clean images are not included in the minibatch used for the weight update.
- Distributed Training: With n = 30 PGD steps preceding each update, adversarial training costs approximately n× more computation than standard clean training.The models use synchronized SGD on 128 GPUs, with a total minibatch size of 4096 images.
6. Experiments
Experiments show that feature denoising consistently improves adversarial robustness under challenging white-box and black-box attacks, while offering little clean-image benefit on deep networks.
- Against White-box Attacks: 55.7% accuracy under 10-iteration PGD attacks improves ResNet-152’s 52.5% baseline by 3.2%.The comparison uses four non-local Gaussian denoising blocks.
- Against White-box Attacks: PGD is reported as the strongest white-box attacker among PGD, FGSM, iterative FGSM, and momentum iterative FGSM evaluations.
- Against White-box Attacks: 42.6% accuracy under 2000-iteration PGD attacks exceeds the ResNet-152 baseline by 3.4%.The baseline achieves 39.2% under the same attack.
- Against White-box Attacks: All evaluated denoising operations outperform ResNet-152, added bottleneck blocks, and null denoising blocks in white-box ablations.The matched-parameter null version performs worse, indicating that parameter count alone does not explain the gains.
- Against White-box Attacks: Removing the 1×1 convolution reduces accuracy from 45.5% to 36.8% under 100-iteration PGD attacks, while removing the residual connection makes training unstable.The results support combining denoised features with input features.
- Against Black-Box Attacks: 46.4% accuracy with four non-local denoising blocks improves the 43.1% ResNet-152 baseline against five black-box attackers.Local filters reach 43.6%–44.4% and are not convincingly better than the null version.
- Against Black-Box Attacks: 50.6% accuracy against 48 unknown attackers wins CAAD 2018 by about 10% absolute over the runner-up’s 40.8%.The challenge uses a secret ImageNet-like dataset and an all-or-nothing criterion.
7. Conclusion
The study demonstrates feature denoising as a promising architecture principle for adversarial robustness, especially when combined with adversarial training, despite limited clean-accuracy gains.
- Feature denoising improves adversarial robustness even when denoising architectures do not improve clean-training and clean-testing accuracy.