Transferability analysis of adversarial attacks on gender classification to face recognition: Fixed and variable attack perturbation

IET BiometricsEarly View ORIGINAL RESEARCHOpen Access Transferability analysis of adversarial attacks on gender classification to face recognition: Fixed and variable attack perturbation Zohra Rezgui, Corresponding Author Zohra Rezgui z.rezgui@utwente.nl orcid.org/0000-0002-4363-114X EEMCS Faculty, Data Management & Biometrics Group, University of Twente, Enschede, The Netherlands Correspondence Zohra Rezgui, EEMCS Faculty, Data Management & Biometrics Group, University of Twente, Drienerlolaan 5, 7522 NB, Enschede, The Netherlands. Email: z.rezgui@utwente.nlSearch for more papers by this authorAmina Bassit, Amina Bassit orcid.org/0000-0002-1331-9702 EEMCS Faculty, Data Management & Biometrics Group, University of Twente, Enschede, The Netherlands EEMCS Faculty, Services and CyberSecurity Group, University of Twente, Enschede, The NetherlandsSearch for more papers by this authorRaymond Veldhuis, Raymond Veldhuis orcid.org/0000-0002-0381-5235 EEMCS Faculty, Data Management & Biometrics Group, University of Twente, Enschede, The Netherlands Department of Information Security and Communication Technology, Norwegian University of Science and Technology, Gjøvik, NorwaySearch for more papers by this author Zohra Rezgui, Corresponding Author Zohra Rezgui z.rezgui@utwente.nl orcid.org/0000-0002-4363-114X EEMCS Faculty, Data Management & Biometrics Group, University of Twente, Enschede, The Netherlands Correspondence Zohra Rezgui, EEMCS Faculty, Data Management & Biometrics Group, University of Twente, Drienerlolaan 5, 7522 NB, Enschede, The Netherlands. Email: z.rezgui@utwente.nlSearch for more papers by this authorAmina Bassit, Amina Bassit orcid.org/0000-0002-1331-9702 EEMCS Faculty, Data Management & Biometrics Group, University of Twente, Enschede, The Netherlands EEMCS Faculty, Services and CyberSecurity Group, University of Twente, Enschede, The NetherlandsSearch for more papers by this authorRaymond Veldhuis, Raymond Veldhuis orcid.org/0000-0002-0381-5235 EEMCS Faculty, Data Management & Biometrics Group, University of Twente, Enschede, The Netherlands Department of Information Security and Communication Technology, Norwegian University of Science and Technology, Gjøvik, NorwaySearch for more papers by this author First published: 27 June 2022 https://doi.org/10.1049/bme2.12082 This paper is an extension of [ 1] published at BIOSIG 2021. AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinked InRedditWechat Abstract Most deep learning-based image classification models are vulnerable to adversarial attacks that introduce imperceptible changes to the input images for the purpose of model misclassification. It has been demonstrated that these attacks, targeting a specific model, are transferable among models performing the same task. However, models performing different tasks but sharing the same input space and model architecture were never considered in the transferability scenarios presented in the literature. In this paper, this phenomenon was analysed in the context of VGG16-based and ResNet50-based biometric classifiers. The authors investigate the impact of two white-box attacks on a gender classifier and contrast a defence method as a countermeasure. Then, using adversarial images generated by the attacks, a pre-trained face recognition classifier is attacked in a black-box fashion. Two verification comparison settings are employed, in which images perturbed with the same and different magnitude of the perturbation are compared. The authors' results indicate transferability in the fixed perturbation setting for a Fast Gradient Sign Method attack and non-transferability in a pixel-guided denoiser attack setting. The interpretation of this non-transferability can support the use of fast and train-free adversarial attacks targeting soft biometric classifiers as means to achieve soft biometric privacy protection while maintaining facial identity as utility. 1 INTRODUCTION The cutting-edge advances in deep learning (DL) have made computer vision problems more approachable. However, neural networks can be unreliable on data unseen during the training, which makes their security questionable. In fact, the majority of DL models are vulnerable to adversarial attacks that, based on subtle perturbations applied to the clean samples, mislead the classifier with high confidence. There has been a number of studies investigating the vulnerabilities of DL-based machine learning systems to different types of adversarial attacks on the input images. The existing attacks can be partitioned into two categories: white-box attacks, where an adversary has full access to the attacked model's parameters, and black-box attacks, where an adversary has no access to such information. Typically, white-box attacks are more powerful than black-box attacks due to their ability to leverage the parameters of the model against its own predictions. In a real-life scenario, a deployed model's parameters would not be accessible leaving the black-box attacks as the only option to disrupt its predictive performance. To benefit from the strength of white-box attacks, Ref. [2, 3] show that it is possible to target a model, where its parameters are known, and transfer the resulting effects on an unknown model, as long as the two models are trained for the same task. Particularly in the field of biometrics, the effectiveness of these attacks should not be overlooked, given the variety of biometric applications such as forensics and border control where wrong predictions are not tolerated. Many biometric applications are inter-connected, specifically those related to the face modality. For instance, there is a plethora of studies showing that different face recognition systems can be enhanced with a soft biometric classifier such as a gender classifier [4]. Similarly, deep face recognition features are known to be discriminative for soft biometric classification [5] via transfer learning. This association motivates us to investigate the potential transferability of adversarial attacks on models that share the same input space but were trained independently to perform different tasks. Previous studies on the transferability of adversarial attacks, however, did not include such a hypothesis because they were solely concerned with same-task transferability. The investigation of this hypothesis could be beneficial in terms of soft biometric privacy. There is usually a trade-off between privacy and utility in privacy applications. Utility specifies how much information we want to keep in the protected data. Indeed, if we consider an adversarial attack to be a privacy mechanism that conceals soft biometric attributes, studying between-task transferability allows us to assess how such a privacy mechanism would impact utility if utility is expressed as the performance of a face recognition classifier. For instance, an effective adversarial attack on a gender classifier that is not transferable to a face recognition system can be used as a privacy protection mechanism to obfuscate gender. This paper is an extension of work originally presented in BIOSIG 2021 [1], where we investigate the transferability of two adversarial attacks against a gender classifier to a face recognition classifier where both classifiers are independently trained and only share the same input space (facial images) and the same model architecture. We start by providing an overview of the hypothesis of transferability between different tasks given the same input space. We then study the impact of two existing gradient-based attacks and deep feature-based defence on the gender classifier. Subsequently, we use the generated adversarial images along with those resulting from the defence against a pre-trained face recognition model to analyse the transferability of both the attacks and the defence. In Ref. [1], there was a faint transferability between an attack on a gender classifier using a range of fixed perturbations. The verification comparisons were performed over images perturbed with the same perturbation. In this extension, we study the transferability using variable perturbations from two attacks. The comparisons are between images with different perturbations in contrast to what was done in Ref. [1]. We also extend the experiments to a ResNet50 architecture. Our results, illustrated in Figure 1, support the transferability hypothesis for the fixed perturbation setting but not for the variable perturbation setting. This finding suggests that unlike fixed-perturbation assaults, attacks with variable perturbations may be better suited as privacy protection mechanisms as there is no indication that they are transferrable from a soft biometric classifier and a face recognition classifier. FIGURE 1Open in figure viewerPowerPoint Overview of the transferability hypothesis from a white-box attack on a gender classifier to a black-box attack on a face recognition classifier with VGG16 architecture. We show the results from the Fast Gradient Sign Method (FGSM) fixed perturbation setting on the left and from the PGD attack (PGD-ATK) variable perturbation setting on the right. The black dots refer to the clean images denoted as C, the red dots refer to the adversarial images generated by each attack denoted as A and the green dots refer to the denoised images generated by the defence method denoted as D. E r r o r C $Erro{r}_{C}$ , E r r o r A $Erro{r}_{A}$ and E r r o r D $Erro{r}_{D}$ correspond to the gender classification errors on the sets BCleanTrans, BAdvTrans and BDenTrans before we use them for verification with the face recognition model. Once we use them for verification using different pair combinations, we derive the equal error rates EERCC, EERAA, EERDD, EERCA, and EERCD. We see that the attacks make no significant difference on EER as we compare the EER among the different combinations, in particular the variable perturbation white-box attack (PGD-ATK) 2 RELATED WORK Adversarial attacks have become an active area of research as they expose the design vulnerabilities of DL-based models. Several white-box attacks are gradient-based such as the Fast Gradient Sign Method (FGSM) [6], its iterative version (IFGSM) [7], and Projected Gradient Descent [8]. Unlike the gradient used in backpropagation to train neural networks, the gradient used in those attacks helps determining the nearest perturbation to the input such that the adversarial image is misclassified. Other methods are based on network architecture information, Ref. [9] finds the minimal perturbation possible to an image that would make it misclassified, via projecting inputs on the closest classification hyperplane. Results in Ref. [10] show that DL-based face recognition models, such as VGGFace, are vulnerable to such attacks and to image processing methods that perturb the samples in a perceptible manner. Moreover, Ref. [11] uses Generative Adversarial Network (GAN)-based image editing to change the direction of the predictions of a binary gender classifier. However, the changes in the resulting images are perceptible to the human eye, which contradicts the purpose of adversarial attacks. To improve the robustness of existing DL models, many defence approaches have been proposed to withstand these attacks. Ref. [6, 12] show that incorporating adversarial samples with the training data increases the attacked model's robustness but such an approach can be resource-demanding. In practice, the model is trained over a diverse training set, where it learns to correctly classify the clean samples and, at the same time, it rectifies the predictions of the adversarial samples. Ref. [13] enhances the classifier's predictions by targeting each class and partitioning it into several sub-classes, assuming that only a few of them are sensitive to adversarial attacks. Subsequently, the different predictions of the sub-classes are aggregated via voting. Other approaches are based on input reconstruction such as Ref. [14] by using a denoising auto-encoder on the adversarial images in order to remove the perturbations. This method has been improved in Ref. [15] by using a U-Net architecture for the denoiser and defining the reconstruction loss based on the deep features of the classifier. While white-box attacks are effective on known machine learning models, it was shown in Ref. [16] that the resulting adversarial images can be effective against unknown models. The literature refers to such phenomenon as attack transferability where the attacked model is called surrogate model and the model to which the attack is transferred is called target model. Ref. [16] shows that adversarial attacks are transferable between the same models and between different models performing the same task, whether these models are differentiable (such as DNNs) or non-differentiable (such as Support Vector Machines). Ref. [2] analyses the level of complexity of the surrogate model in an attempt to justify the transferability effectiveness; a surrogate model that has a low variance loss function is more transferable than a model with a high variance loss function. In order to ameliorate transferability across different neural networks performing the same task, Ref. [17] modifies the IFGSM attack by randomly resizing the images at each iteration. Ref. [18] proposes a GAN-based approach to generate synthetic adversarial samples with imperceptible perturbations against FaceNet [19] and report effective results across different face recognition models. Similarly, Ref. [3] reports transferability of attacks from an open-source surrogate face recognition model to several commercial target face recognition models. As approaches to privacy protection, authors in Ref. [20, 21] used GANs to edit input images by modifying their sensitive attribute category. This is often done via integrating pre-trained soft biometric attribute classifiers as privacy estimators and pre-trained face recognition systems as utility estimators into the framework of the GAN, using them as additional discriminator networks. This allows having realistic-looking images with the characteristics of the faces slightly changed to fool the pre-trained soft biometric attribute classifiers but not the face recognition models. While these methods are promising, they tend to be computationally heavy, unlike common adversarial attacks. In this regard, it is important to investigate whether fast and train-free adversarial attacks are transferable from soft biometric classifiers to face recognition systems. It turns out that when such attacks are non-transferable, they can be used as a privacy protection mechanism to obfuscate a soft biometric attribute. 3 METHODOLOGY Let us denote XF as the space of all facial images, XC the space of clean images, XAdv the space of adversarial images and XDen the space of denoised adversarial images where XC ∪ XAdv ∪ XDen ⊆ XF. We denote YG = {0, 1} the space of the gender labels and YR = {✓, ✗} the space of recognition labels. We consider G: XF → YG a gender classifier and R: XF × XF → YR a facial recognition classifier. Attack An adversarial attack fAdv: XC → XAdv is considered successful if for x ∈ XF there is an adversarial sample fAdv(x) = xAdv ∈ XAdv such that: G ( x ) = y G and G x Adv = y G ‾ $G(x)={y}_{G}\,\text{and}\,G\left({x}_{\mathit{Adv}}\right)=\overline{{y}_{G}}$ Denoising Defence Let fDen: XAdv → XDen denote a denoising function. Ideally, a denoised image xDen = fDen (xAdv) ∈ XDen and verifies G (xDen) = G(x) where x ∈ XC is the clean image such that xadv = fAdv(x). Gender-Recognition Attack Transferability We say that an attack fadv is transferrable from the gender classifier G to a face recognition model R for (x1, x2) ∈ XC × XC if we have R x 1 , x 2 ≠ R x 1 , f Adv x 2 $R\left({x}_{1},\ {x}_{2}\right)\ne R\left({x}_{1},\ {f}_{\mathit{Adv}}\left({x}_{2}\right)\right)$ Gender-Recognition Defence Transferability We say that a defence fDen is transferrable from the gender classifier G to a face recognition model R for (x1, x2) ∈ XC × XC if we have R x 1 , x 2 = R x 1 , f Den ◦ f Adv x 2 $R\left({x}_{1},\ {x}_{2}\right)=R\left({x}_{1},\ {f}_{\mathit{Den}}{\circ}{f}_{\mathit{Adv}}\left({x}_{2}\right)\right)$ Metrics we use the classification accuracy, that is, the number of correct predictions divided by the total number of predictions, to measure the performance of the gender classifier, and we derive different performance metrics for the face recognition classifier based on a similarity measure: the equal error rate (EER), the false non-match rate (FNMR) at a fixed false match rate (FMR) of 0.1% (FNMR at 0.1%FMR) as well as area under the detection error trade-off curve (AUC-DET). (See Figure 2). FIGURE 2Open in figure viewerPowerPoint Methodology overview for analysing the transferability attack from a gender classifier (surrogate model) to a face recognition classifier (target model). A mated comparison is a comparison where two images are of the same subject. A non-mated comparison is a comparison where two images are of different subjects. The graph on the right is an illustration of the expected behaviour of a target model versus any target model where the attack is not transferable. For a target model that is not affected by the attack, we expect that the performance of such a model would only deteriorate due to higher distortion ϵ in the images (Target model 2). For a model to which an attack is transferable, its optimal interval where the error peaks would be similar to that of the surrogate model (Target model 1). Illustration from Ref. [1] Based on the above-mentioned definitions, we adopt the following procedure: Train the gender classifier and measure its classification accuracy. Attack the gender classifier to generate a set of adversarial samples. Train a denoising defence on a subset of adversarial samples and their corresponding clean versions and evaluate it on a separate subset by comparing the classification accuracy of the gender classifier on the adversarial images and their denoised versions. Run a face recognition model on a clean set, its adversarial, its denoised versions, and their combinations to assess the transferability of the attack and the defence methods in terms of the sensitivity of the recognition performance across the diverse sets of images as shown in Figure 2. 4 BACKGROUND 4.1 Fast Gradient Sign Method Attack We use J (θ, x, yG) to denote the loss function of the gender classifier G with respect to an input image x ∈ XC and its ground truth gender label yG ∈ YG. The FGSM attack maximises the loss with respect to the input image [6] by adding to the image a step ϵ in the direction of the loss gradient. An FGSM adversarial attack fAdv: XC → XAdv, with perturbation magnitude ϵ ∈ R ${\epsilon}\in \mathbb{R}$ , results in adversarial images xAdv ∈ XAdv such that: xAdv = x + ϵ ⋅ sign (∇J (θ, x, yG)). 4.2 Projected Gradient Descent Attack PGD (Projected Gradient Descent) attack (PGD-ATK) [8] is an iterative attack where each iteration is an FGSM attack while it restricts the perturbation level inside an ℓ∞ ball. This iterative process increases the chance of obtaining samples that would lie outside of the decision boundary of the correct class. Given S the set of possible perturbations, a projected gradient descent attack (PGD-ATK) fAdvPGD: XC → XAdv, with mini-step α ∈ R $\alpha \in \mathbb{R}$ , results at step t + 1 in adversarial images xAdv ∈ XAdv such that: xt+1 = ∏x + S (xt + α sign (∇xJ (θ, x, yG))) where the operator ∏x + S designates the projection on x + S. 4.3 High-level representation and pixel guided denoisers In this paper, we consider two types of denoisers: a pixel-guided denoiser (PGD) and high-level representation guided denoiser (HGD). A PGD learns to reconstruct a clean image x by reducing the loss defined as, L PGD = ‖ x − x Adv ‖ 1 ${\mathcal{L}}_{\text{PGD}}={\Vert}x-{x}_{\mathit{Adv}}{{\Vert}}_{1}$ , the pixel level difference between a clean image x and its adversarial version xAdv. Whereas, a HGD [15] reduces the loss defined as, L HGD = ‖ f emb i ( x ) − f emb i x Adv ‖ 1 ${\mathcal{L}}_{\text{HGD}}={\Vert}{f}_{\mathit{emb}}^{i}(x)-{f}_{\mathit{emb}}^{i}\left({x}_{\mathit{Adv}}\right){{\Vert}}_{1}$ , the difference between the deep features of a clean image x and the deep features of its adversarial version xAdv where f emb i : X C → R n ${f}_{\mathit{emb}}^{i}:{X}_{C}\to {\mathbb{R}}^{n}$ denotes the function describing the attacked model until its ith layer outputs a feature vector of size n. 5 EXPERIMENT AND EVALUATION 5.1 Architectures We used the VGG16 architecture as the gender classification network and restricted its last layer to two classes to suit our classification goal. The same architecture is used for the face recognition model VGGFace pre-trained on the VGGFace dataset [22]. VGG16 has a straightforward architecture that comprises 13 convolution layers and three fully connected layers. Additionally, we repeat the experiments using a ResNet50 architecture as the gender classification network, transforming its last layer to output two class probabilities corresponding to the gender categories. ResNet50 comprises a total of 48 convolution layers and two layers of max-pooling and average pooling, respectively, before its last fully connected layer for classification. We also use the same architecture for the face recognition network to which we transfer the attacks on the ResNet50 gender classifier. In this case, the face recognition network is pre-trained [23] with an arc loss on the MS1MV dataset.11 http://trillionpairs.deepglint.com/overview For the denoiser, similarly as Ref. [15], we use a U-Net based Denoising Convolution Neural Network,22 https://github.com/lychengr3x/Image-Denoising-with-Deep-CNNs a denoising model, which we will refer to in this work as UDnCNN. The structure of the UDnCNN denoiser has an encoding part, sharing skip connections with a decoding part. The skip connections allow the transfer of fine-grained information that could be lost in a regular auto-encoder, as shown in Figure 3. FIGURE 3Open in figure viewerPowerPoint Training of UDnCNN denoiser when considering the pixel-guided denoiser (PGD) defence, the feature-guided denoiser (FGD) defence, and the logits guided denoiser (LGD) defence (k = 3) [15] and when considering the second fully connected layer-guided denoiser (FC2GD) defence (k = 2). Figure from Ref. [1] 5.2 Dataset division We use the CelebA dataset that comprises 202, 599 samples of 10, 177 different individuals. We divide this dataset into three sets: A (162, 770 samples), B (19, 962 samples), and C (19, 867 samples) with respect to the train-test-validation partition provided by the authors in Ref. [24] where identities do not overlap. For each adversarial attack against the gender classifier and the defence experiment, we use sets A and B to train and test the gender classifier and set C to generate adversarial images against the gender classifier. The resulting adversarial images and their corresponding clean versions are partitioned into four subsets: CAdvTrain and CCleanTrain of equal size as well as CAdvTest and CCleanTest. The subsets CCleanTrain and CAdvTrain are used for the training of the denoisers while CCleanTest and CAdvTest are used to evaluate them. For the transferability experiments, we use set B to get the clean images from which we generate the adversarial images and their corresponding denoised images. Since not all the clean images from B are vulnerable to either of the attacks, we collect, for each adversarial image, the clean image it was derived from and its denoised image. As a result of each attack experiment, we have a set of clean images BCleanTrans, a set of adversarial images BAdvTrans, and another set of denoised images BDenTrans of the same size. Those three sets are used to analyse the transferability of the attacks on the face recognition classifier. We summarise in Tables 1 and 2 the number of samples in each of the sets for each of the attacks for the VGG16 and the ResNet50 architectures, respectively. We note that for the attacks with variable perturbations, there is a considerably smaller amount of adversarial images generated compared to the fixed-perturbation attack. That is explained by the fact that the projected gradient descent attack (PGD-ATK) iteratively performs a projected gradient descent until reaching one adversarial sample. When it comes to FGSM-variable, we select from the images generated by the FGSM-fixed, either randomly one perturbed version per image or the smallest perturbation per image; therefore, we do not keep various adversarial versions of an image. TABLE 1. Number of images in the different sets per attack for the VGG16 architecture. BTrans (#ids) refers to the number of images and identities, respectively, present in each of the clean, adversarial and denoised sets used to assess the transferability of the attacks Attack FGSM-fixed PGD-ATK FGSM-variable CAdvTrain/CCleanTrain 73,779 14,224 - CAdvTest/CCleanTest 18,449 3,557 - BTrans (#ids) 94,965 (995) 17,473 (997) 19,703 (995) TABLE 2. Number of images in the different sets per attack for the ResNet50 architecture. BTrans (#ids) refers to the number of images and identities, respectively, present in each of the clean, adversarial and denoised sets used to assess the transferability of the attacks Attack FGSM-fixed PGD-ATK FGSM-variable CAdvTrain/CCleanTrain 93,786 15,593 - CAdvTest/CCleanTest 23,448 3,899 - BTrans (#ids) 117,025 (999) 19,470 (999) 19,506 (999) 5.3 Performance metrics To assess the gender classifier performance, either before the attack and the defence or after, we calculate the classification accuracy. To reason in terms of errors in the two models, we use the classification error rate (1−accuracy) for the gender classifier in Figure 1. For the face recognition performance, we use the cosine similarity formula in 5.3 to measure the similarity in terms of the cosine of the angle made between pairs of feature vectors: The more similar two features vectors are, the smaller the angle between them and thus the higher the cosine. The cosine similarity between vectors a ⃗ $\vec{a}$ and b ⃗ $\vec{b}$ is given by: cos ( θ ) = a ⃗ ⋅ b ⃗ ‖ a ⃗ ‖ × ‖ b ⃗ ‖ $\mathrm{cos}(\theta )=\frac{\vec{a}\cdot \vec{b}}{{\Vert}\vec{a}{\Vert}\times {\Vert}\vec{b}{\Vert}}$ This is further used to measure the FNMR at a fixed FMR of 0.1% as well as the AUC-DET and finally, the EER. 5.4 Evaluation of the attacks and defence methods 5.4.1 VGG16 architecture Training the gender classifier on CelebA We trained our gender classifier from scratch for 20 epochs using batch normalisation after convolution layers to speed up the training of the baseline VGG16, achieving a validation accuracy of 98.62%. Fast Gradient Sign Method Attack We run the FGSM attack on the VGG16 gender classifier using various values for the perturbation ϵ ∈ [0.005, 0.55]. Figure 4 shows how the VGG16 classifier behaves for different values of ϵ. We observe that the accuracy decreases for ϵ between 0.01 and 0.035, and it starts to increase from 0.04. FIGURE 4Open in figure viewerPowerPoint Sensitivity of the classification accuracy of the VGG16 gender classifier upon the choice of perturbation (epsilon) used in the Fast Gradient Sign Method (FGSM) attack. The green dashed lines represent the bounds of the range of epsilons selected for the transferability experiments. Figure from Ref. [1] Such behaviour is likely caused by a circular or crescent decision boundary where clean images belonging to an initial class get perturbed with a certain epsilon that pushes them into the opposite class, but with an epsilon too large, they are pushed back into their correct initial class. As our goal is to study the effect of perturbations that are imperceptible to the human, we consider the following range of epsilons ϵ ∈ {0.01, 0.015, 0.02, 0.025, 0.03, 0.035} as it is where the VGG16 classifier is most vulnerable. Projected Gradient Descent Attack We run the PGD attack (PGD-ATK) on the gender classifier using an ℓ∞ ball of 0.035. This choice is based on the previous FGSM experiment showing that after that value the perturbations become increasingly less effective. The mini-step α of 0.001 is with 10 iterations. The accuracy of the gender classifier over the adversarial samples was 9.1%. Denoising losses In addition to a PGD, we use three types of HGDs illustrated in Figure 3: FGD based on the last convolutional layer of the gender classifier, FC2GD based on the second fully connected layer and logits guided denoiser (LGD) based on the logits layer. Comparison between the defence methods on clean and adversarial images with FGSM-fixed perturbation Figure 5 shows the performance of the defence methods over increasing values of epsilon. FC2GD seems to be the most robust against adversarial examples generated with values of epsilon outside of its training range, followed by LGD and FGD. Pixel-guided denoiser,