PaperlayerView exact revision on arXiv

Source-linked AI summary

Adversarial purification with Score-based generative models

Jongmin Yoon, Sung Ju Hwang, Juho Lee

arXiv:2106.06041v1cs.LGcs.CR

TL;DR

EBM purification with long MCMC chains is impractical because it requires too many steps. The paper instead trains an EBM with DSM and injects random noise before purification, reporting fast purification and robust performance across attacks and datasets.

  • Problem

    EBM-based adversarial purification is limited by the impractical number of MCMC steps needed to purify attacked images.

  • Method

    The paper trains an EBM with DSM for purification and injects random noise into images before deterministic purification.

  • Results

    The method purifies attacked images within several orders of magnitude fewer steps and achieves state-of-the-art performance across datasets and attacks.

  • Takeaways & Limitations

    Randomized purification improves robustness by making adversarial perturbations negligible and aligning inputs with noisy samples used during DSM training.

  • Takeaways & Limitations

    Adversarial training can remain vulnerable to attacks outside the restricted attack classes used to approximate the full threat model.

Abstract

from arXiv · show

While adversarial training is considered as a standard defense method against adversarial attacks for image classifiers, adversarial purification, which purifies attacked images into clean images with a standalone purification model, has shown promises as an alternative defense method. Recently, an Energy-Based Model (EBM) trained with Markov-Chain Monte-Carlo (MCMC) has been highlighted as a purification model, where an attacked image is purified by running a long Markov-chain using the gradients of the EBM. Yet, the practicality of the adversarial purification using an EBM remains questionable because the number of MCMC steps required for such purification is too large. In this paper, we propose a novel adversarial purification method based on an EBM trained with Denoising Score-Matching (DSM). We show that an EBM trained with DSM can quickly purify attacked images within a few steps. We further introduce a simple yet effective randomized purification scheme that injects random noises into images before purification. This process screens the adversarial perturbations imposed on images by the random noises and brings the images to the regime where the EBM can denoise well. We show that our purification method is robust against various attacks and demonstrate its state-of-the-art performances.

1. Introduction

Adversarial purification offers a classifier-independent alternative to adversarial training, but EBM-based purification has been limited by costly long MCMC chains. The paper proposes DSM-trained EBMs with randomized noise injection for faster and more robust purification.

  • Adversarial attacks can imperceptibly perturb images while completely changing deep neural network classifier predictions.
  • Adversarial purification independently removes adversarial noise before classification, without necessarily requiring class labels during training.
  • EBM purification using Langevin dynamics depends on long MCMC chains, making the required number of sampling steps impractical.
  • DSM-trained EBMs use score functions that denoise perturbed samples, directly matching adversarial purification's denoising interpretation.
  • Several orders of magnitude fewer steps can quickly purify attacked images, while injecting noise before purification improves robustness.
  • The method is evaluated against strong adaptive attacks and reported to achieve state-of-the-art performance across several datasets.

2. Backgrounds

The background contrasts classifier training, preprocessing, and generative purification defenses, then introduces EBMs, MCMC sampling, score matching, and DSM. These foundations explain why DSM is suited to denoising-based purification while highlighting computational limitations of prior approaches.

  • Adversarial training, preprocessing, and purification: Adversarial training approximates worst-case risk minimization using restricted classes of adversarial examples, so networks may remain vulnerable to attacks outside those classes.
  • Adversarial training, preprocessing, and purification: Preprocessing defenses transform inputs before classification, using stochastic or discrete transformations that make gradient estimation harder for attackers.
  • Adversarial training, preprocessing, and purification: Adversarial purification uses an independently trained generative model as a preprocessor to restore clean images from attacked inputs.
  • Energy-based models and adversarial purification: An EBM represents a probability density through an unconstrained energy function and an intractable normalization constant, requiring approximate learning or sampling.
  • Energy-based models and adversarial purification: Maximum-likelihood EBM training approximates model-distribution expectations with Monte Carlo methods, including Langevin-defined Markov chains.
  • Energy-based models and adversarial purification: MCMC purification starts Langevin sampling from attacked images, but typically requires more than 1,000 steps and is costly even on modern GPUs.
  • Denoising score matching: Score matching learns a target density's score function instead of its density, avoiding intractable normalizing constants but basic forms do not scale well because of a trace term.
  • Denoising score matching: DSM avoids computing the trace term by learning the score of perturbed data, with Gaussian noise providing a denoising formulation that recovers original samples.

3. Adversarial purification with score-based generative models

The paper replaces MCMC-trained EBM purification with DSM-trained score networks and deterministic updates, then adds noise injection and adaptive step sizes to improve speed and robustness.

  • 3.1. Denoising score matching for adversarial purification: DSM trains the score function directly to denoise perturbed samples, making it more closely related to adversarial purification than estimating an energy function with MCMC.The authors note that maximum-likelihood training can fit the energy without accurately predicting the gradients used for purification.
  • 3.2. Purification by deterministic updates: Deterministic score updates replace stochastic Langevin sampling, and empirically improve classification accuracy much faster than stochastic updates.The paper reports that DSM works particularly well with deterministic updates, as shown in Figure 2.
  • 3.3. Random noise injection before purification: Noise injection screens relatively small adversarial perturbations and makes inputs more similar to the Gaussian-perturbed data used to train the score network.The method forms x0 = x + ν + ε with ε sampled from N(0, σ2I).
  • Adaptive step sizes: Adaptive step sizes select purification updates using a target score-scale reduction, with λ = 0.05 and δ = 10^-5 fixed in all experiments.The scheme estimates the local noise scale by moving the current point along the score direction and evaluating a small displacement.
  • 3.3. Random noise injection before purification: Adaptive Denoising Purification (ADP) combines DSM, deterministic updates, noise injection, and adaptive step sizes, with multiple purification runs ensembled after randomization.The randomized classifier is described as a randomized smoothing classifier and is reported to have certified robustness for norm-bounded threat models.

4. Related Works

Related work spans adversarial training, preprocessing transformations, and generative adversarial purification methods, including EBM approaches based on long-run MCMC.

  • Adversarial training: Adversarial training augments classifier training with adversarial examples and has been shown to be a reliable defense method.Regularization and self-supervised learning have also been reported to improve robustness.
  • Preprocessing for adversarial defense: Preprocessing defenses apply auxiliary transformations or stochasticity to attacked images before classification.Examples include thermometer encoding, stochastic activation pruning, image quilting, matrix estimation, and discontinuous activation.
  • Adversarial purification methods: Adversarial purification trains a separate generative model to restore clean images from attacked images before classification.The purification model can serve as a classifier-independent preprocessor.
  • Adversarial purification methods: Prior EBM purification methods use maximum-likelihood training with MCMC and long Langevin chains to purify adversarial examples.These methods have been reported to robustly purify examples in the long-run MCMC setting.

5. Experiments

The experiments evaluate ADP across preprocessor-blind, adaptive, certified-robustness, common-corruption, and additional-dataset settings using natural classifiers and specified attack protocols. ADP generally performs strongly, while random noise injection helps against adaptive attacks but hurts performance on unbounded common corruptions.

  • Evaluation scope: ADP is evaluated on ℓ∞-bounded attacks, ℓ2-certified robustness, CIFAR-10-C corruptions, and multiple datasets.The evaluation includes comparisons with adversarial training, purification defenses, and randomized classifiers.
  • Experimental setup: Experiments use WideResNet-28-10 classifiers, NCSN score models, and ensembles of S = 10 purification runs.Unless otherwise stated, ADP uses (λ, δ) = (0.05, 10−5) and naturally trained classifiers.
  • Preprocessor-blind attacks: ADP successfully purifies attacked images while maintaining high natural accuracy under preprocessor-blind attacks.The CIFAR-10 evaluation compares ADP with preprocessor-based defenses and adversarial-training methods.
  • Strong adaptive attacks: ADP generally achieves the best results against strong adaptive attacks, and σ = 0.25 noise injection usually improves robust accuracy over σ = 0.0.Without noise injection, ADP fails on SPSA, whereas random noise injection avoids that failure; certified accuracy exceeds prior results at σ = 0.12 and is comparable at σ = 0.25.
  • Common corruptions: Noise injection underperforms without noise injection on CIFAR-10-C, although both variants surpass other adversarial-training baselines on average.The authors attribute the difference to unbounded corruption norms, which Gaussian noise does not effectively screen; DCT and AugMix training can further improve robust accuracy.

6. Conclusion

The paper presents score-based adversarial purification using DSM-trained EBMs, combining deterministic short-run updates with Gaussian noise injection. It validates the approach across datasets and diverse attacks, reporting superior performance.

  • DSM-trained EBMs quickly purify attacked images with deterministic short-run updates.
  • Gaussian noise injection further robustifies the purification process.
  • The method is validated on various benchmark datasets and diverse adversarial attacks.
  • The paper reports superior performance for the proposed purification method.

Supplementary Materials for Adversarial Purification with Score-based

The supplementary materials document the implementation environment, datasets, corruption benchmark, and dataset-specific image characteristics used in the experiments.

  • The implementation uses Python 3.8.5, PyTorch 1.7.1, Ubuntu 18.04, and a single Titan X GPU.
  • MNIST and FashionMNIST each contain 60,000 training and 10,000 test examples at 28 × 28 grayscale resolution.
  • CIFAR-10 and CIFAR-100 use 32 × 32 RGB images with 45,000 training, 5,000 validation, and 10,000 test examples.
  • CIFAR-10-C contains 15 corruption types evaluated at five severity levels.

A.3. Training hyperparameters

This supplementary section specifies score-network training hyperparameters, classifier and purifier architectures, and image corruptions illustrated in the figures.

  • A.3. Training hyperparameters: Table 5 lists the hyperparameters used to train NCSNv2 purifier networks, including the largest and smallest Gaussian noise levels and the number of noise levels.
  • A.3. Training hyperparameters: DCT- and AugMix-based training adjusts the smallest noise level because small-noise training can over-represent out-of-distribution deviations.
  • A.3. Training hyperparameters: All classifier and purifier networks use Adam with learning rate 0.001, β1 = 0.9, β2 = 0.999, and no weight decay.
  • Architectures: CIFAR classifiers use WideResNet-28-10, while CIFAR purifiers use NCSNv2, whose decoder uses RefineNet.
  • Corruption examples: Figure 5 shows severity-5 examples spanning noise, blur, weather, and digital corruption categories alongside purified counterparts.

C. Full CIFAR-10-C performance

The section reports full CIFAR-10-C corruption results and describes DCT- and AugMix-based perturbation training for improving purifier robustness. It also references the adaptive-attack evaluation setup.

  • C. Full CIFAR-10-C performance: Full CIFAR-10-C performances are reported for all 15 corruption types, with both full and average results presented in Table 11.
  • C. Full CIFAR-10-C performance: ADP training uses adaptive step size α = 0.05 for Gaussian and DCT perturbations, while AugMix uses a decreasing schedule from σ1 = 0.08 to σ10 = 8.0 × 10−4.
  • Perturbation training: DCT and AugMix training modify the DSM perturbation distribution so Gaussian noise is centered on an augmented image F(x).
  • Adaptive attacks: The adaptive-attack table evaluates an l∞ threat model with ε = 8/255 on CIFAR-10 and includes white-box adversarial-training comparisons.

D.1. Full list of defense results for adaptive attacks

The appendix reports ADP’s performance under adaptive attacks, varying noise, attack iterations, purification runs, and EOT settings. Robust accuracy improves through 10 purification runs and remains stable thereafter, while stronger noise reduces standard accuracy faster than robust accuracy.

  • Adaptive attacks: ADP is evaluated against strong adaptive BPDA+EOT and preprocessor-blind classifier PGD attacks across noise levels from σ = 0.05 to σ = 0.4.The evaluation reports both standard and robust accuracy on CIFAR-10.
  • Noise injection: Increasing injected noise decreases both standard accuracy and the standard–robust accuracy gap, with standard accuracy falling faster than robust accuracy.This trend is reported for the CIFAR-10 evaluations across the tested noise levels.
  • EOT variation: ADP robust accuracy is also reported for different EOT counts under BPDA+EOT attacks on CIFAR-10.These attacks apply BPDA after different numbers of random noise injections with σ = 0.25.
  • Attack iterations: 0.30%: increasing BPDA iterations from 40 to 100 slightly decreases robust accuracy.The main experiments use 40 BPDA iterations; the comparison uses 100 iterations.
  • Purification runs: Robust accuracy improves until 10 purification runs and stays stable with additional runs under BPDA+EOT attack.The experiment uses 40 BPDA iterations and 15 EOT attacks on CIFAR-10.

D.6. Full list of defense results for more datasets

The appendix extends evaluation beyond the main dataset and reports randomized-smoothing results. On CIFAR-10, ADP surpasses existing randomized-smoothing classifiers in robust accuracy at noise levels up to σ = 0.25.

  • More datasets: The paper reports full defense results on MNIST, FashionMNIST, and CIFAR-100.These evaluations are collected in Table 9.
  • Randomized smoothing: ADP is evaluated with randomized smoothing classifiers on CIFAR-10.The results are reported as robust accuracy in Table 10.
  • Randomized smoothing: Up to σ = 0.25, randomized-smoothing classifiers using ADP surpass existing randomized-smoothing classifiers in robust accuracy.The comparison is reported for low noise levels on CIFAR-10.

F. Detecting Adversarial Examples before purification

The paper proposes detecting attacked images from score norms before purification and applying different noise levels accordingly. This addresses the clean-accuracy degradation caused by uniformly injecting noise, while score-norm histograms support detection for most attacks.

  • Accuracy trade-off: Uniform random noise improves robust accuracy but degrades standard accuracy by screening features useful for natural-image classification.The detection scheme applies different noise policies to attacked and natural images to prevent this cost.
  • Detection evidence: Except for joint attacks, attacked images usually have higher score norms than natural images, supporting score norms as a detection signal.The paper compares score-norm histograms for natural, adversarial, and purified images across attacks.
  • Detection rule: The detector classifies images as natural below threshold τ and attacked above threshold using the Euclidean score norm ∥sθ(x)∥2.For CIFAR-10 and CIFAR-100, the threshold is fixed at τ = 25.0.
  • Evaluation figures: Figure 8 compares robust accuracy across purification-run counts, with runs on the x-axis and accuracy (%) on the y-axis.Its curves distinguish expectation over pre-softmax outputs, post-softmax outputs, and argmax outputs.
  • Adaptive noise injection: Natural images receive low noise while detected attacked images receive higher noise before purification.The scheme uses σhigh = σ for attacked images and σlow = βσ with β = 0.2 otherwise.
Loading 2106.06041v1…