The Robust Manifold Defense: Adversarial Training using Generative Models

By Andrew Ilyas, Ajil Jalal, Eirini Asteri, Constantinos Daskalakis, A. Dimakis. 2017

176 citations recorded by the source corpus.

We propose a new type of attack for finding adversarial examples for image classifiers. Our method exploits spanners, i.e. deep neural networks whose input space is low-dimensional and whose output range approximates the set of images of interest. Spanners may be generators of GANs or decoders of VAEs. The key idea in our attack is to search over latent code pairs to find ones that generate nearby images with different classifier outputs. We argue that our attack is stronger than searching over perturbations of real images. Moreover, we show that our stronger attack can be used to reduce the accuracy of Defense-GAN to 3\%, resolving an open problem from the well-known paper by Athalye et al. We combine our attack with normal adversarial training to obtain the most robust known MNIST classifier, significantly improving the state of the art against PGD attacks. Our formulation involves solving a min-max problem, where the min player sets the parameters of the classifier and the max player is running our attack, and is thus searching for adversarial examples in the {\em low-dimensional} input space of the spanner. All code and models are available at \url{this https URL}

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Generative Models, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Generative Models

In Safety, Robustness & Interpretability

Citations in the corpus

Certified Robustness to Adversarial Examples with Differential Privacy (2018, methodology): “These defenses include model distialltion [44], automated detection of adversarial examples [22], [41], [40], application of different input transformations [27], [10], randomization [21], [11], and application of generative models [49], [25], [60].”
Adversarial Training for Free! (2019, background): “, 2017], Robust Manifold Defense [Ilyas et al., 2017], L2-nonexpansive nets [Qian and Wegman, 2018], Jacobian Regularization [Jakubovitz and Giryes, 2018], Universal Perturbation [Shafahi et al.”
Exploiting Excessive Invariance caused by Norm-Bounded Adversarial Robustness (2019, methodology): “In order to alleviate the need for human inspection of each candidate x∗i to determine which of these potential adversarial examples is actually misclassified, we follow an approach from Defense-GAN Samangouei et al. (2018) and the Robust Manifold Defense Ilyas et al. (2017): we take the generator f”
Generalization in anti-causal learning (2018, background): “Experiments: Wang et al. (2017); Samangouei et al. (2018); Song et al. (2017); Ilyas et al. (2017) increase robustness against adversarial examples, by learning a generative (causal) model and synthesizing images until a match for the input is found.”
Towards the first adversarially robust neural network model on MNIST (2018, methodology): “• Manifold projections: An input sample is projected onto a learned data manifold (Samangouei et al., 2018; Ilyas et al., 2017; Shen et al., 2017; Song et al., 2018).”
Deep Image Prior (2017, methodology): “The method (Ilyas et al. 2017) successively applies deep image prior to defend against adversarial attacks.”
Adversarial vulnerability for any classifier (2018, methodology): “Other techniques [17] build on this approach, and further use methods to increase the in-distribution robustness.”
PacGAN: The Power of Two Samples in Generative Adversarial Networks (2017, background): “This can be used in various applications, such as image manipulation [31] and defending against adversarial examples [23].”
Disentangling Adversarial Robustness and Generalization (2018, methodology): “First, we showed that regular adversarial examples indeed leave the manifold, as widely assumed in related work [27, 99, 39, 72, 82].”
Robust Perception through Analysis by Synthesis (2018, methodology): “We tried to run each gradient-based attack in two versions: one with the real gradient of the model (if available), one with gradients estimated according to [Ilyas et al., 2017a].”
VectorDefense: Vectorization as a Defense to Adversarial Examples (2018, background): “Since G is not guaranteed to be perfectly trained and therefore, one can ﬁnd AXs directly in the generated distribution [2, 15].”
Global Guarantees for Enforcing Deep Generative Priors by Empirical Risk (2017, background): “In particular, it could help explain the significant observation that generative priors can mitigate against adversarial examples [63], [64], which are minor and sometimes imperceptible modifications to images that lead to catastrophic misclassification by neural networks [65].”
Adversarial Robustness with Semi-Infinite Constrained Learning (2021, unknown): “For generative models with latent dimension z d , the latter approach can be thought of as parameterizing the perturbation distribution λ on a lower-dimensional manifold in the data space, which has been shown to be a strong defense in prior work [90–92].”
Clean-Label Backdoor Attacks (2018, methodology): “In order to generate images similar to the training inputs, we optimized over the latent space using 1000 steps of GD with a step size of 0.1 following the procedure of Ilyas et al. (2017).”
Adversarially Robust Few-Shot Learning: A Meta-Learning Approach (2019, background): “Unfortunately, GANs are not expressive enough to preserve the integrity of testing images on complex datasets involving high-res natural images, and recent attacks have critically compromised the performance of this defense [13, 1].”
You Only Propagate Once: Painless Adversarial Training Using Maximal Principle (2019, methodology): “To improve the robustness of neural networks to adversarial examples, many defense approaches have been proposed, like, adversarial trainining [5], orthogonal regularization [10,11], L2 nonexpansive networks [12], Bayesian method [13], random masking [14], TRADES [7], rejecting adversarial examples ”
Relating Adversarially Robust Generalization to Flat Minima (2021, methodology): “14 [55] Andrew Ilyas, Ajil Jalal, Eirini Asteri, Constantinos Daskalakis, and Alexandros G.”