Adversarial Feature Desensitization
Year: 2021

Abstract:
Neural networks are known to be vulnerable to adversarial attacks – slight but carefully constructed perturbations of the inputs which can drastically impair the network’s performance. Many defense methods have been proposed for improving robustness of deep networks by training them on adversarially perturbed inputs. However, these models often remain vulnerable to new types of attacks not seen during training, and even to slightly stronger versions of previously seen attacks. In this work, we propose a novel approach to adversarial robustness, which builds upon the insights from the domain adaptation field. Our method, called Adversarial Feature Desensitization (AFD), aims at learning features that are invariant towards adversarial perturbations of the inputs. This is achieved through a game where we learn features that are both predictive and robust (insensitive to adversarial attacks), i.e. cannot be used to discriminate between natural and adversarial data. Empirical results on several benchmarks demonstrate the effectiveness of the proposed approach against a wide range of attack types and attack strengths. Our code is available at https://github.com/BashivanLab/afd.

heading: 1 Introduction
text: When training a classifier, it is common to assume that the training and test samples are drawn from the same underlying distribution. In adversarial machine learning, however, this assumption is intentionally violated by using the classifier itself to perturb the samples from the original (natural) data distribution towards a new distribution over which the classifier’s error rate is increased [52]. As expected, when tested on such adversarially generated input distribution, the classifier severely underperforms. To date, various methods have been proposed to defend the neural networks against adversarial attacks [34, 2], additive noise patterns and corruptions [24, 25, 45], and transformations [17]. Among these methods, two of the most successful adversarial defense methods to date are adversarial training [34], which trains the neural network with examples that are perturbed to maximize the loss on the target model, and TRADES [57], which regularizes the classifier to push the decision boundary away from the data. While past adversarial defence methods have successfully improved the neural network robustness against adversarial examples, it has also been shown that these robust networks remain susceptible to even slightly larger adversarial perturbations or other forms of attacks [19, 46, 48].
In this paper, we propose to view the problem of adversarial robustness through the lens of domain adaptation, and to consider distributions of natural and adversarial images as distinct input domains
35th Conference on Neural Information Processing Systems (NeurIPS 2021).
that a classifier is expected to perform well on. We then focus our attention on learning features that are invariant under such domain shifts. Building upon domain adaptation literature [4], we use the classification-basedH∆H-divergence to quantify the distance between the natural and adversarial domains. The theory of domain adaptation allows us to formulate a bound on the adversarial classification error (i.e. the error under the distribution of adversarial examples) in terms of the classification error on natural images and the divergence between the natural and adversarial features.
We further propose an algorithm for minimizing the adversarial error using this bound. For this, we train a classifier and a domain discriminator to respectively minimize their losses on the label classification and domain discrimination tasks. The feature extractor is trained to minimize the label classifier’s loss and maximise the discriminator’s loss. In this way, the feature extractor network is encouraged to learn features that are both predictive for the classification task and insensitive to the adversarial attacks. The proposed setup is conceptually similar to prior work in adversarial domain adaptation [18, 53], where domain-invariant features are learned through an adversarial game between the domain discriminator and a feature extractor network.
This setup is similar to the adversarial learning paradigm widely used in image generation and transformation [20, 28, 60], unsupervised and semi-supervised learning [39], video prediction [35, 31], active learning [47], and continual learning [16]. Some prior work have also considered adversarial learning to tackle the problem of adversarial examples [54, 36, 9, 8]. These methods used generative models to learn the distribution of the adversarial images[54, 36], or to learn the distribution of input gradients[9, 8]. Unlike our method which learns a discriminator function between distributions of adversarial and natural features and updates the feature extractor to reduce the discriminability of those distributions.
The main contributions of this work are as follows:
• We apply domain-adaptation theory to the problem of adversarial robustness; this allows to bound the adversarial error in terms of the error on the natural inputs and the divergence between the feature (representation) distributions of adversarial and natural domains.
• Aiming to minimize this bound, we propose a method which learns adversarially robust features that are both predictive and insensitive to adversarial attacks, i.e. cannot be used to discriminate between natural and adversarial data.
• We empirically demonstrate the effectiveness of the proposed method in learning robust models against a wide range of attack types and attack strengths, and show that our proposed approach often significantly outperforms most previous defense methods.

heading: 2 Related Work
text: There is an extensive literature on mitigating susceptibility to adversarial perturbations [34, 57, 13, 59, 3, 22, 7]. Adversarial training [34] is one of the earliest successful attempts to improve robustness of the learned representations to potential perturbations to the input pattern by solving a min-max optimization problem. TRADES [57] adds a regularization term to the cross-entropy loss which penalizes the network for assigning different labels to natural images and their corresponding perturbed images. [41] proposed an additional regularization term (local linearity regularizer) that encourages the classification loss to behave linearly around the training examples. [55, 51] proposed to regularize the flatness of the loss to improve adversarial robustness.
Our work is closely related to the domain adaptation literature in which adversarial optimization has recently gained much attention [18, 32, 53]. From this viewpoint one could consider the clean and perturbed inputs as two distinct domains for which a network aims to learn an invariant feature set. Although in our setting, i) the perturbed domain continuously evolves while the parameters of the feature network are tuned; ii) unlike the usual setting in domain-adaptation problems, here we have access to the labels associated with some samples from the perturbed (target) domain. Recent work[49] regularized the network to have similar logit values in response to clean and perturbed inputs and showed that this additional term leads to better robust generalization to unseen perturbations. Related to this, Adversarial Logit Pairing [27] increases robustness by directly matching the logits for clean and adversarial inputs. JARN [9] Another line of work is on developing certified defenses which consist of methods with provable bounds over which the network is certified to operate robustly [58, 56, 10]. While these approaches provide a sense of guarantee about the proposed defenses, they
are usually prohibitively expensive to train, drastically reduce the performance of the network on natural images, and the empirical robustness gained against standard attacks is low.

heading: 3 Our approach
text: We will now make a connection between the domain adaptation and adversarial robustness, and build upon this connection to develop an approach for improving the network’s robustness against adversarial attacks.

heading: 3.1 Preliminaries
text: Let Fθ(x) : X → Z , where X ⊆ Rn, Z ⊆ Rm, be a feature extractor (e.g. a neural network with parameters θ) mapping the input x ∈ X into the feature vector (representation) z ∈ Z , and let Cφ : Z → Y , where Y = {1, . . . ,K} are the class labels, be a classifier, with parameters φ (e.g., the last linear layer of a neural network plus the softmax function, on top of the extracted features).
Adversarial attack: Let π(x, ) denote a perturbation function (an adversarial attack) which, for a given (x, y) ∈ X × Y , generates a perturbed sample x′ ∈ B(x, ) within the -neighborhood of x, B(x, ) = {x′ ∈ X : ‖x′ − x‖ < }, by solving the following maximization problem
max t∈B(x, )
L(Cφ(Fθ(t)), y), (1)
where L is the task classification loss function. In practice, however, the perturbed sample x′ found by an attacker is typically an approximate rather than the exact solution to this maximization problem.
In order to characterize the distance between the natural and adversarial data distributions, the following notion of distance between two probability distributions, defined in [4, 18], will be used later to make a connection with domain adaptation theory.
H∆H-distance: Let H be a set of binary classifiers (hypotheses), called a hypothesis space; then the symmetric difference hypothesis space H∆H defines the set of hypotheses that capture the disagreements between two hypotheses inH, as in [4]:
g ∈ H∆H ⇐⇒ g(x) = h(x)⊕ h′(x) for some h, h′ ∈ H, (2)
where ⊕ denotes the XOR function. Then theH∆H-distance [4, 18] between two data distributions (domains) S and T , with respect to the hypothesis spaceH, is defined as:
dH∆H(S, T ) = 2 sup h∈H∆H
|Px∼S [ h(x) = 1 ] − Px∼T [ h(x) = 1 ] |. (3)
This equation turns into an inequation when the supremum is taken over the hypothesis space H instead ofH∆H [18].

heading: 3.2 A Domain Adaptation View of Adversarial Robustness
text: A domain is defined as a data distribution D on the set of inputs X [5]. In the adversarial robustness setting, we consider two domains – the natural and the adversarial domains, corresponding respectively
to the source and target domains in domain adaptation. We denote by DX and D′X the natural and adversarial distributions of input instances respectively and by DZ and D′Z their corresponding induced distributions over the feature space Z . As in domain adaptation, we assume that f : X → Y is a labeling function common to both domains. The expected classification error Z of the classifier Cφ over DZ is defined as the probability that the classifier Cφ disagrees with the function f̃ :
Z(Cφ) = Ez∼DZ [ y 6= Cφ(z) ] , (4)
where f̃ : Z → Y is a mapping from the features to the class label such that f(x) = f̃(Fθ(x)). We similarly define ′Z as the expected error of Cφ over DZ′ . Using theorem 2 from [4] that relates the source and the target domain errors, we get an upper bound on the expected adversarial error ′Z as:
′Z(h) ≤ Z(h) + 1
2 dH∆H(DZ ,D′Z) + c, (5)
where c is a constant term w.r.t. h. Eq. 5 essentially gives a bound on the adversarial error ′Z in terms of the natural error Z and a divergence dH∆H between the natural and adversarial domains with respect to their induced representation distributions DZ and D′Z . In the next section, we will describe an algorithm for improving adversarial robustness of a model by iteratively estimating and minimizing these two components of the error bound.

heading: 3.3 Adversarial Feature Desensitization
text: Based on Eq. 5, the expected adversarial error could be reduced by jointly minimizing the natural error and the divergence between the distributions of natural and adversarial representations dH∆H(DZ ,D′Z). While minimizing the natural error X is straightforward, minimizing the crossdomain divergence requires us to estimate dH∆H(DZ ,D′Z). As was shown before [18], training a domain discriminator Dψ is closely related to estimating the dH∆H(DZ ,D′Z). The domain discriminator is a classifier trained to assign a label of 1 to samples from DZ , and -1 to samples from D′Z . Namely, it is shown [18] that
dH∆H(DZ ,D′Z) ≤ 2 sup h∈H |αDZ ,D′Z (h)− 1|, (6)
where αDZ ,D′Z (h) = Pz∼DZ [ h(z) = 1 ] +Pz∼D′Z [ h(z) = −1 ] combines the true positives and true negatives, and is thus maximized by the optimal domain discriminator h = Dψ. Note that, if the domain distributions DZ and D′Z are the same, then even the best choice of domain discriminator Dψ will achieve chance-level accuracy, corresponding to αDZ ,D′Z (Dψ) = 1. Our approach will aim at minimizing this estimated distance dH∆H(DZ ,D′Z) by tuning the feature extractor network parameters θ in the direction that pushes the distributions DZ and D′Z closer together. In parallel, we train the domain discriminator to estimate and guide the progress of the feature extractor’s tuning.
We now describe the proposed approach (see Algorithm 1) which essentially involves simultaneous training of the feature extractor Fθ, the task classifier Cφ and the domain discriminator Dψ (see Figure 1a)1. One iteration of the training procedure consists of the following three steps.
First, parameters of the feature extractor Fθ and classifier Cφ are updated aiming to minimize the natural error X using the cross-entropy loss on natural inputs:
LC = − 1
m m∑ i=1 ỹi · log ( softmax(Cφ(Fθ(xi))) ) , (7)
where ỹi is a one-hot encoding of the true label of the i-th sample xi.
Next, steps two and three essentially implement a two-player minimax game similar to that in Generative Adversarial Networks (GAN) [20], carried out between the feature extractor network Fθ and the domain discriminator Dψ , with a value function
V (Fθ, Dψ) = Ep(y) [ Ep(x|y)[S(−Dψ(Fθ(x), y))] ] + Eq(y) [ Eq(x|y)[S(Dψ(Fθ(x), y))] ] , (8)
1Note that we will somewhat abuse the notation, assuming that Cφ and Dψ below correspond to the logits (last-layer output) of the corresponding networks. Also, we will use class-conditional discriminators, Dψ(Fθ(x, y)), i.e. train different domain discriminator for different label values y.
Algorithm 1: AFD training procedure Input: Adversarial perturbation function (attack) π, feature extractor Fθ, task classifier Cφ, domain discriminator Dψ , learning rates α, β, and γ. repeat
input next mini-batch {(xi, yi), ..., (xm, ym)} for i=1 to m: x′i ← π(xi, ) Compute LC according to Eq. 7 Compute LD according to Eq. 9 Compute LF according to Eq. 10 (θ, φ)← (θ, φ)− α∇θ, φLC % update feature extractor and task classifier ψ ← ψ − β∇ψLD % update domain discriminator θ ← θ − γ∇θLF % update feature extractor
until convergence;
where S is the softplus function. In particular, parameters of the domain discriminator Dψ are updated to minimize the cross-entropy loss associated with discriminating natural and adversarial inputs, maximizing α(h) in Eq. 6.
LD = 1
m m∑ i=1 [ S(−Dψ(Fθ(xi), yi)) + S(Dψ(Fθ(x′i), yi)) ] , (9)
while the parameters of the feature extractor function Fθ are adversarially updated to maximize the domain discriminator’s loss from Eq. 9
LF = 1
m m∑ i=1 S(−Dψ(Fθ(x′i), yi)). (10)
In Figure 1b, we visually compare the learning dynamics in adversarial training, TRADES and AFD. Essentially, the adversarial training solves the classification problem by pushing the representation of adversarial examples from different classes away. TRADES regularizes the normal classification loss on the natural inputs with an additional term that encourages the representation of adversarial and natural images to match. Similar to TRADES, in AFD, the regular classification loss on natural inputs is augmented but with an adversarial game which consists of training the domain discriminator that distinguishes between the adversarial and natural inputs for each class followed by updates to the feature extractor to make the representations for natural and adversarial examples to become indistinguishable from each other. Notably, because the parameter update for the feature extractor network is done to maximize the domain discriminator loss and not to decrease the loss for particular adversarial examples (as is done in adversarial training or TRADES), it potentially increases the network robustness against any perturbation that could be correctly classified using the same domain discriminator. This could potentially lead to a broader form of generalization learned by the network.
Discussion: Relation to Adversarial Training. Adversarial training minimizes the expected error on adversarial examples (the perturbed versions of the natural samples), generated by an attacker in order to maximize the classification loss. The adversarial training procedure involves a minimax optimization problem consisting of an inner maximization to find adversarial examples that maximize the classification loss and an outer minimization to find model parameters that minimize the adversarial loss. From the domain adaptation point of view, the inner optimization of adversarial training is equal to a sampling procedure that generates samples from the target domain. Intuitively, direct training of the classifier on samples from the target domain would be the best way to improve the accuracy in that domain (i.e. adversarial classification accuracy). However, it’s important to note that the adversarial examples found through the inner optimization only approximately maximize the classification loss, and therefore the adversarial error associated with these samples only act as a lower bound on the true adversarial error and therefore the outer loop of the adversarial training method essentially minimizes a lower bound on the adversarial classification error. In contrast to this setup, our proposed method minimizes a conservative upper bound on the adversarial error and therefore is more likely to generalize to a larger set of unseen attacks, and to stronger versions of previously seen attacks (i.e. ones that generate higher-loss samples in the inner optimization loop).

heading: 4 Experiments

heading: 4.1 Experimental setup
text: Datasets. We validated our proposed method on several common datasets including MNIST [30], CIFAR10, CIFAR100 [29], and tiny-Imagenet [26]. The inputs for all datasets were used in their original resolution except for tiny-Imagenet where the inputs were resized to 32× 32 to allow the experiments to finish within reasonable time on two GPUs.
Adversarial attacks. To fairly assess the generalization ability of each defense method across attack types, we tested each network on 9 well-known adversarial attacks from the literature, using existing implementations from the Foolbox [42] and Advertorch [12] Python packages. Namely, we tested the models against different variations of the Projected Gradient Descent (PGD) [34] (L∞, L2, L1), Fast Gradient Sign Method (FGSM) [21], Momentum Iterative Method (MIM) [14], Decoupled Direction and Norm (DDN) [43], Deepfool [40], C&W [6], and AutoAttack [11] attacks. Also to assess the generalization in robustness across stronger adversarial attacks, for each attack we also varied the value across a wide range and validated different models on each. Specific hyperparameters used for each attack are listed in Table-A2.
Feature extractor network Fθ and classifierCφ. We used the same network architecture, ResNet18 [23] for the feature extractor and classifier networks in experiments on all datasets and only increased the number of features for more challenging datasets. The number of base filters in the ResNet architecture was set to 16 for MNIST and 64 for other datasets. We used the activations before the last linear layer as the the output of the feature extractor network (Z) and the last linear layer as the classifier network Cφ. We added an activation normalization layer to the output of feature extractor network to provide normalized features to both Cθ and Dψ networks.
Domain discriminator network Dψ . We compared several variations of the domain discriminator architecture and evaluated its effect on robust classification on MNIST dataset (Table A5). Overall, we found that using deeper networks for domain discriminator and adding projection discriminator layer improves the robust classification accuracy. The number of hidden units in all layers of Dψ were equal (64 for MNIST and 512 for other datasets). Following the common design principles in Generative Adversarial Networks literature, we used the spectral normalization [37] on all layers of Dψ . In all experiments, the domain discriminator (Dψ) consisted of three fully connected layers with Leaky ReLU nonlinearity followed by a projection discriminator layer that incorporated the labels into the adversarial discriminator through a dot product operation [38]. Further details of training for each experiment are listed in Table-A1.
Training parameters and baselines. All networks including baselines were trained on an adaptive version of PGD attack [11] that adaptively tunes the step size during the attack with virtually no computational overhead compared to standard PGD attack. We used = 0.3, 0.031, and 0.016 for MNIST, CIFAR, and Tiny-Imagenet datasets respectively. To find the best learning rates, we randomly split the CIFAR10 train set into a train and validation sets (45000 and 5000 images in train and validation sets respectively). We then carried out a grid-search using the train-validation sets and picked the learning rates with highest validation performance. Based on this analysis, we selected the learning rate γ = 0.5 for tuning the feature extractor Fθ, and α = β = 0.1 for tuning the parameters in domain discriminator Dψ , and the task classifier Cφ.
In all experiments we trained two versions of the AFD model, one with losses LD and LF according to Eq. 9 and 10 which we call AFD-DCGAN and another version where we substitute the losses with those from the Wasserstein GAN [1] dubbed AFD-WGAN (see Eq. 11 and 12 in the Appendix). We mainly compared the performance of our proposed method with two prominent defense methods, adversarial training and TRADES. We used a re-implementation of adversarial training (AT) method [34] and the official code for TRADES2 [57] and denoted these results with † in the tables. All experiments were run on NVIDIA V100 GPUs. We used one GPU for experiments on MNIST and 2 GPUs for other datasets.

heading: 4.2 Robust classification against nominal attacks
text: We first evaluated our method against adversarial attacks under similar settings to those used during training ( = 0.3, 0.031, and 0.015 for MNIST, CIFAR, and Tiny-Imagenet datasets respectively).
2https://github.com/yaodongyu/TRADES.git
Table 1 compares the robust classification performance of AFD and several other defense methods against PGD-L∞, C&W-L2 and AutoAttack white-box and black-box attacks. The black-box attacks were carried out by constructing the adversarial examples using a ResNet18 architecture trained on the natural inputs x ∼ DX . Overall both versions of AFD (AFD-DCGAN and AFD-WGAN) were highly robust against all five tested attacks while maintaining a higher "Clean" accuracy (on natural data) compared to strong baseline models like TRADES and Adversarial Training. AFD-WGAN was consistently at the top on MNIST and CIFAR10 datasets. On CIFAR100 and Tiny-Imagenet, AFD performed better than or similar to Adversarial Training on all the attacks and performed better than TRADES on most of the attacks, although it was occasionally behind TRADES (on PGD-L∞ and AA white-box attacks). Analysis of feature sensitivity showed that on MNIST and CIFAR10 datasets on which AFD outperformed the other baselines by a larger margin, the features were significantly more insensitive to adversarial perturbations and over a larger range of attack strengths (Figure-A4). In addition to these tests, we also evaluated the AFD model against transfer black-box attacks from Adversarial Training and TRADES models which further demonstrated AFD’s higher robustness to those attacks too (Table-A3).

heading: 4.3 Robust classification against stronger and unseen attacks
text: To evaluate how each network generalizes to unseen domains of adversarial inputs (i.e. adversarial attacks generated with unseen forms of adversarial attacks), we additionally validated the classification robustness against a range of possible values for several widely used attacks that were not used during training. To fairly compare different models while considering both attack types and values, we computed the area-under-the-curve (AUC) for accuracy vs. epsilon for each attack (similar to Figure-2). Table-2 summarizes the AUC values for all 9 attack methods on four tested datasets. Compared with the baselines, we found that, AFD-trained networks consistently performed better on various datasets and on almost all the tested attacks even for substantially larger values (Figure 2, also see Figures A1,A3 in the appendix). These results show that compared to other baselines, AFD-trained networks are robust against a wider range of attacks and attack strengths ( ). This further
suggests that the features learned through AFD generalize better across various forms of attacks and can sustain larger perturbations.
We also observed that the AFD-WGAN performs better than AFD-DCGAN under most tested conditions. This is potentially due to: 1) WGAN’s ability to avoid vanishing gradients when the discriminator becomes too good compared to the generator (the feature extractor function in our case) [5]; 2) WGAN’s ability to avoid mode-collapses during training. In training GANs, mode collapses lead to the generator network to only output a limited set of patterns instead of learning to produce a diverse set of natural-looking images that fool the discriminator. Under our setting, WGAN potentially leads to learning a feature extractor that can produce a more diverse set of features for perturbed inputs, instead of focusing on a subset of latent dimensions. This suggests that applying more advanced GAN training algorithms could potentially further improve the robust performance in AFD-type models.

heading: 4.4 EstimatedH∆H-distance and adversarial-vs-natural generalization gap
text: As stated in Eq. 5, the upper bound on the adversarial error can be stated in terms of the natural error, the divergence between the two domains, and a constant term. In practice, this means that the smaller the divergence term dH∆H is, the smaller the gap between the adversarial and natural errors ( ′Z − Z ) can be. We empirically tested this prediction using the domain discriminator trained on CIFAR10 dataset using the PGD-L∞ attack. Figure-3a shows that the estimated dH∆H using the domain discriminator (i.e., using the corresponding empirical value of α in Eq. 6) trained on PGD − L∞ with = 0.031 is closely related to the adversarial-vs-natural generalization gap over
different values as predicted by Eq. 5. Moreover, estimations from the same domain discriminator also predicts the gap in generalization error attained for other forms of attacks (even ones not seen during AFD training) and values with high accuracy (Figure-3b). This further supports the proposal that minimizing the estimated distance between the natural and adversarial representations can be an efficient way to improve the model robustness against various adversarial attacks.

heading: 4.5 Learning a sparse representation
text: Because the AFD method aims to learn a representation that is insensitive to adversarial attacks, we expected the learned representational space to potentially be of lower dimensionality (i.e. less number of orthogonal features). To test this, we compared the dimensionality of the learned representation using two measures. i) number of non-zero features over the test set within each dataset and ii) number of Principal Component Analysis (PCA) dimensions that explains more than 99% of the variance in the representation computed over the test-set of each dataset. We found that the same network architecture (i.e. ResNet18), when trained with AFD method learns a much sparser and lower dimensional representational space (Table A4) compared to the naturally trained, adversarial training and TRADES models. The representational spaces learned with AFD on MNIST, CIFAR10, and CIFAR100 datasets had only 6, 9, and 76 principal components respectively.

heading: 4.6 Adversarial and norm-based desensitization
text: To investigate whether the same level of robustness could be achieved by encouraging the network to produce similar representations in response to natural and adversarial inputs, we ran an additional experiment on the MNIST dataset in which we added a regularization term to the classification loss to directly minimize the representation sensitivity Se = 1n ∑ x‖F (x)− F (x′)‖, during training. We observed that although this augmented loss led to learning robustness representations, it achieved modest levels of robustness (∼ 80%) and showed only weak generalization to stronger and other unseen attacks (Figure-A5). This result suggests that more direct forms of enforcing representational similarity may not lead to the same form of robustness with generalization properties similar to that achieved using an adversarial training with domain discriminator (e.g. as in AFD).

heading: 5 Conclusion and limitations
text: Decreasing the input-sensitivity of features has long been desired in training neural networks [15] and has been suggested as a way to improve adversarial robustness [44, 61]. In this work we proposed an
algorithm to decrease the sensitivity of neural network representations using an adversarial learning paradigm that involves joint training of a domain discriminator, a feature extractor, and a task classifier. Essentially, our proposed algorithm iteratively estimates a bound on the adversarial error in terms of the natural error and a classification-based measure of distance between the distributions of natural and adversarial features and then minimizes the adversarial error by concurrently reducing the natural error as well as the distance between the two feature distributions.
Limitations. The empirical results presented here suggest that AFD-trained models are robust against a wide range of adversarial attacks (distributions) even compared to strong baselines like Adversarial Training and TRADES. However, it is not guaranteed that the model would remain robust against any unseen attacks that we have not tested or may be invented in the future - as is the case in domain adaptation literature and the lack of theoretical guarantees for cross-domain generalization. With regards to the computational cost, when measuring the average per-epoch training time on the CIFAR10 dataset (using 2 NVIDIA V100 GPUs), we found that the AFD training time is 31% longer than adversarial training and only 4% longer than TRADES. This shows that while AFD requires three SGD updates per batch, the additional computational cost is not significantly higher than many prior methods when considering that most of the computational cost is associated with generating the adversarial examples during training.

heading: 6 Acknowledgements
text: We would like to thank Isabela Albuquerque, Joao Monteiro, and Alexia Jolicoeur-Martineau for their valuable comments on the manuscript. Pouya Bashivan was partially supported by the Unifying AI and Neuroscience – Québec (UNIQUE) Postdoctoral fellowship and NSERC Discovery grant RGPIN-2021-03035. Irina Rish acknowledges the support from Canada CIFAR AI Chair Program and from the Canada Excellence Research Chairs Program.

Review summaries:
This paper proposes Adversarial Feature Desensitization (AFD) as a defense against adversarial examples. AFD employs a min-max adversarial learning framework where the classifier learns to encode features of both clean and adversarial images as the same distribution, thereby desensitizing adversarial features. With the aim of fooling a separate discriminator model into categorizing the classifier’s adversarial features as from clean images, the classifier is trained with the standard cross-entropy loss and adversarial loss terms. The authors showed through experiments on MNIST, CIFAR10 and CIFAR100 datasets that AFD mostly outperform previous defenses across different adversarial attacks under white- and black-box conditions.

This paper applied domain adaption ideas into the adversarial settings. Based on it, they proposed Adversarial Feature Desensitization (AFD) by leveraging a discriminator network to minimize the  distance between adversarial feature and natural feature. They show that their method could improve the robustness  compared to TRADE and AT and could also generalize well to other attacks (with different epsilon).  

This paper proposes a feature desensitization method for adversarial defense. The authors formulate robust representation learning problems from the domain adaptation perspective, the algorithm to solve which is based on two-player minmax methods (i.e., GAN). The evaluation results on multiple datasets demonstrate the advantage over baseline methods. The learned feature also shows to be spare. 

The paper proposes Adversarial Feature Desensitization (AFD) to train classifiers robust to adversarial attacks. In particular, AFD trains jointly a feature extractor, a classifier for the original task and a discriminator which distinguishes between natural and adversarial inputs, in order to find features which are effective for classification but not sensitive to adversarial attacks. In the experimental evaluation on four datasets, AFD outperforms standard methods in most of the cases.