Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models

By Pouya Samangouei, Maya Kabkab, Ramalingam Chellappa. 2018

1,276 citations recorded by the source corpus.

In recent years, deep neural network approaches have been widely adopted for machine learning tasks, including classification. However, they were shown to be vulnerable to adversarial perturbations: carefully crafted small perturbations can cause misclassification of legitimate images. We propose Defense-GAN, a new framework leveraging the expressive capability of generative models to defend deep neural networks against such attacks. Defense-GAN is trained to model the distribution of unperturbed images. At inference time, it finds a close output to a given image which does not contain the adversarial changes. This output is then fed to the classifier. Our proposed method can be used with any classification model and does not modify the classifier structure or training procedure. It can also be used as a defense against any attack as it does not assume knowledge of the process for generating the adversarial examples. We empirically show that Defense-GAN is consistently effective against different attack methods and improves on existing defense strategies. Our code has been made publicly available at this https URL

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Generative Models, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Generative Models

In Safety, Robustness & Interpretability

Citations in the corpus

GAN Inversion: A Survey (2021, background): “In contrast, adversarial defense [152], [153] aims at preventing the model from being fooled by attackers.”
Certified Robustness to Adversarial Examples with Differential Privacy (2018, methodology): “These defenses include model distialltion [44], automated detection of adversarial examples [22], [41], [40], application of different input transformations [27], [10], randomization [21], [11], and application of generative models [49], [25], [60].”
Exploiting Excessive Invariance caused by Norm-Bounded Adversarial Robustness (2019, methodology): “In order to alleviate the need for human inspection of each candidate x∗i to determine which of these potential adversarial examples is actually misclassified, we follow an approach from Defense-GAN Samangouei et al. (2018) and the Robust Manifold Defense Ilyas et al. (2017): we take the generator f”
Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples (2018, methodology): “Defense-GAN (Samangouei et al., 2018) uses a Generative Adversarial Network (Goodfellow et al., 2014a) to project samples onto the manifold of the generator before classifying them.”
Theoretical evidence for adversarial robustness through randomization: the case of the Exponential family (2019, background): “Since the initial discovery of adversarial examples, a wealth of non randomized defense approaches have also been proposed, inspired by various machine learning domains such as adversarial training [18, 27], image reconstruction [29, 39] or robust learning [18, 27].”
Parametric Noise Injection: Trainable Randomness to Improve Deep Neural Network Robustness Against Adversarial Attack (2018, background): “Most of the later works [19, 36] have followed this path to supplement their defense with adversarial training.”
The Robust Manifold Defense: Adversarial Training using Generative Models (2017, methodology): “While we were writing this paper we found two related submissions appearing online: The most closely related concurrent work is the DefenseGAN [3], submitted to ICLR, that proposes a very similar method to INC, independently from our work.”
Towards Robust Neural Networks via Random Self-ensemble (2017, neutral): “[3, 19, 13, 8, 36, 27, 25]) against white box attacks in literature.”
Generalization in anti-causal learning (2018, background): “Experiments: Wang et al. (2017); Samangouei et al. (2018); Song et al. (2017); Ilyas et al. (2017) increase robustness against adversarial examples, by learning a generative (causal) model and synthesizing images until a match for the input is found.”
Towards the first adversarially robust neural network model on MNIST (2018, methodology): “• Manifold projections: An input sample is projected onto a learned data manifold (Samangouei et al., 2018; Ilyas et al., 2017; Shen et al., 2017; Song et al., 2018).”
Theoretically Principled Trade-off between Robustness and Accuracy (2019, methodology): “We also evaluate our robust model on MNIST dataset under the same threat model as in (Samangouei et al., 2018) (C&W white-box attack Carlini & Wagner (2017)), and the robust accuracy is 99.”
Adversarial vulnerability for any classifier (2018, background): “This approach has recently been found to be successful in increasing the robustness of classifiers when accurate generative models can be learned in [35].”
Are adversarial examples inevitable? (2018, background): “, 2017), and using a generative model as a defense (Samangouei et al., 2018).”
Are Labels Required for Improving Adversarial Robustness? (2019, background): “While to our knowledge, this question has not been directly studied, several works such as [16, 33, 35] propose using generative models to detect or denoise adversarial examples, which can in principle be learned on unlabeled data.”
Constructing Unrestricted Adversarial Examples with Generative Models (2018, background): “These include augmenting training data with adversarial examples [2, 9, 10, 11], removing adversarial perturbations [12, 13, 14], and encouraging smoothness for the classifier [15].”
Adversarial Attacks and Defences: A Survey (2018, methodology): “[63] proposed a mechanism to use Generative Adversarial Network as a countermeasure for adversarial perturbations.”
Disentangling Adversarial Robustness and Generalization (2018, methodology): “First, we showed that regular adversarial examples indeed leave the manifold, as widely assumed in related work [27, 99, 39, 72, 82].”