PaperlayerView exact revision on arXiv

Source-linked AI summary

Perceptual Adversarial Robustness: Defense Against Unseen Threat Models

Cassidy Laidlaw, Sahil Singla, Soheil Feizi

arXiv:2006.12655v4cs.LGcs.CVstat.ML

TL;DR

The paper addresses the gap between narrow adversarial threat models and the broad set of image changes imperceptible to humans. It approximates perceptual distance with neural features, develops NPTM attacks and PAT, and finds that PAT generalizes across diverse unseen attacks. This approach relies on LPIPS as the chosen neural perceptual-distance approximation.

  • Problem

    Existing defenses target restrictive threat models, but may fail against other attacks and unforeseen perturbation types.

  • Method

    The paper defines the NPTM using a neural approximation of perceptual distance, develops LPA and Fast-LPA, and trains PAT within LPIPS-bounded neighborhoods.

  • Results

    PAT achieves 32.5% accuracy against the ImageNet-100 union of five attacks, versus 0.5% for L∞ and 12.3% for L2 adversarial training.

  • Takeaways & Limitations

    PAT generalizes to several unforeseen imperceptible threat models without explicitly training against those five attacks.

  • Takeaways & Limitations

    The approach focuses on LPIPS, although other neural perceptual distances could also be used.

Abstract

from arXiv · show

A key challenge in adversarial robustness is the lack of a precise mathematical characterization of human perception, used in the very definition of adversarial attacks that are imperceptible to human eyes. Most current attacks and defenses try to avoid this issue by considering restrictive adversarial threat models such as those bounded by $L_2$ or $L_\infty$ distance, spatial perturbations, etc. However, models that are robust against any of these restrictive threat models are still fragile against other threat models. To resolve this issue, we propose adversarial training against the set of all imperceptible adversarial examples, approximated using deep neural networks. We call this threat model the neural perceptual threat model (NPTM); it includes adversarial examples with a bounded neural perceptual distance (a neural network-based approximation of the true perceptual distance) to natural images. Through an extensive perceptual study, we show that the neural perceptual distance correlates well with human judgements of perceptibility of adversarial examples, validating our threat model. Under the NPTM, we develop novel perceptual adversarial attacks and defenses. Because the NPTM is very broad, we find that Perceptual Adversarial Training (PAT) against a perceptual attack gives robustness against many other types of adversarial attacks. We test PAT on CIFAR-10 and ImageNet-100 against five diverse adversarial attacks. We find that PAT achieves state-of-the-art robustness against the union of these five attacks, more than doubling the accuracy over the next best model, without training against any of them. That is, PAT generalizes well to unforeseen perturbation types. This is vital in sensitive applications where a particular threat model cannot be assumed, and to the best of our knowledge, PAT is the first adversarial training defense with this property.

1 INTRODUCTION

Existing defenses focus on narrow threat models that may not generalize to unforeseen perturbations. The paper proposes the neural perceptual threat model and develops attacks and training that target broad human-imperceptible changes.

  • Motivation: Narrow defenses can fail against other attack types, while simultaneous training across threat models may reduce robustness to each individual model.Not all threat models are known during training, and defenses generally generalize poorly to unforeseen threats.
  • Neural perceptual threat model: The perceptual threat model includes misclassifying perturbations that remain imperceptibly different from a natural image under a human-defined distance threshold.The threshold may depend on the specific input.
  • Neural perceptual threat model: The proposed NPTM approximates true perceptual distance with neural-network features, enabling attacks and defenses against a broader threat model.The paper focuses on LPIPS as the neural perceptual distance.
  • Attacks: 2.4% accuracy is achieved by LPA against the most robust classifier studied on ImageNet-100 while remaining imperceptible.LPA also finds examples outside the other studied threat models.
  • Defense: 32.5% accuracy against the union of five attacks is achieved by PAT on ImageNet-100, versus 0.5% and 12.3% for L∞ and L2 adversarial training.PAT was not explicitly trained against those five attacks and generalized to unseen threat models.
  • Perceptual validation: LPIPS correlates well with human perceptibility judgments across seven adversarial perturbation types and multiple threat-specific bounds.The study used Amazon Mechanical Turk evaluations.

2 RELATED WORK

Prior work studies robustness under norm-bounded and other specialized attacks, while perceptual similarity research develops metrics that better align with human vision. This paper positions PAT as an adversarial-training method intended to generalize across unforeseen perturbation types.

  • Adversarial robustness: Adversarial-robustness research has examined L2, L∞, spatial, recoloring, and frequency-domain threat models.These approaches represent diverse but separately specified perturbation families.
  • Perceptual similarity: L2 and PSNR can disagree with human vision on blurring and spatial transformations, motivating perceptual measures such as SSIM and LPIPS.The related-work discussion lists several alternatives developed for perceptual similarity.
  • Perceptual adversarial robustness: The related work frames the contribution as applying a more accurate perceptual distance to improving adversarial robustness.Earlier work had mainly used LPIPS for generative-model development and evaluation.
  • Perceptual adversarial robustness: The paper identifies PAT as the first adversarial-training method known to generalize to unforeseen threat models without rejecting inputs.It contrasts this with L2- and L∞-based defenses that do not generalize to a more diverse threat model.

3 NEURAL PERCEPTUAL THREAT MODEL (NPTM)

The NPTM uses a neural approximation of human perceptual distance to constrain adversarial examples. In this paper, LPIPS supplies that approximation through normalized neural activations, without learned perceptual weights.

  • Threat-model construction: Because true perceptual distance is difficult to compute efficiently, the paper uses neural perceptual distances, focusing on LPIPS.Other neural perceptual distances could also be used in the attacks and defenses.
  • LPIPS distance: LPIPS constructs φ(x) by channel-normalizing internal activations, normalizing by layer size, and flattening them into one vector.The resulting representation maps classifier inputs into an activation space.
  • LPIPS distance: The LPIPS distance compares the normalized, flattened representations φ(x1) and φ(x2) between two images.The distance is defined from the resulting activation vectors.
  • LPIPS distance: The paper uses LPIPS without the additional learned weights from the original implementation to avoid collecting a human-judgment dataset.The authors report that the unweighted version remains a good surrogate for human vision.
  • Adversarial examples: A neural perceptual adversarial example must remain perceptually similar to the natural input while causing the classifier to misclassify.The bound is expressed through the neural perceptual distance.

4 PERCEPTUAL ADVERSARIAL ATTACKS

The paper introduces two attacks for finding adversarial examples under the complex, non-convex LPIPS constraint: Perceptual PGD and LPA. Both seek adversarial examples with small perceptual distortion, using iterative constrained optimization or Lagrangian relaxation.

  • Computational challenge: The LPIPS constraint makes perceptual attacks harder to compute than attacks under standard Lp threat models because it is complex and non-convex.The paper develops approximate optimization procedures, including conjugate-gradient computation for the PPGD step.
  • Attack formulation: Both attacks optimize adversarial loss while enforcing d(x, ex) = ∥φ(x) − φ(ex)∥2 ≤ ϵ under a fixed classifier and LPIPS network.The LPIPS network may be the attacked classifier itself or a separate externally bounding network.
  • Overview: The paper proposes PPGD and LPA as its two attack methods for the neural perceptual threat model.These methods are used to construct adversarial examples with small perceptual distortion.
  • Perceptual Projected Gradient Descent (PPGD): PPGD iteratively maximizes misclassification loss under an LPIPS step bound, then approximately projects the candidate back onto the feasible perceptual set.The projection is approximated using a Newton-based technique because the feasible set is non-convex.
  • Lagrangian Perceptual Attack (LPA): LPA uses a Lagrangian relaxation of the perceptual attack problem, analogous to Carlini–Wagner attacks for L2 and L∞ threat models.Its constraint penalty is zero within the allowed distance and grows linearly beyond the LPIPS bound.

5 PERCEPTUAL ADVERSARIAL TRAINING (PAT)

Perceptual Adversarial Training (PAT) trains classifiers against worst-case examples within an LPIPS-bounded neighborhood. Because exact inner maximization is intractable, PAT uses Fast-LPA to approximate it during training.

  • Motivation: The paper proposes PAT because robustness to neural perceptual attacks may enhance robustness against unforeseen adversarial perturbation types.This motivation connects the broad perceptual threat model to defense against attacks not included during training.
  • Training objective: PAT minimizes worst-case cross-entropy loss within an LPIPS-bounded neighborhood around each training example.The formulation is analogous to adversarial training for Lp threat models.
  • Perceptual representation: The LPIPS neighborhood is defined by normalized, flattened activations φ(·) from a selected neural network.The paper explores PAT variants that differ in the network used to define φ(·).
  • Optimization: PAT uses perceptual attacks to approximately solve the inner maximization required during robust training.The exact inner maximization is intractable, so the training procedure relies on an attack-based approximation.
  • Optimization: Fast-LPA is an inexpensive LPA variant used repeatedly during PAT training.Unlike LPA, Fast-LPA does not search over λ and omits the final projection step, so its outputs may sometimes fall outside the perceptual bound.

6 PERCEPTUAL EVALUATION

The paper evaluates whether LPIPS approximates human perceptibility and compares perceptual attacks with five narrow threat models. Human-study correlations favor AlexNet-based LPIPS, while LPA and PPGD are strongest at matched perceptibility.

  • Study design: About 1,000 annotations were collected for each of three bounds across all seven attack types, totaling 14,000 annotations over 2,800 image pairs.Participants judged whether sequentially presented image pairs were the same or different.
  • Study design: The perceptual study compares five narrow threat models with PPGD and LPA across three bounds each.The bounds are calibrated by perceptibility, with participant judgments collected from natural–adversarial image pairs.
  • Perceptual validation: AlexNet-based LPIPS correlates best with human perceptibility at r = 0.94.A normally trained ResNet-50 performs similarly but slightly less well, and even an untrained network outperforms L2 correlation.
  • Perceptual validation: The study uses AlexNet to define LPIPS for externally bounded evaluation attacks because it is the best proxy for human judgments in these experiments.The result also supports perceptual alignment early in self-bounded PAT, when the network is untrained.
  • Attack comparison: LPA and PPGD are strongest at a given perceptibility, reducing a PAT-trained classifier to 0% and 8.2% accuracy, respectively.Among narrow threat models, L2 attacks are strongest at matched perceptibility, but both proposed perceptual attacks are stronger.

7 EXPERIMENTS

Experiments evaluate PAT across diverse adversarial and corruption threat models on CIFAR-10 and ImageNet-100, finding broad robustness and strong performance against perceptual attacks. The results also examine why PAT generalizes across threat models and how it compares with single- and multiple-attack defenses.

  • ImageNet-100: 33% vs 12% union accuracy on ImageNet-100 shows PAT more than doubles the next-highest result without training against the narrow threat models.The comparison uses seven attacks at medium bounds.
  • CIFAR-10: PAT raises CIFAR-10 union accuracy from <5% to >20% and nearly doubles unseen mean accuracy from 26% to 49%.These results outperform Lp adversarial training and TRADES.
  • Perceptual attacks: LPA is the strongest studied perceptual attack, reducing the most robust classifier to 9.8% accuracy on CIFAR-10 and 2.4% on ImageNet-100.Models most robust to LPA also have the best union and unseen mean accuracies.
  • Comparison with other defenses: PAT outperforms maximum-loss multiple-attack training on CIFAR-10 while training against none of those attacks and taking one fourth of the training time.Multiple-attack strategies still generalize poorly to the unseen PPGD and LPA attacks.
  • Why PAT generalizes: LPIPS assigns comparable distances to similarly perceptible attacks, unlike Lp metrics, helping explain why PAT generalizes across threat models.The analysis compares L∞, L2, JPEG, StAdv, and ReColorAdv examples in ImageNet-100.

8 CONCLUSION

The paper develops attacks and defenses for the neural perceptual threat model, using LPIPS to approximate human perceptual distance. It concludes that this framework supports attacks and defenses intended to generalize beyond narrowly specified threat models.

  • The paper presents attacks and defenses for the neural perceptual threat model, realized through the LPIPS distance.
  • The conclusion states that the LPIPS-based threat model closely approximates the true perceptual threat model and can help develop defenses against unforeseen attacks.
  • Perceptual PGD: PPGD takes repeated first-order loss-increasing steps in LPIPS distance followed by projection into the allowed perceptual ball.
  • Perceptual PGD: Conjugate gradient efficiently approximates the linear system needed for PPGD without explicitly forming or inverting J⊤J.
  • Lagrangian Perceptual Attack: LPA optimizes a Lagrangian relaxation of the perceptual attack problem using modified gradient descent and adaptive λ updates.

D ADDITIONAL PERCEPTUAL STUDY RESULTS

The perceptual study reports bounds and outcomes for evaluating how perceptible and effective several adversarial threat models are.

  • Table 4 reports perceptibility as the proportion of image pairs judged different and strength as attack success against threat-specific adversarially trained classifiers.

E PERCEPTUAL ATTACK EXPERIMENTS

The experiments compare PPGD and LPA under different projection and bounding choices. LPA is stronger, while externally bounded LPA can substantially reduce PAT robustness on ImageNet-100.

  • LPA tends to be more powerful than PPGD in the perceptual attack experiments.
  • 2.4% accuracy remains for a PAT-trained ImageNet-100 classifier under externally bounded LPA.
  • The evaluation uses externally bounded attacks with AlexNet because its LPIPS distance provides a standard, human-correlated perceptual measure.
  • Table 5 compares PAT accuracy under self-bounded and AlexNet-bounded PPGD and LPA attacks using two perceptual projection methods.

F.1 ABLATION STUDY

The ablations examine Fast-LPA training choices, projection, bounding network, and robustness–clean-accuracy tradeoffs. They also show that PAT can outperform threat-specific training for some attacks on CIFAR-10.

  • Fast-LPA: PAT performs best when Fast-LPA uses both step-size decay and λ increases.
  • Training effects: PAT-trained classifiers gain broad attack robustness but tend to have lower clean accuracy, which selective attack training partly improves.
  • Self-bounded vs. AlexNet-bounded PAT: Externally bounded PAT is more robust than self-bounded PAT on CIFAR-10, while the two perform similarly on ImageNet-100.
  • Self-bounded vs. AlexNet-bounded PAT: 76% greater LPIPS distance separates average test attacks from self-bounded PAT training attacks on CIFAR-10.
  • Self-bounded vs. AlexNet-bounded PAT: Using an AlexNet-bound of ϵ = 0.7 makes self-bounded and AlexNet-bounded PAT results more similar.
  • Comparison with threat-specific training: PAT improves CIFAR-10 robustness over threat-specific training from 54% to 65% for StAdv and from 65% to 71% for ReColorAdv.
  • Comparison with threat-specific training: The authors suggest that training across wider perturbation ranges may improve robustness to new inputs within the same threat model.

G COMMON CORRUPTIONS EVALUATION

PAT-trained classifiers are evaluated on common corruptions in CIFAR-10-C and ImageNet-100-C using relative mCE, where lower values indicate better robustness. PAT improves robustness overall on both datasets, with L2 adversarial training outperforming it only for noise perturbations on CIFAR-10-C.

  • Evaluation setup: CIFAR-10-C and ImageNet-100-C evaluate robustness to 15 random corruption types at 5 severity levels.ImageNet-100-C is formed by taking every tenth class from ImageNet-C.
  • Metric: Relative mCE averages relative corruption error across perturbation types, with lower values indicating better robustness.Relative corruption error uses classifier error at each corruption severity and clean-input error.
  • Results: PAT achieves better overall robustness against common corruptions than normal and adversarial training on both CIFAR-10-C and ImageNet-100-C.The comparison is reported in Tables 10 and 11 using relative mCE.
  • Results: L2 adversarial training outperforms PAT only for the noise category on CIFAR-10-C.The passage attributes this exception to Gaussian and other noise types being symmetrically distributed in an L2 ball.
  • Implementation: All experiments train ResNet-50 with SGD for 100 epochs, using 10 attack iterations for training and generally 200 for testing.PPGD and LPA use 40 testing iterations because they are more expensive; self-bounded PAT takes about 12 hours on CIFAR-10 and 5 days on ImageNet-100.
  • Implementation: Images are standardized after adversarial perturbation and before classification using dataset-wide per-channel means and standard deviations.The experiments also use default data augmentation techniques from the robustness library.
Loading 2006.12655v4…