Defense against Adversarial Examples by Encoder-Assisted Search in the Latent Coding Space

1 INTRODUCTION . Deep neural networks ( DNNs ) have achieved state-of-the-art performances among various challenging computer vision tasks . However , they are shown to be vulnerable to adversarial attacks ( Szegedy et al. , 2013 ; Goodfellow et al. , 2014b ; Madry et al. , 2017b ) , which add carefully crafted perturbations to a legitimate input sample . The perturbations are small and not perceptible to a human , but they can significantly mislead the target model . Moreover , adversarial examples have considerable transferability between different models , which entertains the feasibility of black-box attacks in the real world . Therefore , it is important to find effective strategies to defend against adversarial attacks . There have been many efforts to defend against adversarial attacks by diminishing perturbations of samples before feeding them into classifiers . Auto-encoder based methods have achieved prevalence though ( Gu & Rigazio , 2014 ; Meng & Chen , 2017 ) , they are shown to be vulnerable to white-box attacks ( Samangouei et al. , 2018 ) because the model stacked by auto-encoder and classifier can be attacked again . Other generative models ( Samangouei et al. , 2018 ; Song et al. , 2017 ) have been trained to model the distribution of normal data and project back the adversarial samples to the manifold of normal samples . In the process of purifying input images , they often include complicated optimization . Therefore , they can easily resist the white-box attacks but at the cost of time . Compared to natural images , adversarial examples have much lower probability densities under the image distribution ( Song et al. , 2017 ) , which is regarded as an unknown input pattern for an autoencoder trained with legitimate examples . As a result , the output of the encoder can be influenced by the crafted perturbations and lead to a top-down reconstruction far away from the input . When humans handle unknown input patterns , we will first find a conception in our mind and correct our conception step by step by checking the consistency between the input and the reconstruction . We can apply this mechanism to neural networks , where the latent code for reconstruction is calculated by a search process guided by feedback from the visual space . The same idea has been included in Defense-GAN ( Samangouei et al. , 2018 ) , where a generator is trained to model the distribution of unperturbed images . When given an image , it uses GD minimization to find the optimum latent code , which corresponds to the closest output without perturbations to the given image . However , Defense-GAN requires multiple random restart points and considerable iterations to guarantee the performance , which brings a high computation cost . That ’ s because the GD minimization is sensitive to the initial points , which is given randomly in Defense-GAN . Our approach takes the advantages of both auto-encoder and Defense-GAN . We follow the encoderdecoder framework to build the reconstruction model but also include a search process to find the best reconstruction . The encoder-decoder framework can help to form a self-organized latent space and preserves the neighborhood relations ( Xu , 2019 ) , which can provide a fair start point and a more conducive environment for the search process . However , the traditional auto-encoder is trained to form an identical mapping from the input to output instead of minimizing the distance between the distribution of natural and generated images . Consequently , auto-encoder may find the closest image to a given perturbed image but out of the distribution of real data , which is still hard for a classifier to give a right prediction . To solve this problem , we add a discriminator to distinguish between natural images and generated images and force the decoder to model the distribution of natural data . The training for the reformer network is simple and requires no adversarial samples . Experimental results show that the decoder can always generate natural samples when the encoder can provide a good start point and a self-organized latent space for the search process . Besides , the encoder-decoder framework can also act as an effective detector ( Meng & Chen , 2017 ) . In the inference stage , when there comes a test sample , we can first detect if the sample is a malicious image or not . If not , we simply reconstruct the input image to eliminate missing noise . If true , we start the search process in the latent space , which is implemented by GD minimization , to find the closest natural reconstruction to the given image . Compared with Defense-GAN , we have two advantages : ( 1 ) The detecting enables us to discriminate natural samples and adversarial samples effectively , thus we can bypass the searching stage on natural samples , which saves much time ; ( 2 ) For malicious samples , the search process starts at a good initial , thus we need no random restarts and only a few iterations . Compared with auto-encoder , we have a strong defense against white-box attacks due to the searching process . Experiments show that our method is robust against different attacks and can reach comparable even better performance with Defense-GAN while using much fewer computations . 2 RELATED WORK . ADVERSARIAL ATTACKS Various attack models have been studied to generate adversarial examples . Szegedy et al . first introduced adversarial examples against neural networks ( Szegedy et al. , 2013 ) and generated adversarial perturbations using an L-BFGS method to solve an optimization problem . For better efficiency , Goodfellow et al . proposed Fast Gradient Sign Method ( FGSM ) ( Goodfellow et al. , 2014b ) , an efficient single-step attack where the perturbation is updated along with the sign of the gradient of the loss w.r.t the input images . Later , Basic Iterative Method ( BIM ) ( Kurakin et al. , 2016b ) is proposed as an extension of FGSM by running a finer optimization for multiple iterations and clipped pixel values in each iteration . After that , Moosavi-Dexfooli et al . proposed DeepFool ( Moosavi-Dezfooli et al. , 2016 ) to find the closest distance from the normal input to the decision boundary of adversar- ial samples . More recently , Carli and Wagner ( Carlini & Wagner , 2016 ) launched a powerful attack to defeat defensive distillation ( Papernot et al. , 2015 ) , which generates adversarial examples with small perturbations . It is also possible to use generative models to generate universal adversarial perturbations ( Reddy Mopuri et al. , 2018 ) . DEFENSE METHODS In recent years , a variety of techniques have been proposed to defend against adversarial attacks . Adversarial training ( Kurakin et al. , 2016a ; Goodfellow et al. , 2014b ; He et al. , 2017 ; Madry et al. , 2017b ) is one of the most popular ways which trains the classifier on the augmented training set with adversarial samples . It improves the accuracy on adversarial samples but can not generalize well to new attacks ( He et al. , 2017 ) . Meanwhile , it is time-consuming to generate adversarial examples and retrain the classifier . Gradient masking method ( Papernot et al. , 2015 ) has also been considered to mask or reduce the gradients in magnitude when training the classifier , but it has been shown to give a false sense of security in defending against attacks ( Athalye et al. , 2018 ) . The two popular methods include retraining the classifier , while the classifier may not be allowed to be modified in the physical world . Another way is to pre-process adversarial samples before feeding them into classifiers . Some previous work resort to traditional denoising methods ( Das et al. , 2017 ; Dziugaite et al. , 2016 ; Osadchy et al. , 2017 ) to purify the adversarial examples . The main drawback of these methods is that they can only fix small perturbations and may cause information loss . Denoising auto-encoder ( Gu & Rigazio , 2014 ) is firstly proposed to defend against adversarial attacks by training an auto-encoder to map the corrupted images to clean ones . As discussed in ( Samangouei et al. , 2018 ) , the stacked network is still easy to be attacked . MagNet ensembles many auto-encoders and applies a two-step defense mechanism where the hard adversarial attacks can be detected and soft adversarial attacks can be reformed . However , MagNet still suffers from white-box attacks . Different from autoencoder , Defense-GAN ( Samangouei et al. , 2018 ) is proposed to leverage the representative power of GAN to diminish adversarial perturbations . At the inference stage , they implement a gradient descent minimization to find the best code corresponding to the closest reconstruction . Since the gradient can not pass the searching process , Defense-Gan can strongly defense against white-box attacks while the searching process is time-consuming . 3 APPROACH . 3.1 THREAT MODEL . We consider the following types of adversarial attacks , according to the level of how much information is available to the attackers : • Black-box attacks : no details about the classifier and defense mechanism are accessible . A substitute network is trained to mimic the classifier and then is used to generate adversarial examples . • White-box attacks : complete access to all the information about the classifier and the defense strategy . • Gray-box attacks : complete access to the classifier but no access to defense strategy . 3.2 METHOD OVERVIEW . Let fθ ( x ) : Rd → N be a classifier parameterized by θ , where Rd is the image space and N is the set of natural numbers denoting class labels . Given a clean image x , an adversary can perturb the clean image with small perturbation η but confuse f : fθ ( x+ η ) 6= fθ ( x ) , ‖η‖ < attack ( 1 ) where ‖·‖ is a measurement and attack is the perturbation scale which sets the maximum perturbation allowed for each pixel and often set to a small number to get almost imperceptible difference between xadv = x+ η and x . We want to improve robustness by learning a transformation T ( . ) , such that the predicted label of the transformed image does not change when the image corrupted with perturbations , i.e. , fθ ( T ( xadv ) ) = fθ ( T ( x ) ) . The basic idea of our method is to purify input images by searching the closest reconstruction without perturbations within little computation cost . To achieve this , we build a reconstruction network based on the encoder-decoder framework , which is denoted as AE-GAN+r and will be described in detail in Section 3.3 . After training , the encoder of AE-GAN+r can provide a good representation for most inputs , and the decoder can always generate an image on the manifold of natural samples during the search . In the inference time , when given an input , we first detect if the sample is adversarial or not . If not , we simply reconstruct the input image by AE-GAN+r to diminish missing noises . If true , we start a search process in the latent coding space to find the best code , which corresponds to the closest reconstruction without perturbations . The search process starts at the output of the encoder and implemented by GD minimization , which will be described in Section 3.4 . Formally , we denote this encoder assisted search process as AE-GAN+rs . 3.3 ARCHITECTURE OF AE-GAN . An auto-encoder ( AE ) is composed of two components : the encoder F and the decoder G. Let X be the visual space and Z be the latent space . The mapping F : X → Z performs image abstraction , which encode the image x ∈ X into a code z ∈ Z . The mapping Z → X performs image generation , which generates image x ∈ X from the output of encoder z ∈ Z . Formally , we denote the distribution of training images as pdata . The loss function of AE is defined as : Ex∼pdata ‖G ( F ( x ) ) − x‖ 2 2 ( 2 ) As shown in Equation 2 , traditional AE minimizes the euclidean distance between input and output . Thus , it is trained to form an identical mapping from the input to output instead of minimizing the distance between the distribution of natural images pdata and generated images pg . Consequently , when we search for the best code z in the latent space , AE may find a close image G ( z ) but out of Pdata , as shown in Figure 5 in Appendix E , which is a meaningless purification because the accuracy of classifier on these images is not good . To solve this problem , we adapt the auto-encoder by introducing a discriminator and the min-max loss in GANs ( Goodfellow et al. , 2014a ) , as shown in Figure 2 . We denote the adapted AE as AE-GAN . GANs consists of two neural networks , a generator G and a discriminator D. G maps a low-dimensional latent space Z to the high dimensional sample space X . D is a binary neural network classifier . While G learns to generate samples that similar to the real data x , D learns to distinguish between “ real ” samples x and “ fake ” samples G ( z ) . D and G are trained in an alternating fashion to minimize the following min-max loss ( Goodfellow et al. , 2014a ) : min G max D V ( D , G ) =Ex∼pdata [ logD ( x ) ] + Ez∼pz [ log ( 1−D ( G ( z ) ) ] ( 3 ) To preserve the advantages of AE , we still keep the mean square error to drive the abstraction mapping and self-organizing in the latent space . Meanwhile , we add a discriminator learning to distinguish between the samples generated by the decoder and real samples . Thus , the objective of AE-GAN is to minimize the following min-max loss : min F , G max D V ( D , F , G ) =Ex∼pdata [ log ( D ( x ) ) ] + Ez∼pz [ log ( 1−D ( G ( z ) ) ) ] + Ex∼pdata ‖G ( F ( x ) ) − x‖ 2 2 ( 4 ) As the start point of the search process , the output of the encoder is expected to be close to the optimum code and thus help the search to converge quickly . Since AE-GAN is trained with legitimate images , the encoder F may suffer from the covariate shift when the input is corrupted with large perturbations . To solve this , we perturb the clean images with random Gaussian noise before feeding them into the encoder when calculating the reconstruction error . Adding noise in the input layer acts as a regularization ( Bishop , 1995 ) , thus we denote the method as noise regularization ( +r ) in this paper . The final objective function of AE-GAN+r can be written as Equation 5. min F , G max D V ( D , F , G ) =Ex∼pdata [ log ( D ( x ) ) ] + Ez∼pz [ log ( 1−D ( G ( z ) ) ) ] + Ex∼pdata ‖G ( F ( x+ η ) ) − x‖ 2 2 , ( 5 ) where η ∼ N ( 0 , σ ) , σ follows the uniform distribution on a given region . Bidirectional Generative Adversarial Networks ( BiGANs ) ( Donahue et al. , 2016 ) also includes encoder-decoder mapping . In addition to the generator from the standard GAN framework , BiGAN includes an encoder to map the input data into the latent representation . The discriminator in BiGAN discriminates jointly data and latent code , i.e. , ( x , E ( x ) ) versus ( G ( z ) , z ) ) . However , experimental results show that BiGAN has poor reconstruction performance . When BiGAN equipped with the searching process , the encoder in BiGAN can not provide a good initial point for the decoder .

Summary: Authors propose to use a modified autoencoder at the input of a network to ward off adversarial samples by purifying them. The encoder-decoder is trained with a discriminator which can identify whether the input is malicious or normal. A malicious input image is purified with the help of a search procedure in the latent space of the auto-encoder. The gradient based search obtains a latent code that corresponds to the reconstructed image that is closest to the input. The algorithm uses output of the decoder as a starting point in the search. Experiments show a reasonable performance against adversarial attacks on MNIST and F-MNIST images. The proposal seems to be an alternative to the Defence-GAN method of (Samangouei et. al. 2018) where search is computationally expensive - due to multiple starting points and many iterations. The ease of optimization in the proposed method comes at the cost of accuracy (Table 1). However, for a single starting point during search and fewer iterations, it outperforms Defense-GAN by a significant margin (Table 2).