Towards Deep Neural Network Architectures Robust to Adversarial Examples

By Shixiang Shane Gu, Luca Rigazio. 2014

892 citations recorded by the source corpus.

Recent work has shown deep neural networks (DNNs) to be highly susceptible to well-designed, small perturbations at the input layer, or so-called adversarial examples. Taking images as an example, such distortions are often imperceptible, but can result in 100% mis-classification for a state of the art DNN. We study the structure of adversarial examples and explore network topology, pre-processing and training strategies to improve the robustness of DNNs. We perform various experiments to assess the removability of adversarial examples by corrupting with additional noise and pre-processing with denoising autoencoders (DAEs). We find that DAEs can remove substantial amounts of the adversarial noise. How- ever, when stacking the DAE with the original DNN, the resulting network can again be attacked by new adversarial examples with even smaller distortion. As a solution, we propose Deep Contractive Network, a model with a new end-to-end training procedure that includes a smoothness penalty inspired by the contractive autoencoder (CAE). This increases the network robustness to adversarial examples, without a significant performance penalty.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Safety, Robustness & Interpretability

Citations in the corpus

Explaining and Harnessing Adversarial Examples (2014, background): “Indeed, Gu & Rigazio (2014) and Chalupka et al. (2014) have already begun the ﬁrst steps toward designing models that resist adversarial perturbation, though no model has yet succesfully done so while maintaining state of the art accuracy on clean inputs.”
Scaling Laws for Reward Model Overoptimization (2022, methodology): “…of adversarial examples in all kinds of neural networks [Szegedy et al., 2013, Lin et al., 2017, Ebrahimi et al., 2018, Dai et al., 2018], and proposed methods to measure and increase neural network robustness [Gu and Rigazio, 2014, Zheng et al., 2016, Carlini et al., 2019, Guo et al., 2021].”
Towards the Science of Security and Privacy in Machine Learning (2016, methodology): “Gu et al. introduce a new ML model, which they name deep contractive networks , trained using a smoothness penalty [81].”
Towards Deep Learning Models Resistant to Adversarial Attacks (2017, background): “Due to the growing body of work on adversarial examples [8, 6, 23, 17, 3, 25, 7, 12], we focus only on the most related papers here.”
Virtual Adversarial Training: A Regularization Method for Supervised and Semi-Supervised Learning (2017, methodology): “impose constraints on the derivatives. For example, constraints may be imposed on the Frobenius norm of the Jacobian of the output with respect to the input. This approach was taken by Gu and Rigazio [13] in their deep contractive network. Instead of computing the computationally expensive full Jaco”
Distributional Smoothing with Virtual Adversarial Training (2015, background): “Deep contractive network by Gu and Rigazio (Gu & Rigazio, 2015) takes still another approach to smooth the model distribution.”
Toward Causal Representation Learning (2021, methodology): “A related defense method proceeds by reconstructing the input using an autoencoder before feeding it to a classiﬁer [96].”
Ensemble Adversarial Training: Attacks and Defenses (2017, background): “Various defensive techniques against adversarial examples in deep neural networks have been proposed (Gu & Rigazio, 2014; Luo et al., 2015; Papernot et al., 2016c; Nayebi & Ganguli, 2017; Cisse et al., 2017) and many remain vulnerable to adaptive attackers (Carlini & Wagner, 2017a;b; Baluja &…”
Towards Evaluating the Robustness of Neural Networks (2016, background): “…examples not only limits their potential application settings, but entirely defeats its purpose: an adversary who is able to make only slight modifications to a malware file that cause it to remain malware, but become classified as benign, has entirely defeated the malware classifier [8], [14].”
Practical Black-Box Attacks against Machine Learning (2016, background): “rtunity for future work. Discussing defenses against this attack is outside the scope of this paper. Previous work suggested the use of adversarial sample training [15], Jacobian-based regularization [16], and distillation [31] as means to make DNNs robust to adversarial samples. Such solutions appl”
Mitigating Evasion Attacks to Deep Neural Networks via Region-based Classification (2017, methodology): “If the testing example is not predicted to be an adversarial example, they will reform the testing example using a reformer, which essentially de-noises the testing example via an autoencoder [9].”
The Limitations of Deep Learning in Adversarial Settings (2015, background): “Another approach was proposed in [18], but it is unsuccessful as by stacking the denoising auto-encoder used for detection with the original DNN, the adversary can again produce adversarial samples.”
Spatially Transformed Adversarial Examples (2018, methodology): “The traditional attack strategies adopt L 2 (or other L p ) norm distance as a perceptual similarity metric to evaluate the distortion (Gu & Rigazio, 2014).”
The Robust Manifold Defense: Adversarial Training using Generative Models (2017, background): “Common defense approaches involve modifying the training dataset such that the classiﬁer is made more robust [20], [41], modifying the network architecture to increase robustness [11] or performing defensive distillation [37].”
Verifying Neural Networks with Mixed Integer Programming (2017, neutral): “Another approach is to attempt to detect adversarial examples by identifying some properties on which they differ from normal input [1, 9].”
PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples (2017, background): “Some other work has focused on modifying the classiﬁer architecture to increase its robustness, e.g ., Gu & Rigazio (2014), Cisse et al. (2017) and Nayebi & Ganguli (2017).”