Adversarial Defense by Restricting the Hidden Space of Deep Neural Networks

Abstract

Deep neural networks are vulnerable to adversarial attacks, which can fool them by adding minuscule perturbations to the input images. The robustness of existing defenses suffers greatly under white-box attack settings, where an adversary has full knowledge about the network and can iterate several times to find strong perturbations. We observe that the main reason for the existence of such perturbations is the close proximity of different class samples in the learned feature space. This allows model decisions to be totally changed by adding an imperceptible perturbation in the inputs. To counter this, we propose to class-wise disentangle the intermediate feature representations of deep networks. Specifically, we force the features for each class to lie inside a convex polytope that is maximally separated from the polytopes of other classes. In this manner, the network is forced to learn distinct and distant decision regions for each class. We observe that this simple constraint on the features greatly enhances the robustness of learned models, even against the strongest white-box attacks, without degrading the classification performance on clean images. We report extensive evaluations in both black-box and whitebox attack scenarios and show significant gains in comparison to state-of-the art defenses 1 .

Adversarial Dual Network Learning With Randomized Image Transform for Restoring Attacked Images

“…Reference [32] proposed an efficient approach that bring adversarial samples onto the natural image manifold, restoring classification towards correct classes. Reference [33] maximally separated the polytopes of classes by force to learn distinct and distant decision regions for each classes.…”

Towards Certifiable Adversarial Sample Detection

“…Adversarial training adds adversarial samples to the training process, helping the model to learn how to deal with an attacker [15,27]. Pang et al use an ensemble of models to increase decision robustness [38], while Mustafa et al use class-wise disentanglement to restrict feature maps crossing the decision boundaries [37]. However, Schott et al showed that even building robust classification on the small MNIST data remains an unsolved problem [41].…”

A useful taxonomy for adversarial robustness of Neural Networks

“…There have been several recent papers showing that using metric learning loss functions during training helps in making neural networks more robust to adversarial examples [22][23][24].…”

“…Mustafa, et al [23], used their own variation of the contrastive center-loss [25], that encourages both intra-class compactness and inter-class separation of the feature vectors or logits, which are the activations from the last hidden layer. The center loss [26], is a loss function that encourages the feature vectors for each class to lie close to each other (i.e., it encourages intraclass compactness) and the contrastive center-loss function is a generalization of it that also encourages interclass separation.…”