Title: FEATURIZED BIDIRECTIONAL GAN: ADVERSARIAL DEFENSE VIA ADVERSARIALLY LEARNED SEMANTIC INFERENCE

Abstract: Deep neural networks have been demonstrated to be vulnerable to adversarial attacks, where small perturbations intentionally added to the original inputs can fool the classifier. In this paper, we propose a defense method, Featurized Bidirectional Generative Adversarial Networks (FBGAN), to extract the semantic features of the input and filter the non-semantic perturbation. FBGAN is pre-trained on the clean dataset in an unsupervised manner, adversarially learning a bidirectional mapping between the high-dimensional data space and the low-dimensional semantic space; also mutual information is applied to disentangle the semantically meaningful features. After the bidirectional mapping, the adversarial data can be reconstructed to denoised data, which could be fed into any pre-trained classifier. We empirically show the quality of reconstruction images and the effectiveness of defense.

1. INTRODUCTION:

The existence of adversarial examples causes serious security concern about reliability of deep neural networks (DNN). DNN may mislabel the perturbed images with high confidence even though the perturbation is too small to be recognized by human. Moreover, adversarial examples will often fool several models simultaneously, even if these models have different architectures (Szegedy et al., 2014) . One possible explanation is that when recognizing images, human usually catch highlevel and semantic features, such as the shape of the digits in MNIST dataset, which are robust under small perturbation; DNN may easily catch low-level and weak features, such as the gray-scale values of certain area in the images, which are non-robust when the pixel-wise perturbation accumulates (Tsipras et al., 2018) .

Most previous adversarial defense methods fall into two classes: adversarial training and gradient masking. Adversarial training methods (Szegedy et al., 2014; Tramèr et al., 2017; Madry et al., 2017; Sinha et al., 2017) apply adversarial perturbations on training data online, and feed both the clean data and the adversarial data to train the classifier, i.e., solve a minimax game iteratively. However, it is flawed by the high computational cost to generate adversarial examples, especially for more complex dataset and harder attacks. Gradient masking methods modify the architecture of the classifier such that the attacker cannot get useful gradient information of the inputs. One example is the thermometer encoding (Buckman et al., 2018) which preprocesses the input in a one hot vector, and such discretization prevent the attacker from backpropagating through the input to calculate the adversarial purtabation. However, Athalye et al. (2018) shows that gradient masking methods can be circumvented and lead to a false sense of security in defenses against adversarial attacks.

Both of adversarial training and gradient masking methods defend adversarial attacks by improving the classifier. We take another approach by denoising the adversarial examples without changing the classifier (Meng & Chen, 2017; Ilyas et al., 2017; Liao et al., 2018) . Our defense is motivated by human cognition process. The fact that adversarial examples cannot fool human suggests that human do classification based on some semantic features that are unchanged after the perturbation. Hence, it is natural to extract those semantic features and doing the inference solely based on semantic information. One closely related work is Defense-GAN (Samangouei et al., 2018) , which trains a GAN (Goodfellow et al., 2014a) to generate the manifold of unperturbed images, then finds the nearest point on the manifold to the adversarial example as the denoising result. While it is a novel way to leverage generative model to filter the adversarial perturbation, it takes iterations to search the nearest point on the manifold, which is time consuming.

In this paper, we propose Featurized Bidirectional GAN (FBGAN), an encoding and generative model that extracts the semantic features of the input images (either original or perturbed), and reconstructs the unperturbed images from these features. We take advantage of the generative capability of Bidirectional GAN (Donahue et al., 2016; Dumoulin et al., 2016) , where an encoder is learned to map the input to its latent codes directly, instead of doing the manifold search iterations. Inspired by InfoGAN (Chen et al., 2016) , we maximize the mutual information (MI) between all the latent codes and the generated images. The MI regularization can significantly reduce the dimension of latent space, as well as disentangle the semantic features of inputs in different components of the latent codes, e.g., the tilt angle and stroke thickness of digits in MNIST. We call the MIenhanced latent codes as semantic codes (Figure 1 ). FBGAN is pre-trained on the clean dataset in an unsupervised manner. With the feature-extraction and reconstruction procedure, we can denoise the adversarial examples and fed them into any pre-trained classifier, which shows effective defense against both white-box and gray-box attacks (see section 4 for details).

Our contribution:

1. FBGAN depicts a bidirectional mapping between a high-dimensional data space and a low-dimensional semantic latent space. We can extract the semantic features of the images, which is unchanged after the adversarial perturbation; we can also generate new images with indicated semantic features, such as the category and tilt angle of the digits.

2. We denoise the adversarial example by extracting semantic features and reconstructing via FBGAN. This defense method is shown to be effective for any given pre-trained classifier under both white-box and gray-box attacks.

2. PRELIMINARIES 2.1 GENERATIVE ADVERSARIAL NETWORKS AND ITS DERIVATIVES:

Generative Adversarial Networks GAN (Goodfellow et al., 2014a ) is a generative model to learn high-dimensional data distribution via an adversarial process. Instead of modeling the probability density function, GAN learns a generator G which is a mapping from low-dimensional latent space Ω z to high-dimensional data space Ω x . Then a standard distribution (usually Gaussian) z ∼ P z in the latent space can be transferred into the distribution G(z) ∼ P G in the data space. P G is supposed to approximate the objective data distribution P x , thus a discriminator D is proposed to distinguish between samples from P x and P G . The generator G and discriminator D are represented by DNN and updated in the following minimax game: min

EQUATION

It can be shown that the theoretical optimal discriminator D satisfies:

EQUATION

where P (•) denotes the probability density of distribution P , and D JS is the Jensen-Shannnon divergence between two distribution. Thus the theoretical optimal generator G will recover the data distribution, i.e. P G = P x .

Bidirectional GAN BiGAN (Donahue et al., 2016; Dumoulin et al., 2016) considers the inverse mapping of the generator to learn the latent codes z as feature representation given data x. The encoder E is introduced as a mapping from data space Ω x to latent space Ω z , and the discriminator takes a tuple of data point and latent codes (x, z) as inputs, distinguishing between the joint distribution of (x, E(x)) and (G(z), z). The minimax objective becomes min

EQUATION

The optimal condition for D is replacing P x and P G by P x,E(x) and P G(z),z in (2). The optimal encoder and generator can guarantee

G (E (x)) = x for x ∈ Ω x and E (G (z)) = z for z ∈ Ω z .

InfoGAN InfoGAN (Chen et al., 2016) is an extension of GAN that is able to learn disentangled semantic representation. For example, one discrete latent code may represent the class of the image while another continuous code may control tilt angles. InfoGAN decomposes the latent codes into two parts z = (c, z ) where the semantic codes c target the meaningful features, and noise codes z which stand for incompressible noise. Then an information-theoretic regularization is introduced to maximize MI between semantic codes c and generated G(c, z ): min

EQUATION

where the mutual information I(c; x) = H(c) -H(c|x) and H is the entropy.

2.2. ADVERSARIAL ATTACKS:

In the image classification task, given a vectorized clean image x ∈ [0, 1] d , a classifier C will output a label y = C(x). All adversarial attacks aim to find a small perturbation ρ to fool the classifier such that C(x + ρ) = y (Szegedy et al., 2014) . It can be formulated as

min ρ ρ , s.t. x + ρ ∈ [0, 1] d , C(x + ρ) = y.

Various attacking algorithms have been proposed to fool DNN (Akhtar & Mian, 2018; Papernot et al., 2016) , and here are two most famous attacks.

Fast Gradient Sign Method FGSM (Goodfellow et al., 2014b ) is a single-step attack. Let L(x, y) be the loss function of the classifier C given input x and label y. FGSM defines the perturbation ρ as ρ = ε • sign(∇ x L(x, y)), where ε is a small scalar. FGSM simply chooses the sign of change at each pixel to increase the loss L(x, y) and fool the classifier.

Projected Gradient Descent PGD (Madry et al., 2017) is a more powerful multi-step attack with projected gradient descent:

x PGD 0 = x, x PGD t+1 = Π S x PGD t + α • sign ∇ x L(x PGD t , y)

where Π S is the projection onto S = {x : xx ∞ ≤ ε}.

3. FEATURIZED BIDIRECTIONAL GAN:



3.1. ROUTE MAP:

We use BiGAN framework to adversarially learn the bidirectional feature mapping, and MI regularization to reduce the dimension of semantic codes and disentangle the semantic features. In adversarial defense task, first we train FBGAN on clean dataset, which is an unsupervised learning for semantic encoder E and image generator G. Second, given a pre-trained classifier C and adversarial data x, we reconstruct x as x = G(E(x)) to filter the non-semantic noise, then feed x to the classifier and use C(x) as the prediction.

3.2. FORMULATION:

BiGAN provides a good approach to map high-dimensional image data x to low-dimensional latent codes z = E(x), yet it has no restriction on the semantic meaning of the latent codes z. To eliminate the non-semantic noise in adversarial examples, we maximize mutual information between latent codes z and generated G(z). Unlike InfoGAN where the latent codes is decomposed into semantic codes and incompressible noise z = (c, z ) and only I(c; G(c, z )) is maximized, here we regard all latent codes as semantic and maximize I(z, G(z)) directly. Although the former method may improve the diversity of the generation, our method focuses on the main semantic features which is more robust under adversarial attack.

To maximize the mutual information I(z; G(z)), we use Variational Information Maximization technique. Suppose the underlying joint distribution is (x, z) ∼ P , then

I(z; x) = H(z) -H(z|x) = H(z) + E P [log P (z|x)] = H(z) + max Q E P [log Q(z|x)],

where Q is taken over all possible joint distributions of (x, z). Assume that each semantic codes z contain one categorical code z c and n continuous codes z 1 , . . . , z n . Assume that

Q(•|x) is a factored distribution Q(z|x) = Q c (z c |x) n i=1 Q i (z i |x). For the categorical code, rewrite the discrete probability Q c (•|x) as a vector ϕ c (x), i.e. ϕ c (x) k = Q c (z c = k|x), then log Q c (z c |x) = -H(z c , ϕ c (x))

where H is the cross entropy of two vectors regarding z c as a one-hot vector. For the continuous codes, assume Q i (•|x) is a Gaussian N (ϕ i (x), σ 2 ) for fixed variance σ. Now, define MI gap as the following distance

dist(z, ϕ(x)) := -log Q(z|x) = H(z c , ϕ c (x)) + C n i=1 z i -ϕ i (x) 2 (5)

where ϕ is the concatenation of (ϕ c , ϕ 1 , . . . , ϕ n ) and C is a constant. Note that the MI gap is a useful approach to maximize MI between two variables.

In the defense task, we want to pay more attention to the encoding E(x) and reconstruction G(E(x)) on given data x, and take the pair (G(E(x)), E(x)) into consideration. Therefore, FB-GAN has the following objective function (as illustrated in Figure 1 ) Figure 2 shows the implementation of FBGAN. E, G and D take the standard BiGAN architectures (Dumoulin et al., 2016) . We replace all ReLU activation with ELU in E and G for smoothness, and use weight normalization instead of batch normalization in order to ensure E(x) and G(z) depend only on x and z instead of the whole minibatch (Kumar et al., 2017) . E are trained by feature matching methods, while G and D are trained by the original GAN loss objectives (Salimans et al., 2016) . The hyperparameter λ = 1. In relatively complicated dataset such as SVHN, we add an auto-encoder term E x∼Px G(E(x)) -x 2 in the objective function for only the last 1% training steps to further improve the reconstruction quality.

min G,E,ϕ max D VFBGAN(D, G, E) := Ex log D(x, E(x)) + 1 2 Ez log(1 -D(G(z), z)) + Ex log(1 -D(G(E(x)), E(x))) + λEz dist(z, ϕ(G(z))).

4. EXPERIMENTS:

We present our results in two parts: (1) Representing capability of semantic codes. We can store the information of an image by a few number of semantic codes, and the reconstruction from the codes keep the main features as the original one. ( 2) Defenses against gray-box and white-box attacks. In this paper, we call gray-box attacks as having access only to the original classifier architectures and parameters; white-box attacks are those have access to both of the classifier and FBGAN details.

We focus on three datasets in our experiments: the MNIST hand-written digits dataset (LeCun et al., 1998) , Fashion MNIST (FMNIST) dataset (Xiao et al., 2017) , and the Street View House Numbers (SVHN) dataset (Netzer et al., 2011) .

4.1. SEMANTIC REPRESENTATION:

FBGAN can present the semantic features of MNIST by one ten-dimensional categorical code and only four continuous codes, and FMNIST by one ten-dimensional categorical code and eight continuous codes. Previous related works require much higher latent space dimenssion. For example in InfoGAN, one ten-dimensional categorical code and three continuous codes and 128 random noises codes are used.

Categorical code can learn the most significant modes in a data distribution. For example, the ten-categorical code in MNIST / FMNIST represents ten different digits / fashion products. The continuous codes can finely tune the more detailed features of a certain mode. Figure 3 shows ten MNIST digits generated by FBGAN and the effect of tuning different continues codes.

We observe that the reconstruction of MNIST and FMNIST datasets are of high qualities. The encoder first encodes a semantic representation, which is then fed into the generator. The reconstructed image not only maintains the category, but also detailed features as the input.

4.2. ADVERSARIAL DEFENSES:



4.2.1. DEFENSES AGAINST GRAY-BOX ATTACKS:

In gray-box attacks, the attacker can only access to the classifier, but have no information about the FBGAN filter. Hence we prepare our adversarial data by using FGSM and PGD methods to directly attack trained classifiers. The classifier tested on the original MNIST dataset has accuracy of 99.26%, and the classifier tested on the original FMNIST dataset has accuracy of 91.16%. Table 1 shows our defense effect against different methods with different ε values. As shown in Figure 4 , given adversarial examples generated by PGD method with ε = 0.3, we have the reconstructed images with categories and main features maintained, and there are no more attack noises there. 

4.2.2. DEFENSES AGAINST WHITE-BOX ATTACKS:

In white-box case, the attacker can access not only the classifier but also the FBGAN filter. The original data x is fed through the encoder E, the generator G and the classifier C to output C(G(E(x))) as the classification. Since E, G and C are all represented as DNN, the whole structure is a large DNN and regraded as the objective of white-box attacks.

We implement white-box defense on MNIST and FMNIST with FBGAN having one ten-categorical code and eight continuous codes. A regularization is added to the encoded semantic codes z = E(x): for the categorical code which is represented by a 10-dimensional probability vector, we replace it by the corresponding one-hot vector; for the continuous codes, we clip them between [-1, 1].

Regularizing the categorical codes can map the original input to its conterpart in the generated space, and clipping the continuous codes is to eliminate the influence of those low probability outliers. The results are shown in Figure 4 and Table 1 , where the accuracy is above 82% on MNIST and 44% on FMNIST with adversarial perturbation ε = 0.3.

4.3. COMPARISON WITH BIGAN AND INFOGAN:

BiGAN and InfoGAN are generative models aiming to produce new detailed data, while FBGAN is a defense model aiming to regenerate data with semantic features. The main novelty of FBGAN lies in combining the bidirectional mapping structure and feature extraction capability for the purpose of adversarial defense. The most important improvement from BiGAN and InfoGAN to FBGAN is the significant reduction of the number of semantic codes by applying MI regularization on all the semantic codes. BiGAN and InfoGAN require larger latent space to ensure the quality and diversity of the generation, and the semantic features are stored in latent codes in a highly entangled way; FBGAN requires much smaller latent space to catch the basic semantic features which is robust under attacks. For example, BiGAN and InfoGAN both employ at least 128 codes to represent and regenerate data of MNIST, while FBGAN reduces the number to 10 categorical codes and 4 Vanilla BiGAN without MI regularization cannot disentangle the semantic features. Theoretically, if BiGAN achieved its optimal solution, the minimization of JS divergence D JS (P x,E(x) P G(z),z ) would ensure that H(z|G(z)) = 0 and all latent codes are effective. However, experiments show that BiGAN cannot minimize the conditional cross entropy, and the latent codes cannot disentangle the semantic features automatically (Figure 6 ). Thus it is necessary to apply explicit MI regularization.

5. DISCUSSION:

Nonetheless, the effectiveness of our FBGAN model against adversarial attacks are highly dependent on the reconstruction accuracy. It is also challenging to get a high reconstruction accuracy without over-fitting the training data. For example, in SVHN, we apply 4 ten-dimensional categorical codes and 128 continuous codes; however, its white-box defense accuracy is much worse than that of MNIST and FMNIST. We consider the various performances with different datasets as the fact that SVHN dataset has much more modes than the rest two datasets have. Even though the features within one category are quite different, for example different images of number one, the background of an image adds a large number of extra features to the object, which makes mode separation much harder. In contrast, MNIST and FMNIST dataset with all black background could be separated via fewer categorical codes. In our opinion, if we can find the suitable number of categorical codes, the performance of our model will be improved.

:



Figures and Tables:

Figure1: (a) The semantic features of images should be unchanged before and after the adversarial perturbation. Via FBGAN, original, adversarial and reconstructed images are encoded to similar semantic codes. Each column stands for the ten-categorical code that related to the classification of an image (see section 3 for details). Here all three images are classified as "7" from categorical codes. (b) Besides a discriminator D and a generator G in the vanilla GAN, we add an encoder E mapping from the data space to the latent space, and the discriminator D takes a tuple (x, z) as input. There are three types of tuple (x, z): (x, E(x)) for x ∼ P x , (G(z), z) for z ∼ P z and (G(E(x)), E(x)) for x ∼ P x ; the discriminator D treats the first type as real and the other two as fake. Mutual information between latent codes z and generated G(z) is maximized in order to disentangle the semantic features.

Figure 2: Implementation The encoder E(x) is a convolutional network and the generator G(z) is a deconvolutional network. The discriminator D(x, z) shares parameters with the auxiliary function ϕ(x). z = (z c , z 1:n ) stands for the categorical and continuous codes.

Figure 3: Manipulating semantic codes on MNIST and FMNIST Images generated by one ten-dimensional categorical code and eight continuous codes. (a) and (c) demonstrate that we can generate any category of images by changing the categorical codes. (b) and (d) are the effects of continuous codes: each row shows how the generated image changes when tuning one continuous codes with all other codes fixed.

Figure 4: Reconstruction of MNIST and FMNIST The first two rows are the original test set images and their reconstructions; the middle two rows are the gray-box adversaries and their reconstructions; the last two rows are the white-box adversaries and their reconstructions. All the adversaries are from PDG with purtabation ε = 0.3.

Figure 5: Generation and reconstruction of SVHN (a) and (c) are generated images by changing the categorical codes and continuous codes respectively, similar to Figure 3. We observe that the continuous codes shown in (c) control: the blurriness (from clear to blurry), brightness (from bright to dark), background color (from green to brown) and the feature on the edge. (b) and (d) are the adversarial defense results. (b) shows the accuracy on clean, adversarial and reconstructed images, similar to Table 1. In (d), the first two rows are the clean images and their reconstructions, and the last two rows are the gray-box adversaries (PGD, ε = 0.1) and their reconstructions. The semantic codes consist 4 ten-categorical codes and 128 continuous codes.

Figure 6: Performance of vanilla BiGAN (a) illustrates MI gap (5) of the categorical code, where FBGAN converges fast but BiGAN does not. (b) and (c) are generated images by changing the categorical code and continuous codes, similar to Figure 3. The semantic features are entangled in the latent codes of BiGAN.

Classification accuracy (%) under different attack and defense methods for MNIST and FMNIST. The perturbation ε is in l ∞ norm. FBGAN here uses one ten-dimensional categorical code and 8 continuous codes. Gray-box attacks only apply to noise-filtering-type defense, and we compare FBGAN and Defense-GAN under the same setting. For white-box attack, the adversarial training with PGD ε = 0.3 is one of the state of the art results. Although better than FBGAN, adversarial training has its limitation: if the attack method is harder than the one used in training (PGD is harder than FGSM), or the perturbation is larger, then the defense may totally fail. FBGAN is effective and consistent for any given classifier, regardless of the attack method or perturbation.

Table content: <table><tr><td/><td/><td/><td colspan="2">Gray-box</td><td/><td colspan="2">White-box</td><td/></tr><tr><td colspan="2">Attack ε</td><td>No defense</td><td>FBGAN</td><td>Defense GAN</td><td>FBGAN</td><td>Adv train FGSM 0.3</td><td>Adv train PGD 0.1</td><td>Adv train PGD 0.3</td></tr><tr><td/><td/><td/><td/><td colspan="2">MNIST</td><td/><td/><td/></tr><tr><td>Clean</td><td>0</td><td>99.3</td><td>97.6</td><td>93.6</td><td>97.6</td><td>99.2</td><td>99.5</td><td>98.8</td></tr><tr><td colspan="2">FGSM 0.1</td><td>78.2</td><td>96.6</td><td>95.2</td><td>93.4</td><td>97.4</td><td>97.9</td><td>97.6</td></tr><tr><td colspan="2">FGSM 0.3</td><td>18.9</td><td>87.0</td><td>82.0</td><td>82.8</td><td>94.4</td><td>83.1</td><td>96.0</td></tr><tr><td colspan="2">PGD 0.1</td><td>10.5</td><td>96.3</td><td>94.7</td><td>91.7</td><td>83.0</td><td>96.1</td><td>97.3</td></tr><tr><td colspan="2">PGD 0.3</td><td>0.6</td><td>90.9</td><td>93.2</td><td>88.6</td><td>3.9</td><td>29.2</td><td>94.0</td></tr><tr><td/><td/><td/><td/><td colspan="2">FMNIST</td><td/><td/><td/></tr><tr><td>Clean</td><td>0</td><td>91.2</td><td>82.2</td><td>78.0</td><td>82.2</td><td>91.4</td><td>89.9</td><td>91.0</td></tr><tr><td colspan="2">FGSM 0.1</td><td>24.2</td><td>76.3</td><td>52.6</td><td>62.7</td><td>82.6</td><td>81.0</td><td>75.9</td></tr><tr><td colspan="2">FGSM 0.3</td><td>9.1</td><td>41.0</td><td>38.9</td><td>49.2</td><td>89.4</td><td>42.4</td><td>74.4</td></tr><tr><td colspan="2">PGD 0.1</td><td>5.9</td><td>76.9</td><td>62.6</td><td>50.5</td><td>12.1</td><td>71.7</td><td>61.8</td></tr><tr><td colspan="2">PGD 0.3</td><td>5.7</td><td>58.8</td><td>62.6</td><td>44.2</td><td>5.6</td><td>7.1</td><td>68.1</td></tr></table>

Peer review (iclr2019):
 This work proposes to defend against adversarial examples by “denoising” the input image through an autoencoder (a BiGAN trained similar to InfoGAN) before classifying it with a standard CNN. The robustness of the model is evaluated on the L_infinity metric against FGSM and PGD. My main criticism is as follows: * Novelty: several defences are based on a similar principle and the contributions of this paper are unclear. * Insufficient evidence: The evaluation is minimal (only FGSM and PGD, no decision-, transfer- or score-based attacks) and insufficient to support the claims. * Gradient masking: There is at least one clear sign of gradient masking in the results (FGSM performing better than PGD). ### Novelty The only prior work against which the paper compares is DefenseGAN. The only advantage over DefenseGAN being stated is performance (because no intermediate optimisation step is used). However, besides DefenseGAN there are several other defences that project the input onto the learned manifold of “natural” inputs, including (see prior work section in [1] for an up-to-date list): * Adversarial Perturbation Elimination GAN * Robust Manifold Defense * PixelDefend (autoregressive probabilistic model) * MagNets ### Insufficient evidence The only attacks employed are two gradient-based techniques (FGSM and PGD). It is known that gradient-based techniques may suffer from gradient-masking (see also next point) and that the effectiveness of different attacks various greatly (which is why one should use many different attacks). Hence, a full evaluation of the model should include score-based and decision-based attacks. ### Gradient masking In Figure 5 (b) the FGSM attack performs better than PGD for epsilon = 0.05 (66.4% vs 71.5%). PGD, however, should be strictly more powerful than FGSM if the gradients and the hyperparameters are ok. Gradient masking is the primary reason for why 95% of all proposed defences turned out to be ineffective, and there are good reasons to believe that the same might affect this defence. The robustness evaluation has to be much more thorough and convincing before any substantiated claims about the bidirectional architecture proposed here can be derived. In addition, the difference to prior work has to be made much clearer. [1] Schott et al. “Towards the first adversarially robust neural network model on MNIST”