PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples

By Yang Song, Taesup Kim, Sebastian Nowozin, Stefano Ermon, Nate Kushman. 2017

846 citations recorded by the source corpus.

Adversarial perturbations of normal images are usually imperceptible to humans, but they can seriously confuse state-of-the-art machine learning models. What makes them so special in the eyes of image classifiers? In this paper, we show empirically that adversarial examples mainly lie in the low probability regions of the training distribution, regardless of attack types and targeted models. Using statistical hypothesis testing, we find that modern neural density models are surprisingly good at detecting imperceptible image perturbations. Based on this discovery, we devised PixelDefend, a new approach that purifies a maliciously perturbed image by moving it back towards the distribution seen in the training data. The purified image is then run through an unmodified classifier, making our method agnostic to both the classifier and the attacking method. As a result, PixelDefend can be used to protect already deployed models and be combined with other model-specific defenses. Experiments show that our method greatly improves resilience across a wide variety of state-of-the-art attacking methods, increasing accuracy on the strongest attack from 63% to 84% for Fashion MNIST and from 32% to 70% for CIFAR-10.

Subfields: Artificial Intelligence, Molecular Biology, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Molecular Biology

In Safety, Robustness & Interpretability

Citations in the corpus

Your Classifier is Secretly an Energy Based Model and You Should Treat it Like One (2019, methodology): “This insight has been used to detect and robustly classify adversarial examples with generative models (Song et al., 2017; Li et al., 2018; Fetaya et al., 2019).”
Generative Modeling by Estimating Gradients of the Data Distribution (2019, background): “To list a few, they have been used to generate high-fidelity images [26, 6], synthesize realistic speech and music fragments [58], improve the performance of semi-supervised learning [28, 10], detect adversarial examples and other anomalous data [54], imitation learning [22], and explore promising s”
Adversarial Example Games (2020, methodology): “On the other hand obfuscation methods rely on masking the input gradient needed by an attacker to construct adversarial examples [60, 10, 32, 18].”
Feature Purification: How Adversarial Training Performs Robust Deep Learning (2020, background): “Since the original discovery of “adversarial examples”, a large body of works have been done emphasizing how to improve the robustness of the deep learning models against such perturbations [44, 63, 64, 83, 89].”
Certified Robustness to Adversarial Examples with Differential Privacy (2018, methodology): “These defenses include model distialltion [44], automated detection of adversarial examples [22], [41], [40], application of different input transformations [27], [10], randomization [21], [11], and application of generative models [49], [25], [60].”
Adversarial Training for Free! (2019, background): “…to [Goodfellow et al., 2015 [Xie et al., 2019], Defensive Quantization [Lin et al., 2019], Thermometer Encoding [Buckman et al., 2018], PixelDefend [Song et al., 2017], Robust Manifold Defense [Ilyas et al., 2017], L2-nonexpansive nets [Qian and Wegman, 2018], Jacobian Regularization [Jakubovitz…”
Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples (2018, methodology): “Song et al. (2018) propose using a PixelCNN generative model to project a potential adversarial example back onto the data manifold before feeding it into a classifier.”
The Robust Manifold Defense: Adversarial Training using Generative Models (2017, neutral): “The second related paper is PixelDefend [44].”
Towards Robust Neural Networks via Random Self-ensemble (2017, background): “It is worth mentioning that there are many defense algorithms ( r.f. [3,19,13,8,36,27,25]) against white box attacks in literature.”
Evolving Robust Neural Architectures to Defend from Adversarial Attacks (2019, background): “fast attack for the robustness evaluation of architectures. Details of the attacks are explained at [38]. still vulnerable to attacks [36]. Many recent variations of defenses were proposed [20], [11] [32], which are carefully analyzed and many of their shortcomings explained in [1],[37]. In this pap”
Generalization in anti-causal learning (2018, background): “Experiments: Wang et al. (2017); Samangouei et al. (2018); Song et al. (2017); Ilyas et al. (2017) increase robustness against adversarial examples, by learning a generative (causal) model and synthesizing images until a match for the input is found.”
Towards the first adversarially robust neural network model on MNIST (2018, methodology): “• Manifold projections: An input sample is projected onto a learned data manifold (Samangouei et al., 2018; Ilyas et al., 2017; Shen et al., 2017; Song et al., 2018).”
Theoretically Principled Trade-off between Robustness and Accuracy (2019, background): “, 2017), computer vision (Song et al., 2018; Xie et al., 2017; Meng & Chen, 2017), natural language processing (Jia & Liang, 2017), and many other domains.”
Maximum Likelihood Training of Score-Based Diffusion Models (2021, background): “Since better likelihoods are useful for applications including compression [21, 20, 51], semi-supervised learning [10], adversarial purification [47], and comparing against likelihood-based generative models, we seek a training objective for score-based diffusion models that is as efficient as score”
Are adversarial examples inevitable? (2018, background): “A number of papers have looked at sparse adversarial examples, in which a small number of image pixels, in some cases only one (Su et al., 2017), are changed to manipulate the class label. To study this case, we would like to investigate adversarial examples under the `0 metric. The `0 distance is d”
Are Labels Required for Improving Adversarial Robustness? (2019, background): “While to our knowledge, this question has not been directly studied, several works such as [16, 33, 35] propose using generative models to detect or denoise adversarial examples, which can in principle be learned on unlabeled data.”