PaperlayerView exact revision on arXiv

Source-linked AI summary

ME-Net: Towards Effective Adversarial Robustness with Matrix Estimation

Yuzhe Yang, Guo Zhang, Dina Katabi, Zhi Xu

arXiv:1905.11971v1cs.LGcs.CVstat.ML

TL;DR

Neural networks remain vulnerable to adversarial attacks while defenses often lag behind. ME-Net randomly masks image pixels and reconstructs them with matrix estimation to suppress adversarial structure while preserving global structure. Across several benchmarks, it improves robustness against both black-box and white-box attacks and can also improve clean-image generalization.

  • Problem

    Existing methods can readily craft successful adversarial examples, whereas defense techniques have lagged and often fail under strong attacks.

  • Method

    ME-Net randomly masks image pixels and applies matrix estimation to reconstruct denoised representations that preserve underlying global image structure.

  • Results

    ME-Net consistently improves state-of-the-art robustness across CIFAR-10, MNIST, SVHN, and Tiny-ImageNet under black-box and white-box attacks.

  • Takeaways & Limitations

    ME-Net can be combined with standard or adversarial training, embedded into existing networks, and provide additional clean-image generalization benefits.

Abstract

from arXiv · show

Deep neural networks are vulnerable to adversarial attacks. The literature is rich with algorithms that can easily craft successful adversarial examples. In contrast, the performance of defense techniques still lags behind. This paper proposes ME-Net, a defense method that leverages matrix estimation (ME). In ME-Net, images are preprocessed using two steps: first pixels are randomly dropped from the image; then, the image is reconstructed using ME. We show that this process destroys the adversarial structure of the noise, while re-enforcing the global structure in the original image. Since humans typically rely on such global structures in classifying images, the process makes the network mode compatible with human perception. We conduct comprehensive experiments on prevailing benchmarks such as MNIST, CIFAR-10, SVHN, and Tiny-ImageNet. Comparing ME-Net with state-of-the-art defense mechanisms shows that ME-Net consistently outperforms prior techniques, improving robustness against both black-box and white-box attacks.

1. Introduction

ME-Net addresses the gap between readily available adversarial attacks and weaker defenses by combining random pixel masking with matrix-estimation reconstruction. The resulting pipeline preserves image-level structure, works with standard or adversarial training, and improves robustness across several benchmarks.

  • Adversarial examples exploit small, human-indistinguishable perturbations to cause high-confidence misclassification, creating safety concerns for deployed neural networks.
  • Defense methods have lagged behind attack algorithms, with prior defenses often failing under strong attacks.On CIFAR-10, one state-of-the-art defense achieved less than 50% adversarial accuracy, while recent strong attacks reduced many defenses to nearly 0%.
  • ME-Net randomly masks pixels and reconstructs the masked image with matrix estimation to remove crafted structure while preserving global image structure.The reconstruction treats masked adversarial images as noisy, incomplete observations of clean images.
  • ME-Net can be combined with standard SGD or adversarial training, and both combinations improve adversarial robustness.This differs from preprocessing methods that cannot exploit adversarial training and fail under strong white-box attacks.
  • ME-Net improves robustness under black-box and white-box ℓ∞ attacks across CIFAR-10, MNIST, SVHN, and Tiny-ImageNet.Adversarially trained ME-Net outperforms state-of-the-art defenses on white-box attacks, including attacks designed to counter gradient obfuscation.
  • ME-Net also improves performance on clean images and can be embedded into existing networks.The paper reports these additional benefits alongside its robustness results.

2. ME-Net

ME-Net uses random masking followed by matrix-estimation reconstruction to suppress adversarial structure while recovering global image structure. Its design is supported by the low-rank character of benchmark images and uses reconstructed images during training and inference.

  • 2.1. Design Motivation: The method models an image as intrinsic scene structure, adversarial structured noise, and non-adversarial noise.Random masking disrupts crafted structure but also damages image content, motivating a reconstruction step.
  • 2.1. Design Motivation: Matrix estimation recovers matrices from noisy, incomplete observations when the underlying data has global structure such as low rank.ME therefore serves as the reconstruction oracle for masked images.
  • 2.2. Matrix Estimation Pipeline: Images in MNIST, CIFAR-10, and SVHN mostly have approximate rank below 5, while Tiny-ImageNet images have rank around 10 versus dimension 64.Approximate rank is the minimum number of singular values capturing at least 90% of image energy.
  • 2.2. Matrix Estimation Pipeline: Matrix-estimation reconstruction preserves the global structure of an image even when the probability of observing each true pixel is as low as 0.3.The paper uses this preservation to motivate retaining human-recognizable structure while weakening adversarial structure.
  • 2.3. Model: During training, ME-Net applies n masks with different probabilities, reconstructs each masked image with ME, and trains on the reconstructed images.Training can use either standard SGD or adversarial training.
  • 2.3. Model: During inference, ME-Net masks each test image using the average training probability, reconstructs it with the same ME algorithm, and predicts from the reconstruction.The RGB channels are concatenated into one matrix in this paper.

3. Evaluation

ME-Net is evaluated against black-box and white-box attacks across multiple datasets and training procedures. Results indicate improved robustness, class separation, and clean-data generalization, while matrix-estimation choices trade computational cost against performance.

  • Evaluation setup: ME-Net is evaluated under ℓ∞-bounded attacks, using black-box and white-box settings across MNIST, CIFAR-10, SVHN, and Tiny-ImageNet.The study includes standard SGD and adversarial-training variants, with transfer-based, PGD, CW, FGSM, and BPDA attacks.
  • Black-box Attacks: Without adversarial training, ME-Net improves CIFAR-10 black-box accuracy by 13% to 25% over prior defenses, depending on the attack.The comparison uses transfer-based attacks against state-of-the-art adversarial-training and preprocessing defenses.
  • Black-box Attacks: ME-Net preserves class separation under black-box attacks, reducing within-class distances and improving between-class separation on clean and adversarial data.These effects are reported from both 2D feature projections and empirical CDFs of intra-class and inter-class distances.
  • White-box Attacks: With adversarial training, ME-Net achieves 52.8% accuracy with ResNet and 55.1% with WideResNet under strong white-box attacks.The method outperforms the cited state-of-the-art defense, while another preprocessing-plus-adversarial-training method fails against the strong adversary.
  • Evaluation with Different Datasets: Across datasets, adversarial-training gains are comparable on MNIST, about 8% on CIFAR-10 and Tiny-ImageNet, and 23% on SVHN.The paper relates these differences to dataset properties, including image rank and complexity.
  • Comparison of Different ME Methods: All three evaluated matrix-estimation methods improve standard generalization with nearly identical test accuracy, but nuclear-norm minimization is more computationally expensive than USVT.Soft-Impute reduces the process but still requires computational resources, whereas USVT is simpler and faster; more complex methods may perform slightly better.

4. Related Work

Prior work established strong attack methods but defenses remained fragile, especially against strong white-box attacks. Related defenses include adversarial training, preprocessing transformations, and matrix estimation.

  • Adversarial Training: Adversarial training improves robustness by training models on adversarial examples, but it can overfit and require substantially more data for generalization.
  • Preprocessing: Many preprocessing defenses transform images before classification, but BPDA attacks can reduce their accuracy to near zero.
  • Preprocessing: ME-Net is presented as a preprocessing method that remains effective under strong BPDA attacks by leveraging adversarial training.
  • Matrix Estimation: Matrix estimation recovers data matrices from noisy and incomplete observations, with theoretical guarantees under global structural assumptions such as low rank.

5. Conclusion

The paper concludes that ME-Net improves adversarial robustness across benchmark datasets and attack settings, while remaining easy to integrate into existing networks.

  • ME-Net consistently improves state-of-the-art robustness across benchmark datasets under strong black-box and white-box attacks.
  • ME-Net can be embedded into existing networks and may also improve standard generalization.

Supplementary Material

ME-Net training generates reconstructed images from multiple random masks and trains a network on them; inference reconstructs a masked test image before prediction.

  • ME-Net Training: For each training image, the procedure samples multiple masks, reconstructs the masked images with ME, and adds the reconstructions to a new training set.
  • ME-Net Training: The reconstructed training images are used in mini-batch network updates after randomly initializing the network.
  • ME-Net Inference: At inference, the procedure samples a mask, reconstructs the masked test image with ME, and feeds the reconstruction to the trained network for prediction.

B. Training Details

The supplementary material details ME-Net’s preprocessing choices, mask generation, training settings, and evaluations against black-box and white-box attacks on CIFAR-10.

  • B. Training Details: Training uses standard augmentation with padding, random cropping, horizontal flips, and normalization to [0, 1].
  • B. Training Details: ME-Net concatenates RGB channels into one wide matrix, applies a shared mask, and reconstructs the whole matrix with matrix estimation.
  • B. Training Details: The mask-generation scheme usually selects 10 masks with observing probabilities evenly spaced across a specified range, though better image-specific schemes may improve results.
  • C.1. Black-box Attacks: The experiments evaluate ME-Net against transfer-, decision-, and score-based black-box attacks, including a stronger setting where the adversary knows the trained network architecture and weights.
  • C.2. White-box Attacks: Under white-box evaluation, pure ME-Net is tested against strong PGD and BPDA attacks across attack steps and perturbation settings, and is reported as effective against the strongest white-box attacks.

C.2.2. COMBINING WITH ADVERSARIAL TRAINING

ME-Net remains compatible with adversarial training and consistently outperforms the state-of-the-art baseline under strong white-box attacks, while also being evaluated against stronger black-box settings.

  • C.2.2. COMBINING WITH ADVERSARIAL TRAINING: ME-Net achieves consistently better results than current state-of-the-art defenses under strongest white-box attacks when combined with adversarial training.The evaluation applies up to 1000-step PGD or BPDA attacks and compares with Madry et al. (2017).
  • C.2.2. COMBINING WITH ADVERSARIAL TRAINING: The CIFAR-10 white-box evaluation includes attacks that target the preprocessing pipeline using up to 1000 PGD or BPDA steps.The table caption distinguishes white-box attacks that do not attack the preprocessing layer, while the extensive evaluation includes BPDA attacks.
  • C.2.2. COMBINING WITH ADVERSARIAL TRAINING: On MNIST, ME-Net maintains high robustness when the black-box adversary receives the trained model architecture and weights.The stronger black-box setting is reported separately from the standard extensive black-box evaluation.
  • C.2.2. COMBINING WITH ADVERSARIAL TRAINING: MNIST black-box experiments use transfer-, decision-, and score-based attacks, with additional tests where the adversary has access to the trained network.The extensive black-box results and the stronger-access setting are reported in Tables 14 and 15.
  • C.2.2. COMBINING WITH ADVERSARIAL TRAINING: The MNIST white-box experiments report both pure ME-Net and ME-Net combined with adversarial training under up to 1000-step PGD or BPDA attacks.The comparison uses released models from Madry et al. (2017) with attack steps increased to 1000.

E.1. Black-box Attacks

Across MNIST, SVHN, and Tiny-ImageNet evaluations, ME-Net shows robustness under strong black-box and white-box attack settings, including adversaries with additional model access.

  • E.1. Black-box Attacks: ME-Net provides significant adversarial robustness against transfer-, decision-, and score-based black-box attacks on SVHN.The evaluation uses ResNet-18 and compares ME-Net with a vanilla model using the same network and training process.
  • E.1. Black-box Attacks: ME-Net maintains high robustness on SVHN when the black-box adversary receives the network architecture and trained weights.This setting strengthens the black-box adversary beyond ordinary query-based access.
  • E.1. Black-box Attacks: ME-Net consistently outperforms the Madry et al. baseline under strongest white-box attacks on SVHN.The evaluation applies up to 1000 attack steps and reports both pure and adversarially trained ME-Net.
  • E.1. Black-box Attacks: On Tiny-ImageNet, black-box evaluations include standard attacks and a setting where the adversary has limited access to ME-Net.The black-box results report Top-1 adversarial accuracy.
  • E.1. Black-box Attacks: Tiny-ImageNet white-box results show consistent ME-Net gains over Madry et al. in both Top-1 and Top-5 adversarial accuracy.The comparison uses up to 1000-step PGD or BPDA attacks with matched training procedures.

G. Trade-off between Adversarial Robustness and Standard Generalization

ME-Net exhibits an inherent trade-off between adversarial robustness and standard generalization: lowering the mask observation probability increases robustness but reduces clean-data performance across datasets.

  • G. Trade-off between Adversarial Robustness and Standard Generalization: Higher observation probability preserves more image details and can make generalization resemble or exceed that of the vanilla network, but leaves more adversarial structure intact.The recovered images become more similar to the originals as observation probability increases.
  • G. Trade-off between Adversarial Robustness and Standard Generalization: Lower observation probability eliminates more adversarial structure but makes image reconstruction harder and clean inputs less similar to the originals.The paper identifies this as the mechanism behind reduced clean-data generalization at lower observation probabilities.
  • G. Trade-off between Adversarial Robustness and Standard Generalization: Lowering the mask observation probability reduces generalization while rapidly increasing adversarial robustness across datasets.The trade-off is measured using 7-step white-box BPDA attacks on models trained with different observation probabilities.
  • G. Trade-off between Adversarial Robustness and Standard Generalization: Different matrix-estimation methods are evaluated on CIFAR-10 under both black-box and white-box attacks.The methods include USVT, Soft-Impute, and Nuclear Norm minimization, with identical training processes.
  • G. Trade-off between Adversarial Robustness and Standard Generalization: All three evaluated ME-Net variants outperform Madry et al. under strong white-box attacks while achieving higher generalization on CIFAR-10.The comparison uses adversarially trained models and up to 1000-step PGD or BPDA attacks.

I. Additional Studies of Attack Parameters

Additional studies examine attack parameters, majority-vote inference, image recovery, and the number of masks, showing that robustness depends on evaluation and inference choices.

  • I. Additional Studies of Attack Parameters: Smaller attack step sizes strengthen the adversary for both ME-Net and Madry et al., because they enable finer perturbation searches.The study reports this behavior across different step sizes in CIFAR-10 white-box attacks.
  • I. Additional Studies of Attack Parameters: More random restarts can reduce ME-Net robust accuracy by a few percent, although ME-Net still outperforms Madry et al. across tested parameters.The authors use a hard success criterion and note that matching restarts during training would add overhead.
  • I. Additional Studies of Attack Parameters: Majority voting over multiple masks consistently improves adversarial robustness over standard single-mask inference.The approach applies masks with the training observation probability and aggregates predicted labels.
  • I. Additional Studies of Attack Parameters: Matrix estimation recovers global image structure even when the observation probability is small.The visualization compares masked images with their ME-reconstructed versions.
  • I. Additional Studies of Attack Parameters: Using more masked images per input improves performance in the reported CIFAR-10 study.The evaluation measures both standard generalization and adversarial robustness with transfer-based black-box and BPDA white-box attacks.

L. Additional Visualization Results

On Tiny-ImageNet, visualizations show that ME-Net redistributes adversarial noise toward the image’s global structure, which is described as aligned with human perception. In contrast, vanilla-model noise spreads across the image and contains human-imperceptible structure.

  • Vanilla-model adversarial noise spreads across the entire image and contains human-imperceptible adversarial structure.
  • ME-Net’s reconstructed images redistribute adversarial noise toward the images’ global structure, aligning it with human perception.The visualization compares reconstructed clean and adversarial examples with their redistributed noise.
  • The visualization examines clean images, PGD-generated adversarial examples, and their differences before and after ME-Net reconstruction.Tiny-ImageNet is used because its images have higher resolution.
Loading 1905.11971v1…