Source-linked AI summary
Defense Against Adversarial Attacks Using Feature Scattering-based Adversarial Training
Haichao Zhang, Jianyu Wang
TL;DR
Adversarial training must improve robustness without relying on supervised attack generation that can suffer from label leaking. This paper uses unsupervised feature scattering to generate collaboratively perturbed images through inter-sample relationships, and reports effectiveness across benchmark datasets and attacks.
Problem
Existing adversarial training commonly uses supervised attack generation, but label leaking remains a documented challenge.
Method
The method generates adversarial training images through unsupervised feature scattering that couples samples and uses inter-sample relationships.
Results
The proposed approach outperforms competing methods on reported CIFAR10, SVHN, and CIFAR100 robustness evaluations and ablation studies.
Takeaways & Limitations
Feature scattering provides a collaborative adversarial-training approach that leverages inter-sample relationships and induces coupled regularization.
Abstract
from arXiv · showhide
We introduce a feature scattering-based adversarial training approach for improving model robustness against adversarial attacks. Conventional adversarial training approaches leverage a supervised scheme (either targeted or non-targeted) in generating attacks for training, which typically suffer from issues such as label leaking as noted in recent works. Differently, the proposed approach generates adversarial images for training through feature scattering in the latent space, which is unsupervised in nature and avoids label leaking. More importantly, this new approach generates perturbed images in a collaborative fashion, taking the inter-sample relationships into consideration. We conduct analysis on model robustness and demonstrate the effectiveness of the proposed approach through extensively experiments on different datasets compared with state-of-the-art approaches.
1 Introduction
Adversarial examples can fool deep models while remaining visually indistinguishable, and conventional adversarial training still faces label leaking and manifold-structure concerns. The paper responds by shifting attack generation from decision boundaries toward inter-sample structure through unsupervised, collaborative feature scattering.
- Adversarial examples are modified inputs that remain visually indistinguishable from natural images but cause different classifier predictions.
- Adversarial training improves robustness by training on perturbed images, but label leaking remains a challenge in existing approaches.
- Natural images lie on a low-dimensional manifold, whereas classifier behavior beyond that manifold is less constrained and can expose adversarial vulnerabilities.
- The proposed method shifts attention from the decision boundary to inter-sample structure, perturbing local neighborhoods in an unsupervised fashion.
- The paper proposes collaborative, unsupervised feature scattering, a bilevel adversarial-training formulation, and extensive benchmark evaluation.
2 Background
Adversarial training generates attacks through an inner maximization and minimizes the resulting adversarial loss, but label leaking and gradient masking can undermine its reliability. Feature scattering instead generates perturbations collectively by maximizing feature-matching distance between clean and perturbed samples.
- Adversarial training: Adversarial training alternates attack generation through inner maximization with outer minimization of the induced adversarial loss.The inner problem can be approximated using FGSM or multi-step PGD.
- Adversarial training: PGD randomly initializes x within the ε-cube B(x, ε), then applies several projected-gradient steps using step size α.The projection operator maps inputs back into the feasible region S_x.
- Adversarial-training limitations: Label leaking occurs when perturbations correlate with ground-truth labels, allowing networks to decode class information from perturbations rather than image content.This can produce higher adversarial accuracy than clean-image accuracy during training.
- Feature scattering: Feature scattering generates adversarial perturbations collectively by maximizing feature-matching distance between clean samples {x_i} and perturbed samples {x′_j}.The pipeline updates model parameters by minimizing cross-entropy on the perturbed images.
- Adversarial-training limitations: Gradient masking can create an appearance of robustness by producing less useful attack gradients, which substitute models may bypass.The passage characterizes this as a false sense of robustness.
- Distributional distances: Distances between point sets can be measured through accumulated pairwise distances or divergences between their empirical distributions, including KL and Jensen-Shannon divergence.Optimal transport instead measures minimum transport cost between distributions and is suited to data on low-dimensional manifolds such as natural-image embeddings.
3 Feature Scattering-based Adversarial Training
Feature scattering generates adversarial examples by maximizing feature-matching distance between clean and perturbed empirical distributions while respecting domain constraints. Used in adversarial training, it couples samples through inter-sample relationships, promotes diversity, and avoids incorporating labels into the feature-matching objective.
- 3.1 Feature Matching and Feature Scattering: Unlike sample-wise adversarial generation, feature scattering computes perturbations collaboratively by coupling feature points within a batch.This uses inter-sample structure rather than only the direction from an individual sample to the decision boundary.
- 3.1 Feature Matching and Feature Scattering: Feature matching uses optimal transport to measure distance between empirical distributions of clean and perturbed image features.The transport cost is defined as cosine distance between features extracted by the network up to its softmax layer.
- 3.1 Feature Matching and Feature Scattering: Feature scattering produces a perturbed empirical distribution by maximizing feature-matching distance subject to domain and perturbation-budget constraints.The perturbations are applied within ℓ∞-cubes around the clean inputs.
- 3.2 Adversarial Training with Feature Scattering: Feature scattering-based adversarial training alternates feature-scattering attack updates with model-parameter updates over random batches.The procedure uses a perturbation budget ϵ, attack iterations T, batch size n, learning rate γ, and training epochs K.
- 3.2 Adversarial Training with Feature Scattering: The resulting objective contains a coupled regularization term over all inputs, and its feature-based distance excludes label information, avoiding potential label leaking.When the distance becomes separable and supervised, the formulation reduces to conventional adversarial training.
4 Discussions
The discussion positions the method as a distinct use of manifold and inter-sample structure for adversarial defense. It contrasts feature scattering with projection-based defenses and other regularization methods that impose relationships around training examples or between predictions.
- Manifold-based Defense: Unlike manifold-projection defenses, feature scattering uses inter-sample relationships to generate perturbations and induces implicit model regularization.The manifold is leveraged through relationships among samples rather than by projecting perturbed images onto a proper manifold.
- Inter-sample Regularization: Feature scattering differs from Mixup, logit pairing, and virtual adversarial training by using inter-sample relationships to generate perturbations and coupling the induced regularization across inputs.The compared methods respectively use interpolation, clean-versus-adversarial logit differences, or prediction-probability KL divergence as regularization mechanisms.
5 Experiments
Experiments across CIFAR10, SVHN, and CIFAR100 evaluate robustness under white-box and black-box attacks, together with ablations of feature scattering, matching, and OT solvers. The proposed approach consistently outperforms the reported baselines, including 70.5% CIFAR10 accuracy under PGD20 and about 20% gains over Madry and Bilateral on CIFAR100 under PGD.
- Experimental setup: Experiments use WRN-28-10 across CIFAR10, CIFAR100, and SVHN, comparing the proposed method with Standard, Madry, and Bilateral baselines.Evaluation reports clean accuracy and robustness under PGD and CW attacks with different iteration counts.
- White-box robustness: 70.5% accuracy under standard PGD20 on CIFAR10 exceeds Madry by 25.6% and Bilateral by 13.0%.The comparison is reported for the CIFAR10 PGD20 threat model.
- White-box robustness: The proposed model consistently outperforms Madry across PGD attack iterations and outperforms Bilateral across all reported PGD and CW variants.Both Madry and Proposed maintain fairly stable performance as attack iterations increase with fixed attack budget 8.
- Cross-dataset results: On SVHN, the proposed method achieves the best clean accuracy and a clear robustness margin under PGD and CW attacks; on CIFAR100, it is about 20% better than Madry and Bilateral under PGD.The CIFAR100 advantage is about 10% under CW attacks.
- Ablation studies: Feature scattering outperforms Random and Supervised perturbation schemes, supporting its effectiveness as the main contributor to improved adversarial robustness.The ablation isolates feature scattering while keeping other hyper-parameters fixed.
- Ablation studies: Uniform, Identity, and OT matching schemes all improve performance, while the proposed approach performs well with different OT solvers.The experiments examine matching choices within feature scattering and solver sensitivity.
6 Conclusion
The paper presents feature scattering-based adversarial training, using unsupervised collaborative perturbations that leverage inter-sample relationships. It also derives a coupled regularization term and demonstrates effectiveness on benchmark datasets.
- Feature scattering generates adversarial training images through unsupervised, collaborative perturbations that leverage inter-sample relationships.
- The approach induces a coupled regularization term for adversarial training.
- Extensive experiments on benchmark datasets empirically demonstrate the proposed method’s effectiveness.