PaperlayerView exact revision on arXiv

Source-linked AI summary

A Self-supervised Approach for Adversarial Robustness

Muzammal Naseer, Salman Khan, Munawar Hayat, Fahad Shahbaz Khan, Fatih Porikli

arXiv:2006.04924v1cs.CV

TL;DR

DNN vision systems remain vulnerable to transferable adversarial examples, while adversarial training lacks cross-task generalizability and input-processing defenses can fail against evolving attacks. The paper proposes self-supervised adversarial training in input space with a Neural Representation Purifier, reducing the success rate of an ensemble translation-invariant attack from 79.8% to 31.9% and defending classification, segmentation, and detection.

  • Problem

    Existing adversarial training is task-dependent, while input-processing defenses face strong white-box and black-box attacks and may amplify perturbations.

  • Method

    The paper trains a Neural Representation Purifier with self-supervised feature-space perturbations and a hybrid loss to restore adversarial images toward clean perceptual representations.

  • Results

    The defense reduces the effectiveness of the ensemble translation-invariant attack with input diversity from 79.8% to 31.9% and successfully removes unseen perturbations across tasks.

  • Takeaways & Limitations

    NRP is presented as a label-space-independent, plug-and-play defense applicable across classification, segmentation, and object detection without additional training.

  • Takeaways & Limitations

    Adversarial training remains constrained by computational cost, clean-accuracy loss, and label leakage, while input-processing defenses can be broken or amplify attacks.

Abstract

from arXiv · show

Adversarial examples can cause catastrophic mistakes in Deep Neural Network (DNNs) based vision systems e.g., for classification, segmentation and object detection. The vulnerability of DNNs against such attacks can prove a major roadblock towards their real-world deployment. Transferability of adversarial examples demand generalizable defenses that can provide cross-task protection. Adversarial training that enhances robustness by modifying target model's parameters lacks such generalizability. On the other hand, different input processing based defenses fall short in the face of continuously evolving attacks. In this paper, we take the first step to combine the benefits of both approaches and propose a self-supervised adversarial training mechanism in the input space. By design, our defense is a generalizable approach and provides significant robustness against the \textbf{unseen} adversarial attacks (\eg by reducing the success rate of translation-invariant \textbf{ensemble} attack from 82.6\% to 31.9\% in comparison to previous state-of-the-art). It can be deployed as a plug-and-play solution to protect a variety of vision systems, as we demonstrate for the case of classification, segmentation and detection. Code is available at: {\small\url{https://github.com/Muzammal-Naseer/NRP}}.

1. Introduction

The introduction contrasts task-dependent adversarial training with input-processing defenses, then proposes self-supervised adversarial training in input space through a purifying model.

  • Adversarial training modifies model parameters but remains task-dependent, requiring further training to transfer between classification, detection, and segmentation.
  • AT also incurs high computational cost, can reduce clean-data accuracy, and may suffer label leakage that harms generalization to unseen adversaries.ResNet50 accuracy is reported to drop from 76% to 64% under PGD robustness training at ϵ ≤2.
  • Input-processing defenses are scalable and cross-task, but have been broken in white-box settings, perform poorly in black-box settings, and can amplify attacks.
  • The paper proposes self-supervised adversarial training in input space using a min-max formulation to learn an input-processing function that implicitly performs adversarial training.
  • NRP is trained on feature-space adversaries and projects perturbed images toward the perceptual space of clean images, creating a loop independent of task and label space.
  • The proposed defense targets task generalizability, label-independent self-supervision, robustness to transferable strong perturbations, and preservation of clean-data accuracy.

2. Related Work

Related work covers input-processing defenses that remove or transform adversarial image components and attack methods that generate adversarial perturbations through different optimization strategies.

  • Defenses: JPEG compression removes high-frequency components, while Total Variation Minimization targets small localized changes caused by adversarial perturbations.
  • Defenses: Random Resizing and Padding, high-level representation guided denoising, and transformation pipelines have been proposed as preprocessing defenses.
  • Defenses: The NeurIPS-r3 pipeline combines image transformations with an ensemble of adversarially trained models to produce a weighted prediction response.
  • Attacks: Adversarial attack research includes single-step FGSM and multi-step I-FGSM methods for demonstrating vulnerability to imperceptible input changes.

3. Neural Representation Purifier

The Neural Representation Purifier (NRP) learns to restore adversarially perturbed images toward clean perceptual representations using self-supervised, task-independent training. Its feature-space perturbations are designed for transferability, while a hybrid loss combines feature, pixel, and adversarial objectives.

  • Overview: NRP trains a purifier to map adversarial images toward the perceptual feature space of clean natural images.The approach uses automatically derived self-supervision rather than task-specific labels or objectives.
  • Self-Supervised Perturbation: MI-FGSM maintains feature distortion as iterations increase, whereas I-FGSM’s feature distortion and fooling rate decrease on the black-box Inc-v4 evaluation.This observation motivates maximizing deep feature-space distortion to create transferable, task-independent adversaries.
  • Self-Supervised Perturbation: Feature distortion measures changes in internal representations between clean and perturbed images and motivates the self-supervised perturbation.The distance can use metrics such as ℓp, Wasserstein distance, or cosine similarity.
  • Self-Supervised Perturbation: SSP starts with a transformed input, maximizes feature-space distance within a perturbation budget, and returns a perturbed sample for NRP training.The algorithm uses a feature extractor, input transformation, step size, iteration count, and an ℓ∞ perturbation constraint.
  • NRP Loss Functions: NRP training uses a hybrid objective combining feature, pixel, and relativistic adversarial losses.Feature and pixel losses restore image content and style, while adversarial loss restores texture details; removing feature loss weakens convergence and defense.
  • Suitable Perceptual Adversaries: VGG-space perceptual adversaries show the highest transferability, with conv3.3 features offering better transferability than other tested layers.Increasing representation loss across multiple layers does not notably improve attack success and adds computational overhead.

4. Experiments

Experiments evaluate NRP across black-box attacks, cross-task defenses, ablations, adaptive attacks, and SSP as an attack. NRP shows robustness and generalization across attacks and vision tasks, while feature loss is important for effective purification.

  • Cross-task defense: NRP generalizes across classification, object detection, and instance-level segmentation against unseen CDA perturbations.Table 2 evaluates classification against CDA trained on Inc-v3 and detection and segmentation against CDA trained on Res-v2-152.
  • Ablation: Removing feature loss makes NRP fail to converge to a meaningful state and produces weaker defense, whereas removing pixel loss causes only a slight performance decrease.The ablation compares NRP with GNP and FGSP under black-box ensemble attacks using Top-1 accuracy on ImageNet-NeurIPS.
  • Defense results: NRP recovers images from strong adversarial patterns, including SSP applied to an adversarially robust model and diverse black-box attacks.Figures 6 and 7 visualize purification using an IncRes-v2ens backbone, while Figure 8 reports stabilized Mask-RCNN predictions after CDA removal.
  • Adaptive attacks: Under adaptive BPDA and translation-invariant attacks, NRP shows relative gains of 74% for IncRes-v2 and 66% for IncRes-v2ens.The attacker is assumed to know the defense, training data, and training mechanism, and uses a locally trained purifier with BPDA.
  • SSP attack: SSP transfers across tasks, reducing SegNet-Basic per-pixel accuracy by 47.11% and lowering RetinaNet and Mask-RCNN mAP from 53.78% to 5.16% and 59.5% to 9.7%.These results use l∞≤16; detection mAP is reported at IoU = 0.5.

5. Conclusion

The defense removes harmful perturbations with an adversarially trained purifier, generalizes to unseen attacks, and protects classification, segmentation, and object detection.

  • The proposed defense removes harmful perturbations using an adversarially trained purifier.
  • The defense is independent of the label space and does not require large training data.
  • The defense generalizes to unseen state-of-the-art attacks.
  • The approach successfully defends classification, segmentation, and object detection tasks.
  • The purifier can remove structured noise patterns in which an adversarial image is maliciously embedded into the original image.

Supplementary: A Self-supervised Approach for Adversarial Robustness

The supplementary material examines why SSP works, compares NRP with related defenses and attacks, evaluates transformation-based defenses, and visualizes perturbation removal.

  • Appendix A explores why the Self-supervised Perturbation attack works.
  • Appendix B compares NRP with conventional adversarial training in adversarial robustness and defense training time.
  • Appendix C discusses differences between the proposed attack and defense and feature scattering.
  • Appendix D compares SSP's ability to fool object detectors against CDA.
  • Appendix E evaluates JPEG, total variation minimization, and median filtering against SSP, while Appendix F provides evaluation attack parameters.
  • Appendix G visually demonstrates NRP's ability to remove different kinds of adversarial perturbations.

Appendix A. Why Self-supervision Works?

The appendix motivates SSP through transferable perturbations in shared perceptual feature spaces rather than task-specific output spaces, and reports comparisons with adversarial training and related attacks.

  • Why Self-supervision Works?: VGG can destroy non-robust features more effectively than ResNet models, yielding better transferability without adversarial training.
  • Why Self-supervision Works?: Feature-space adversaries found in VGG transfer better to naturally trained IncRes-v2 than adversaries found in other compared model spaces.
  • Comparison with AT: NRP avoids the clean-accuracy degradation reported for conventional adversarial training, which reduced ResNet152 accuracy from 78% to 65.3% at 55.7% robustness.
  • Comparison with AT: NRP can be used dynamically by taking a random input-space step and projecting the modified sample back into perceptual space.
  • Why Self-supervision Works?: Feature spaces are shared across input samples, whereas logits are tied to task-specific final responses, motivating task-independent adversary generation.

Appendix B.2. Training Cost

NRP is presented as model- and task-independent, with training-time advantages over conventional adversarial training and favorable transferability against feature-scattering attacks.

  • Training Cost: NRP training time remains constant across backbone models, whereas feature-denoising adversarial training takes longer as model size increases.
  • Training Cost: Conventional adversarial training depends on the number of classes, dataset, and task, while NRP is independent of these constraints.
  • Training Cost: NRP requires less labelled data than conventional adversarial training, which is described as requiring a large amount of labelled data.
  • Training Cost: Feature Scattering remains model- and task-specific, whereas NRP is independent of the target model and task.
  • Training Cost: SSP operates in perceptual feature space, while FSA operates in logit space by maximizing Optimal Transport distance; SSP performs favorably against FSA.

Appendix D. SSP vs. CDA

The paper compares SSP with the transferable CDA attack on MS-COCO validation data using Mask-RCNN. Performance is measured by mAP at IoU = 0.5.

  • SSP is compared with CDA, a recent transferable attack, on the MS-COCO validation set.
  • Mask-RCNN is used as the object-detection model in the comparison.
  • The evaluation reports mean average precision with IoU = 0.5.

Appendix E. Effect of Input Transformations on SSP Attack

The appendix evaluates input transformations against SSP across segmentation and object detection, while describing the attack configurations used for comparison. Transformations can reduce adversarial effects, but their effectiveness varies and may reduce benign accuracy.

  • The study tests JPEG, Total Variation Minimization, and Median Filtering as input transformations against SSP.JPEG removes high-frequency components, while TVM targets small variations; the supplied passage introduces MF but does not complete its description.
  • 47.11%: SSP reduces Segnet-Basic per-pixel accuracy on CAMVID within l∞≤16.JPEG and TVM are slightly effective, but they reduce accuracy on benign examples.
  • 53.78% to 5.16%: SSP reduces RetinaNet mAP with IoU = 0.5 on MS-COCO validation data under l∞≤16.
  • TVM is relatively more effective than the other tested transformations against SSP in the RetinaNet setting.
  • I-FGSM, MI-FGSM, and DIM are run for 10 iterations with step size 1.6, while MI-FGSM uses momentum decay factor 1.FGSM uses step size 16, and R-FGSM uses α=16/3 followed by a gradient step of 16−α.

Appendix G. Generalization to Unseen Attacks

NRP, trained with SSP, is evaluated on adversarial patterns produced by attacks and settings not seen during training. The visual demonstrations cover classification, segmentation, detection, and adversaries with diverse structures and transformations.

  • NRP successfully removes perturbations produced by attack algorithms it never saw during training.
  • NRP separates original signal from adversarial signal even for structured, in-painted perturbations from adversarially robust models.Figure 7 uses untargeted SSP adversaries in the feature space of adversarially trained ResNet50 with l∞≤16.
  • Figures 4 and 5 show SSP adversaries and predictions or detections for Segnet-Basic and RetinaNet, respectively.Figure 4 uses l∞≤16; Figure 5 contrasts original-image detections with detections for SSP adversaries.
  • NRP removes thick DIM patterns and smooth DIM-TI perturbations, as illustrated for ensemble attacks on Inc-v3, Inc-v4, IncRes-v2, and Res-152.The ensemble adversaries use perturbation budget l∞≤16.
  • NRP recovers original samples from unseen CDA adversaries evaluated on ImageNet and Paintings.Figure 9 describes untargeted adversaries produced by CDA trained against Inc-v3, with l∞≤16.
  • NRP removes CDA perturbations and greatly stabilizes Mask-RCNN predictions when those adversaries reduce detection performance.
Loading 2006.04924v1…