Online Adversarial Purification based on Self-supervised Learning

1 INTRODUCTION . Deep neural networks have achieved remarkable results in many machine learning applications . However , these networks are known to be vulnerable to adversarial attacks , i.e . strategies which aim to find adversarial examples that are close or even perceptually indistinguishable from their natural counterparts but easily mis-classified by the networks . This vulnerability raises theory-wise issues about the interpretability of deep learning as well as application-wise issues when deploying neural networks in security-sensitive applications . Many strategies have been proposed to empower neural networks to defend against these adversaries . The current most widely used genre of defense strategies is adversarial training . Adversarial training is an on-the-fly data augmentation method that improves robustness by training the network not only with clean examples but adversarial ones as well . For example , Madry et al . ( 2017 ) propose projected gradient descent as a universal first-order attack and strengthen the network by presenting it with such adversarial examples during training ( e.g. , adversarial training ) . However , this method is computationally expensive as finding these adversarial examples involves sample-wise gradient computation at every epoch . Self-supervised representation learning aims to learn meaningful representations of unlabeled data where the supervision comes from the data itself . While this seems orthogonal to the study of adversarial vulnerability , recent works use representation learning as a lens to understand as well as improve adversarial robustness ( Hendrycks et al. , 2019 ; Mao et al. , 2019 ; Chen et al. , 2020a ; Naseer et al. , 2020 ) . This recent line of research suggests that self-supervised learning , which often leads to a more informative and meaningful data representation , can benefit the robustness of deep networks . In this paper , we study how self-supervised representation learning can improve adversarial robustness . We present Self-supervised Online Adversarial Purification ( SOAP ) , a novel defense strategy that uses an auxiliary self-supervised loss to purify adversarial examples at test-time , as illustrated in Figure 1 . During training , beside the classification task , we jointly train the network on a carefully selected self-supervised task . The multi-task learning improves the robustness of the network and more importantly , enables us to counter the adversarial perturbation at test-time by leveraging the label-independent nature of self-supervised signals . Experiments demonstrate that SOAP performs competitively on various architectures across different datasets with only a small computation overhead compared with vanilla training . Furthermore , we design a new attack strategy that targets both the classification and the auxiliary tasks , and show that our method is robust to this adaptive adversary as well . Code is available at https : //github.com/Mishne-Lab/SOAP . 2 RELATED WORK . Adversarial training Adversarial training aims to improve robustness through data augmentation , where the network is trained on adversarially perturbed examples instead of the clean original training samples ( Goodfellow et al. , 2014 ; Kurakin et al. , 2016 ; Tramèr et al. , 2017 ; Madry et al. , 2017 ; Kannan et al. , 2018 ; Zhang et al. , 2019 ) . By solving a min-max problem , the network learns a smoother data manifold and decision boundary which improve robustness . However , the computational cost of adversarial training is high because strong adversarial examples are typically found in an iterative manner with heavy gradient calculation . Compared with adversarial training , our method avoids solving the complex inner-max problem and thus is significantly more efficient in training . Our method does increase test-time computation but it is practically negligible per sample . Adversarial purification Another genre of robust learning focuses on shifting the adversarial examples back to the clean data representation , namely purification . Gu & Rigazio ( 2014 ) exploited using a general DAE ( Vincent et al. , 2008 ) to remove adversarial noises ; Meng & Chen ( 2017 ) train a reformer network , which is a collection of autoencoders , to move adversarial examples towards clean manifold ; Liao et al . ( 2018 ) train a UNet that can denoise adversarial examples to their clean counterparts ; Samangouei et al . ( 2018 ) train a GAN on clean examples and project the adversarial examples to the manifold of the generator ; Song et al . ( 2018 ) assume adversarial examples have lower probability and learn the image distribution with a PixelCNN so that they can maximize the probability of a given test example ; Naseer et al . ( 2020 ) train a conditional GAN by letting it play a min-max game with a critic network in order to differentiate between clean and adversarial examples . In contrast to above approaches , SOAP achieves better robust accuracy and does not require a GAN which is hard and inefficient to train . More importantly , our approach exploits a wider range of self-supervised signals for purification and conceptually can be applied to any format of data and not just images , given an appropriate self-supervised task . Self-supervised learning Self-supervised learning aims to learn intermediate representations of unlabeled data that are useful for unknown downstream tasks . This is done by solving a selfsupervised task , or pretext task , where the supervision of the task comes from the data itself . Recently , a variety of self-supervised tasks have been proposed on images , including data reconstruction ( Vincent et al. , 2008 ; Rifai et al. , 2011 ) , relative positioning of patches ( Doersch et al. , 2015 ; Noroozi & Favaro , 2016 ) , colorization ( Zhang et al. , 2016 ) , transformation prediction ( Dosovitskiy et al. , 2014 ; Gidaris et al. , 2018 ) or a combination of tasks ( Doersch & Zisserman , 2017 ) . More recently , studies have shown how self-supervised learning can improve adversarial robustness . Mao et al . ( 2019 ) find that adversarial attacks fool the networks by shifting latent representation to a false class . Hendrycks et al . ( 2019 ) observe that PGD adversarial training along with an auxiliary rotation prediction task improves robustness , while Naseer et al . ( 2020 ) use feature distortion as a self-supervised signal to find transferable attacks that generalize across different architectures and tasks . Chen et al . ( 2020a ) combine adversarial training and self-supervised pre-training to boost fine-tuned robustness . These methods typically combine self-supervised learning with adversarial training , thus the computational cost is still high . In contrast , our approach achieves robust accuracy by test-time purification which uses a variety of self-supervised signals as auxiliary objectives . 3 SELF-SUPERVISED PURIFICATION . 3.1 PROBLEM FORMULATION . As aforementioned , Mao et al . ( 2019 ) observe that adversaries shift clean representations towards false classes to diminish robust accuracy . The small error in input space , carefully chosen by adversaries , gets amplified through the network , and finally leads to wrong classification . A natural way to solve this is to perturb adversarial examples so as to shift their representation back to the true classes , i.e . purification . In this paper we only consider classification as our main task , but our approach should be easily generalized to other tasks as well . Consider an encoder z = f ( x ; θenc ) , a classifier g ( z ; θcls ) on top of the representation z , and the network g ◦f a composition of the encoder and the classifier . We formulate the purification problem as follows : for an adversarial example ( xadv , y ) and its clean counterpart ( x , y ) ( unknown to the network ) , a purification strategy π aims to find xpfy = π ( xadv ) that is as close to the clean example x as possible : xpfy → x . However , this problem is underdetermined as different clean examples can share the same adversarial counterpart , i.e . there might be multiple or even infinite solutions for xpfy . Thus , we consider the relaxation min π Lcls ( ( g ◦ f ) ( xpfy ) , y ) s.t . ||xpfy − xadv|| ≤ adv , xpfy = π ( xadv ) , ( 1 ) i.e . we accept xpfy as long as Lcls is sufficiently small and the perturbation is bounded . Here Lcls is the cross entropy loss for classification and adv is the budget of adversarial perturbation . However , this problem is still unsolvable since neither the true label y nor the budget adv is available at testtime . We need an alternative approach that can lead to a similar optimum . 3.2 SELF-SUPERVISED ONLINE PURIFICATION . Let h ( z ; θaux ) be an auxiliary device that shares the same representation z with g ( z ; θcls ) , and Laux be the auxiliary self-supervised objective . The intuition behind SOAP is that the shift in representation z that hinders classification will hinder the auxiliary self-supervised task as well . In other words , large Laux often implies large Lcls . Therefore , we propose to use Laux as an alternative to Lcls in Eq . ( 1 ) . Then we can purify the adversarial examples using the auxiliary self-supervised signals , since the purified examples which perform better on the auxiliary task ( small Laux ) should perform better on classification as well ( small Lcls ) . During training , we jointly minimize the classification loss and self-supervised auxiliary loss min θ { Lcls ( ( g ◦ f ) ( x ; θenc , θcls ) , y ) + αLaux ( ( h ◦ f ) ( x ; θenc , θaux ) ) } , ( 2 ) where α is a trade-off parameter between the two tasks . At test-time , given fixed network parameters θ , we use the label-independent auxiliary objective to perform gradient descent in the input space . The purification objective is min π Laux ( ( h ◦ f ) ( xpfy ) ) s.t . ||xpfy − xadv|| ≤ pfy , xpfy = π ( xadv ) , ( 3 ) where pfy is the budget of purification . This is legitimate at test-time because unlike Eq . ( 1 ) , the supervision or the purification signal comes from data itself . Also , compared with vanilla training the only training increment of SOAP is an additional self-supervised regularization term . Thus , the computational complexity is largely reduced compared with adversarial training methods . In Sec . 4 , we will show that adversarial examples do perform worse on auxiliary tasks and the gradient of the auxiliary loss provides useful information on improving robustness . Note that adv is replaced with pfy in Eq . ( 3 ) , and we will discuss how to find appropriate pfy in the next section . Algorithm 1 PGD attack Input : x : a test example ; T : the number of attack steps Output : xadv : the adversarial example 1 : δ ← 0 2 : for t = 1 , 2 , . . . , T do 3 : ` ← Lcls ( ( g ◦ f ) ( x+ δ ; θenc , θcls ) , y ) 4 : δ ← δ + γ sign ( ∇x ` ) 5 : δ ← min ( max ( δ , − adv ) , adv ) 6 : δ ← min ( max ( x+ δ , 0 ) , 1 ) − x 7 : end for 8 : xadv ← x+ δ Algorithm 2 Multi-step purification Input : x : a test example ; T : the number of purification steps Output : xpfy : the purified example 1 : δ ← 0 2 : for t = 1 , 2 , . . . , T do 3 : ` ← Laux ( ( h ◦ f ) ( x+ δ ; θenc , θaux ) ) 4 : δ ← δ − γ sign ( ∇x ` ) 5 : δ ← min ( max ( δ , − pfy ) , pfy ) 6 : δ ← min ( max ( x+ δ , 0 ) , 1 ) − x 7 : end for 8 : xpfy ← x+ δ

Summary: This paper studies adversarial defense by combing purification and self-supervised loss. During inference, the authors propose an online-purification method based on (clipped) iterative gradient ascent. The loss used by purification is from some pre-defined self-supervised tasks. During training, joint loss of softmax and self-supervised loss are used to match the purification process in inference. Experiments on MNIST10 and CIFAR10 demonstrate the effectiveness of the proposed method over several SOTA baselines. The evaluation considers both the white-box and black-box attack setup.