Source-linked AI summary
Adversarial Defense by Restricting the Hidden Space of Deep Neural Networks
Aamir Mustafa, Salman Khan, Munawar Hayat, Roland Goecke, Jianbing Shen, Ling Shao
TL;DR
Adversarial perturbations exploit nearby class representations and remain difficult to defend against under strong white-box attacks. The paper separates class-wise intermediate feature polytopes with a multi-level objective, reporting robustness across black-box and white-box settings, including 46.7% on CIFAR-10 and 36.1% on CIFAR-100 against strong PGD attacks.
Problem
Adversarial perturbations can change deep-network decisions with imperceptible input changes, while conventional cross-entropy does not explicitly enforce margins between learned classification regions.
Method
The method uses multi-level supervision and a maximal-separation objective to place different classes in distinct, non-overlapping feature and decision regions.
Results
The method achieves 46.7% robustness on CIFAR-10 and 36.1% on CIFAR-100 against PGD with ϵ = 0.03, with robustness maintained across black-box and white-box attacks.
Takeaways & Limitations
The findings provide evidence that objective-function constraints on feature separation substantially influence adversarial robustness without relying on obfuscated gradients.
Abstract
from arXiv · showhide
Deep neural networks are vulnerable to adversarial attacks, which can fool them by adding minuscule perturbations to the input images. The robustness of existing defenses suffers greatly under white-box attack settings, where an adversary has full knowledge about the network and can iterate several times to find strong perturbations. We observe that the main reason for the existence of such perturbations is the close proximity of different class samples in the learned feature space. This allows model decisions to be totally changed by adding an imperceptible perturbation in the inputs. To counter this, we propose to class-wise disentangle the intermediate feature representations of deep networks. Specifically, we force the features for each class to lie inside a convex polytope that is maximally separated from the polytopes of other classes. In this manner, the network is forced to learn distinct and distant decision regions for each class. We observe that this simple constraint on the features greatly enhances the robustness of learned models, even against the strongest white-box attacks, without degrading the classification performance on clean images. We report extensive evaluations in both black-box and white-box attack scenarios and show significant gains in comparison to state-of-the art defenses.
1. Introduction
Adversarial perturbations threaten security-critical applications because imperceptible input changes can drastically alter model outputs. The paper proposes separating class representations across network depths to improve robustness.
- Adversarial examples use human-imperceptible perturbations to fool learned models, threatening autonomous cars, biometric identification, and surveillance systems.
- Existing defenses include reactive input transformations and proactive changes to network architecture or training procedures.
- The proposed proactive defense maximally separates learned feature representations at multiple depth levels of the network.
- The method separates class-specific feature polytopes and reduces overlap between classes in intermediate feature and decision spaces.
- The method achieves 46.7% robustness on CIFAR-10 and 36.1% on CIFAR-100 against PGD with ϵ = 0.03.
- The approach is evaluated across five public datasets and under strong white-box and iterative attacks, including PGD.
2. Related Work
Prior work addresses adversarial attacks through input transformations or modified training procedures. The paper positions its method as a distinct feature-space defense that adds multi-level constraints beyond conventional center-based clustering.
- Adversarial-attack research includes FGSM, iterative attacks, Deep-Fool, PGD, Carlini–Wagner, and other gradient- or saliency-based methods.
- Defenses generally preprocess inputs at inference time or modify training using approaches such as adversarial and ensemble adversarial training.
- The proposed objective and multi-level supervision discriminate classes in feature space by enhancing between-class distances and separating samples from non-true classes.
- The method differs from center loss through its multi-layered hierarchical loss and maximal-separation constraints for adversarial robustness.
3. Prototype Conformity Loss
The prototype conformity loss defines class-specific, non-overlapping feature regions and combines output-space separation with auxiliary supervision at intermediate depths. This reduces overlap between adversarial polytopes and supports robustness within bounded perturbation budgets.
- Prototype conformity loss: Adversarial polytopes for different-class samples make attacks easier when they overlap, motivating an explicit maximal-separation constraint.The conventional cross-entropy loss does not explicitly enforce margins between classification regions.
- Prototype conformity loss: A margin m > 2λ between the closest different-class samples guarantees robustness against perturbations within budget ϵ under the stated assumptions.The guarantee follows when λ bounds the distance from a polytope center to its convex outer polytope.
- Prototype conformity loss: The training objective is designed to minimize overlap between class regions so bounded input perturbations cannot move samples into viable regions of other classes.The construction treats samples outside all class-specific regions as adversarial perturbations.
- Prototype conformity loss: The method represents each class with a learned prototype and encourages its samples to lie within a fixed, non-overlapping p-norm ball.Inference assigns a feature to the closest class only when it lies within that class’s decision region.
- Prototype conformity loss: The overall loss combines cross-entropy with prototype conformity, enforcing intra-class compactness and inter-class separation in the output space.Auxiliary losses extend the same effect to intermediate representations through branches that map features to lower-dimensional outputs.
4. Adversarial Attacks
The paper evaluates several gradient-based and optimization-based adversarial attacks, including single-step, iterative, momentum, projected, and Carlini–Wagner methods. These attacks seek misclassification under a constrained perturbation budget, with iterative methods repeatedly updating the input.
- Attack methods: FGSM generates an adversarial sample by taking one gradient-sign step that maximizes the loss within perturbation budget ϵ.The update is xadv = x + ϵ · sign(∇xL(x, y)).
- Attack methods: BIM is an iterative variant of FGSM that updates the image repeatedly from the clean input, indexed by iteration number i.The method applies repeated bounded gradient updates.
- Attack methods: MIM modifies BIM with a momentum term to stabilize the gradient direction during iterative attack generation.The momentum is controlled by decay factor µ.
- Attack methods: The Carlini–Wagner attack introduces an auxiliary variable ζ and minimizes an objective whose confidence is controlled by κ.The associated logits term compares the target class against the largest non-target logit.
- Attack methods: PGD starts from a random point in the clean image neighborhood U(x, ϵ) and applies FGSM for m iterations with step size γ.It is described as a strong iterative attack relying on first-order information from the target model.
5. Experiments
The experiments evaluate the proposed defense across multiple datasets, threat models, attack strengths, and comparisons with existing defenses. Results indicate strong robustness, especially against black-box and iterative white-box attacks, while adversarial training further improves performance.
- Datasets and Models: The method is evaluated on MNIST, FMNIST, CIFAR-10, CIFAR-100, and SVHN using CNN-6 or ResNet-110 architectures.Intermediate features are extracted through auxiliary branches for prototype conformity loss.
- Threat Models and Attacks: The evaluation covers white-box and black-box attacks, including BIM, MIM, PGD, C&W, and standard perturbation sizes such as ϵ = 0.3 or ϵ = 0.03.White-box attacks use full model knowledge, while black-box samples are generated without access to the target model.
- Black-Box Robustness: On CIFAR-10, PGD-0.03 black-box attacks reduce clean accuracy from 91.89% to 88.8%, indicating negligible attack potential in that setting.The samples are generated using VGG-19 and transferred to the defended model.
- Adversarial Training: Adversarial training complements the proposed defense and enhances robustness under both black-box and white-box attack settings.The reported training uses clean and attacked samples generated with FGSM and PGD.
- Attack-Strength Analysis: Increasing the perturbation bound decreases robustness, while iterative attacks are more successful than single-step attacks.These trends are reported as evidence that the defense does not obfuscate gradients.
6. Conclusion
The paper concludes that maximal feature-space separation makes adversarial perturbations harder to exploit and preserves robustness across diverse attack settings.
- The proposed model maintains high robustness against diverse single-step and iterative attacks in both black-box and white-box settings.
- Non-overlapping adversarial polytopes across classes prevent viable perturbations within the allowed budget.
- Empirical evaluations indicate that the robustness gains are not caused by obfuscated gradients.