Sparsity-based Defense Against Adversarial Attacks on Linear Classifiers

Abstract

Deep neural networks represent the state of the art in machine learning in a growing number of fields, including vision, speech and natural language processing. However, recent work raises important questions about the robustness of such architectures, by showing that it is possible to induce classification errors through tiny, almost imperceptible, perturbations. Vulnerability to such "adversarial attacks", or "adversarial examples", has been conjectured to be due to the excessive linearity of deep networks. In this paper, we study this phenomenon in the setting of a linear classifier, and show that it is possible to exploit sparsity in natural data to combat ∞-bounded adversarial perturbations. Specifically, we demonstrate the efficacy of a sparsifying front end via an ensemble averaged analysis, and experimental results for the MNIST handwritten digit database. To the best of our knowledge, this is the first work to show that sparsity provides a theoretically rigorous framework for defense against adversarial attacks.

Combatting Adversarial Attacks through Denoising and Dimensionality Reduction: A Cascaded Autoencoder Approach

“…Previous studies have investigated the effectiveness of using sparsity as a defense against such adversarial perturbations. For example, Z. Marzi et al [5] shows that enforcing sparsity by taking the K out of N largest elements in magnitude, and zeroing the rest, for an inputted classifier sample in the wavelet domain, successfully decreases the misclassification caused by an adversarial attack on a Support Vector Machine (SVM). Furthermore, A. N. Bhagoji et al [6] shows that projecting high dimensional data onto a lower dimensional subspace using Principle Component Analysis (PCA) is effective in decreasing adversarial success.…”

“…More specifically, the injection of visually imperceptible l 2 and l ∞ bounded perturbations into the input testing data has shown to render even the most robust classifiers useless. For example, both Support Vector Machines (SVMs) and Artificial Neural Networks with robust classification metrics have resulted in nearly 0% accuracy when processing perturbed data [5] [6]. This paper presents novel defense strategies, which are not only capable of combatting such adversarial attacks, but are also more robust than current standards in the literature.…”

Selectivity and robustness of sparse coding networks

“…Although we do not provide decision-based attack results, other empirical work suggests that robustness in this regime can be improved with population nonlinearities, sparsity, and recurrence. For example, robustness to decision-based attacks has been shown by imposing sparsification ( Marzi, Gopalakrishnan, Madhow, & Pedarsani, 2018 ; Alexos, Panousis, & Chatzis, 2020 ), recurrence ( Krotov & Hopfield, 2018 ; Yan et al, 2019 ), and specifically with the LCA network ( Springer, Strauss, Thresher, Kim, & Kenyon, 2018 ; Kim, Yarnall, Shah, & Kenyon, 2019 ; Kim, Rego, Watkins, & Kenyon, 2020 ). We offer a theoretical explanation for these findings.…”

Countering Acoustic Adversarial Attacks in Microphone-equipped Smart Home Devices

“…In [41] it was observed that, if the input dimension is huge, even tiny perturbations, distinguishing an original from an adversarial image, can accumulate into an inner product with a weight vector to produce a huge distortion which sets the DNN astray onto a wrong classification. Subsequently, work in [70,71] proposes to combat such dimensionality phenomenon with a sparsifying front end which projects the input towards a lower dimensional space. Alternatively, [72] incorporates a subnetwork trained to distinguish legitimate from adversarial images.…”