Generative Cleaning Networks with Quantized Nonlinear Transform  for  Deep Neural Network Defense

1 INTRODUCTION . Recent research has shown that deep neural networks are sensitive to adversarial attacks ( Szegedy et al. , 2013 ) . Very small changes of the input image can fool the state-of-art classifier with very high success probabilities . During the past few years , a number of methods have been proposed to construct adversarial samples to attack the deep neural networks , including fast gradient sign ( FGS ) method ( Goodfellow et al. , 2014b ) , Jacobian-based saliency map attack ( J-BSMA ) ( Papernot et al. , 2016a ) , and projected gradient descent ( PGD ) attack ( Kurakin et al. , 2016 ; Madry et al. , 2018 ) . It has also been demonstrated that different classifiers can be attacked by the same adversarial perturbation ( Szegedy et al. , 2013 ) . The fragility of deep neural networks and the availability of these powerful attacking methods present an urgent need for effective defense methods . During the past few years , a number of deep neural network defense methods have been developed , including adversarial training ( Kurakin et al. , 2016 ; Szegedy et al. , 2013 ) , defensive distillation ( Papernot et al. , 2016b ; Carlini & Wagner , 2016 ; Papernot & McDaniel , 2016 ) , Magnet ( Meng & Chen , 2017 ) and featuring squeezing ( He et al. , 2017 ; Xu et al. , 2017 ) . It has been recognized that these methods suffer from significant performance degradation under strong attacks , especially white-box attacks with large magnitude and iterations ( Samangouei et al. , 2018 ) . In this work , we explore a new approach to defend various attacks by developing a generative cleaning network with quantized nonlinear transform . We recognize that the attack noise is not random and has sophisticated patterns . The attackers often generate noise patterns by exploring the specific network architecture or classification behavior of the target deep neural network so that the small noise at the input layer can accumulate along the network inference layers , finally exceed the decision threshold at the output layer , and result in false decision . On the other hand , we know a well-trained deep neural networks are robust to random noise ( Arjovsky et al. , 2017 ) , such as Gaussian noise . Therefore , the key issue in network defense is to randomize or destroy the sophisticated pattern of the attack noise while preserving the original image content . Motivated by this observation , we design a new generative cleaning network with quantized nonlinear transform to first destroy the sophisticated noise patterns of adversarial attacks and then recover the original image content damaged during this nonlinear transform . We also construct a detector network which serves as the dual network for the target classifier to be defended . The generative cleaning network and detector network are jointly trained using adversarial learning so that the detector network can not detect the existence of attack noise pattern in the images recovered by the generative cleaning network . Our extensive experimental results demonstrate that our approach outperforms the state-of-art methods by large margins in both white-box and black-box attacks . It significantly improves the classification accuracy for white-box PGD attacks upon the second best method by more than 40 % on the SVHN dataset from 46.90 % to 93.80 % , and more than 20 % on the challenging CIFAR-10 dataset from 60.15 % to 86.05 % . The major contributions of this work can be summarized as follows . ( 1 ) We have proposed a new approach for deep neural network defense by developing a unique generative cleaning network with quantized nonlinear transform . ( 2 ) We have formulated the problem of destroying the noise patterns of adversarial attacks and reconstructing original image content into generative adversarial network design and training which considers both perceptual loss and adversarial loss . ( 3 ) Our new method has significantly improved the performance of the state-of-the-art methods in the literature under a wide variety of attacks . The rest of this paper is organized as follows . Section 2 reviews related work . The proposed method is presented in Section 3 . Experimental results and performance comparison with existing methods are provided in Section 4 . Section 5 concludes the paper . 2 RELATED WORK . In this section , we review related work on adversarial attack and network defense methods . ( A ) Attack methods . Attack methods can be divided into two threat models : white-box attacks and black-box attacks . The white-box attacker has full access to the classifier network parameters , network architecture , and weights . The black-box attacker has no knowledge of or access to the target network . For white-box attack , a simple and fast approach called Fast Gradient Sign ( FGS ) method has been developed by Goodfellow et al . ( 2014b ) using error back propagation to directly modify the original image . Basic Iterative Method ( BIM ) is an improved version of the FGS method . Carlini & Wagner ( 2016 ) designed an optimization-based attack method , called Carlini-Wagner ( C & W ) attack , which is able to fool the target network with the smallest perturbation . Xiao et al . ( 2018 ) trained a generative adversarial network ( GAN ) ( Goodfellow et al. , 2014a ) to generate perturbations . Kannan et al . ( 2018 ) found that the Projected Gradient Descent ( PGD ) is the strongest among all attack methods . It can be viewed as a multi-step variant of FGSk ( Madry et al. , 2018 ) . Athalye et al . ( 2018 ) introduced a method , called Backward Pass Differentiable Approximation ( BPDA ) , to attack networks where gradients are not available . It is able to successfully attack all existing state-of-the-arts defense methods . For black-box attacks , the attacker has no knowledge about target classifier . Papernot et al . ( 2017 ) introduced the first approach for black-box attack using a substitute model . Dong et al . ( 2018 ) proposed a momentum-based iterative algorithms to improve the transferability of adversarial examples . Xie et al . ( 2018c ) boosted the transferability of adversarial examples by creating diverse input patterns . ( B ) Defense methods Several approaches have recently been proposed for defending both whitebox attacks and black-box attacks . Adversarial training defends various attacks by training the target model with adversarial examples ( Szegedy et al. , 2013 ; Goodfellow et al. , 2014b ) . Madry et al . ( 2018 ) suggested that training with adversarial examples generated by PGD improves the robustness . Meng & Chen ( 2017 ) proposed a method , called MagNet , which detects the perturbations and then reshape them according to the difference between clean and adversarial examples . Recently , there are several defense methods based on GANs have been developed . Samangouei et al . ( 2018 ) projected the adversarial examples into a trained generative adversarial network ( GAN ) to approximate the input using generated clean image with multiple iterations . Recently , some defense methods have been developed based on input transformations . Guo et al . ( 2018 ) proposed several input transformations to defend the adversarial examples , including image cropping and re-scaling , bit-depth reduction , and JPEG compression . Xie et al . ( 2018a ) proposed to defend against adversarial attacks by adding a randomization layer , which randomly re-scales the image and then randomly zero-pads the image . Jia et al . ( 2019 ) proposed an image compression framework to defend adversarial examples , called ComDefend . Xie et al . ( 2018b ) introduced a feature denoising method for defending PGD white-box attacks . Our proposed defense method is also related to GANs and image transformations . But , compared to existing methods , our method is unique in the following aspects : ( 1 ) We introduce a special layer called quantized nonlinear transform , into the generative cleaning network to destroy the sophisticated noise pattern of adversarial attacks . ( 2 ) Unlike the GAN-based methods in ( Wang & Yu , 2019 ; Xiao et al. , 2018 ) which aim to approximate input noise image using images generated by the GAN over multiple iterations , our generative cleaning network aims to reconstruct the image content damaged by quantized nonlinear transform . ( 3 ) Our method does not need to modify the target network to be protected . 3 THE PROPOSED DEFENSE METHOD . In this section , we present our proposed generative cleaning network method for effective deep neural network defense . For convenience , we refer to our proposed method by GCLN . 3.1 METHOD OVERVIEW . Figure 1 provides an overview of the proposed method . The attacked image x∗ is fed into the generative cleaning network Gθ . The network has a special layer , called quantized nonlinear transform , to destroy the noise pattern of the adversarial attack in the input image . The generative cleaning network aims to recover the original image content and produce a recovered image x̄ . This recovered image x̄ will be passed to the target classifier Cα for image classification or recognition . To successfully learn the generative cleaning network Gθ , we construct a detector network Dφ , which serves as the dual network for the target classifier network Cα . The task of Dφ is to determine if the input image is clean or being attacked . In our proposed method , the generative cleaning network Gθ and the detector network Dφ are jointly trained through adversarial learning : the Gθ network is trying to recover the image x̂ so that Dφ can not detect any attack noise in it . In the following sections , we will explain the proposed method in more detail . 3.2 QUANTIZED NONLINEAR TRANSFORM LAYER IN THE GENERATIVE CLEANING NETWORK . During the generative cleaning network design , We incorporate one special layer into the network , called quantized nonlinear transform . This transform aims to disturb and partially destroy the sophisticated pattern of the attack noise . In this work , we propose to construct such a transform using a linear transform T , followed by a quantizer Q and an inverse transform T−1 . For the linear transform , we can use the discrete cosine transform ( DCT ) ( Ahmed et al. , 1974 ) which has been in JPEG image compression ( Wallace , 1992 ) . Specifically , we partition the input image into blocks of M × M . The original image block is denoted by X∗B = [ x∗nk ] 1≤n , k≤M . The output block X̂B = [ x̂ij ] 1≤i , j≤M after DCT transform is given by x̂ij = 1 4 CiCj M−1∑ n=0 M−1∑ k=0 xnk cos ( iπ 2n+ 1 2M ) cos ( jπ 2k + 1 2M ) , ( 1 ) with Ci = 1/ √ 2 for i = 0 , and Ci = 1 for i 6= 0 . After transform , we will quantize the transform coefficient x̂ij as follows RQ ( x̂ij ) = Round ( x̂ij q ) × q , ( 2 ) where q is the quantization parameter . Certainly , this DCT transform can be replaced with other invertible transform , such as discrete wavelet transform ( Daubechies , 1990 ) . During network training , this special quantized nonlinear transform layer is implemented in the same way as the pooling layers in existing deep neural networks and included into the training process of the whole generative cleaning network .

Summary: This paper developed a method for defending deep neural networks against adversarial attacks based on generative cleaning networks with quantized nonlinear transform. The network is claimed to recover the original image while cleaning up the residual attack noise. The authors developed a detector network, which serves as the dual network of the target classifier network to be defended, to detect if the image is clean or being attacked. This detector network and the generative cleaning network are jointly trained with adversarial learning so that the detector network cannot find any attack noise in the output image of generative cleaning network. The experimental results demonstrated that the proposed approach outperforms the state-of-art methods by large margins in both white-box and black-box attacks.