Modeling Adversarial Noise for Adversarial Defense

Deep neural networks have been demonstrated to be vulnerable to adversarial noise , promoting the development of defense against adversarial attacks . Motivated by the fact that adversarial noise contains well-generalizing features and that the relationship between adversarial data and natural data can help infer natural data and make reliable predictions , in this paper , we study to model adversarial noise by learning the transition relationship between adversarial labels ( i.e . the flipped labels used to generate adversarial data ) and natural labels ( i.e . the ground truth labels of the natural data ) . Specifically , we introduce an instance-dependent transition matrix to relate adversarial labels and natural labels , which can be seamlessly embedded with the target model ( enabling us to model stronger adaptive adversarial noise ) . Empirical evaluations demonstrate that our method could effectively improve adversarial accuracy . 1 INTRODUCTION . Deep neural networks have been demonstrated to be vulnerable to adversarial noise ( Goodfellow et al. , 2015 ; Szegedy et al. , 2014 ; Jin et al. , 2019 ; Liao et al. , 2018 ; Ma et al. , 2018 ; Wu et al. , 2020a ) . The vulnerability of deep neural networks seriously threatens many decision-critical deep learning applications ( LeCun et al. , 1998 ; He et al. , 2016 ; Zagoruyko & Komodakis , 2016 ; Simonyan & Zisserman , 2015 ; Kaiming et al. , 2017 ; Ma et al. , 2021 ) . To alleviate the negative affects caused by adversarial noise , a number of adversarial defense methods have been proposed . A major class of adversarial defense methods focus on exploiting adversarial examples to help train the target model ( Madry et al. , 2018 ; Ding et al. , 2019 ; Zhang et al. , 2019 ; Wang et al. , 2019 ) , which achieve the state-of-the-art performance . However , these methods do not explicitly model the adversarial noise . The relationship between the adversarial data and natural data has not been well studied yet . Studying ( or modeling ) the relationship between adversarial data and natural data is considered to be beneficial . If we can model the relationship , we can infer natural data information by exploiting the adversarial data and the relationship . Previous researches have made some explorations on this idea . Some data pre-processing based methods ( Jin et al. , 2019 ; Liao et al. , 2018 ; Naseer et al. , 2020 ; Zhou et al. , 2021 ) , which try to recover the natural data by removing the adversarial noise , share the same philosophy . However , those methods suffer from the high dimensionality problem because both the adversarial data and natural data are high dimensional . The recovered data is likely to have human-observable loss ( i.e. , obvious inconsistency between processed examples and natural examples ) ( Xu et al. , 2017 ) or contain residual adversarial noise ( Liao et al. , 2018 ) . To avoid the above problems , in this paper , we propose to model adversarial noise in the lowdimensional label space . Specifically , instead of directly modeling the relationship between the adversarial data and the natural data , we model the adversarial noise by learning the label transition from the adversarial labels ( i.e. , the flipped labels used to generate adversarial data ) to the natural labels ( i.e. , the ground truth labels of the natural data ) . Note that the adversarial labels have not been well exploited in the community of adversarial learning , which guide the generation of adversarial noise and thus contain valuable information for modeling the well-generalizing features of the adversarial noise ( Ilyas et al. , 2019 ) . It is well-known that the adversarial noise depends on many factors , e.g. , the data distribution , the adversarial attack strategy , and the target model . The proposed adversarial noise modeling method is capable to take into account of the factors because that the label transition is dependent of the adversarial instance ( enabling us to model how the patterns of data distribution and adversarial noise affect label flipping ) and that the transition can be seamlessly embedded with the target model ( enabling us to model stronger adaptive adversarial noise ) . Specifically , we employ a deep neural network to learn the complex instance-dependent label transition . By using the transition relationship , we propose a defense method based on Modeling Adversarial Noise ( called MAN ) . Specifically , we embed a label transition network ( i.e. , a matrix-valued transition function parameterized by a deep neural network ) into the target model , which denotes the transition relationship from mixture labels ( mixture of adversarial labels and natural labels ) to natural labels ( i.e. , the ground truth labels of natural instances and adversarial instances ) . The transition matrix explicitly models adversarial noise and help us to infer natural labels . Considering that adversarial data can be adaptively generated , we conduct joint adversarial training on the target model and the transition network to achieve an optimal adversarial accuracy . We empirically show that the proposed MAN based defense method could provide significant gains in the classification accuracy against adversarial attacks in comparison to state-of-the-art defense methods . The rest of this paper is organized as follows . In Section 2 , we introduce some preliminary information and briefly review related work on attacks and defenses . In Section 3 , we discuss how to design an adversarial defense by modeling adversarial noise . Experimental results are provided in Section 4 . Finally , we conclude this paper in Section 5 . 2 PRELIMINARIES . In this section , we first introduce some preliminary about notation and the problem setting . We then review the most relevant literature on adversarial attacks and adversarial defenses . Notation . We use capital letters such as X and Y to represent random variables , and lower-case letters such as x and y to represent realizations of random variables X and Y , respectively . For norms , we denote by ‖x‖ a generic norm . Specific examples of norms include ‖x‖∞ , the L∞ norm of x , and ‖x‖2 , the L2 norm of x . Let B ( x , ) represent the neighborhood of x : { x̃ : ‖x̃− x‖ ≤ } , where is the perturbation budget . We define the classification function as f : X → { 1 , 2 , . . . , C } . It can be parametrized , e.g. , by deep neural networks . Problem setting . This paper focuses on a classification task under the adversarial environment , where adversarial attacks are utilized to craft adversarial noise to mislead the predictions of the target classification model . Let X and Y be the variables for natural instances and natural labels ( i.e. , the ground truth labels of natural instances ) respectively . We sample natural data { ( xi , yi ) } ni=1 according to the distribution of the variables ( X , Y ) , where ( X , Y ) ∈ X × { 1 , 2 , . . . , C } . Given a deep learning model based classifier f and a pair of natural data ( x , y ) , the adversarial instance x̃ satisfies the following constraint : f ( x̃ ) 6= y s.t . ‖x− x̃‖ ≤ . ( 1 ) The generation of the adversarial instance is guided by the adversarial label ỹ which is different with the natural label y. Adversarial labels can be set by the attacker in target attacks , or be randomly initialized and then found by non-target attacks . Let X̃ and Ỹ be the variables for adversarial instances and adversarial labels respectively . We denote by { ( x̃i , ỹi ) } ni=1 the adversarial data drawn according to a distribution of the variables ( X̃ , Ỹ ) . Our aim is to design an adversarial defense to correct the adversarial label ỹ into natural label y by modeling the relationship between adversarial data ( i.e. , x̃ or ỹ ) and natural data ( i.e. , x or y ) . Adversarial attacks . Adversarial examples are inputs maliciously designed by adversarial attacks to mislead deep neural networks ( Szegedy et al. , 2014 ) . They are generated by adding imperceptible but adversarial noise to natural examples . Adversarial noise can be crafted by multi-step attacks following the direction of adversarial gradients , such as PGD ( Madry et al. , 2018 ) and AA ( Croce & Hein , 2020 ) . These adversarial noise is bounded by a small norm-ball ‖ · ‖p ≤ , so that their adversarial examples can be perceptually similar to natural examples . Optimization-based attacks such as CW ( Carlini & Wagner , 2017b ) and DDN ( Rony et al. , 2019 ) jointly minimize the perturbation L2 and a differentiable loss based on the logit output of a classifier . Some attacks such as FWA ( Wu et al. , 2020b ) and STA ( Xiao et al. , 2018 ) focus on mimicking non-suspicious vandalism by exploiting the geometry and spatial information . Adversarial defenses . The issue of adversarial examples promotes the development of adversarial defenses . A major class of adversarial defense methods is devoted to enhance the adversarial robustness in an adversarial training manner ( Madry et al. , 2018 ; Ding et al. , 2019 ; Zhang et al. , 2019 ; Wang et al. , 2019 ) . They augment training data with adversarial examples and use a min-max formulation to train the target model ( Madry et al. , 2018 ) . However , these methods do not explicitly model the adversarial noise . The relationship between the adversarial data and natural data has not been well studied yet . In addition , some data pre-processing based methods try to remove adversarial noise by learning a denoising function or a feature-squeezing function . For example , denoising based defenses ( Liao et al. , 2018 ; Naseer et al. , 2020 ) transfer adversarial examples into clean examples , and feature squeezing based defenses ( Guo et al. , 2018 ) aim to reduce redundant but adversarial information . However , these methods suffer from the high dimensionality problem because both the adversarial data and natural data are high dimensional . For examples , the recovered data is likely to have human-observable loss ( Xu et al. , 2017 ) ( i.e. , the obvious inconsistency between processed examples and natural examples ) , and the recovered data may contain residual adversarial noise ( Liao et al. , 2018 ) , which would be amplified by the target model and mislead the final prediction . To avoid the above problems , we propose to model adversarial noise in the low-dimensional label space . 3 MODELING ADVERSARIAL NOISE BASED DEFENSE . In this section , we present the proposed Modeling Adversarial Noise ( MAN ) based defense method , to improve the adversarial accuracy against adversarial attacks . We first illustrate the motivation of the proposed defense method ( Section 3.1 ) . Next , we introduce how to model adversarial noise ( Section 3.2 ) . Finally , we present the training process of the proposed adversarial defense ( Section 3.3 ) . 3.1 MOTIVATION . Studying the relationship between adversarial data and natural data is considered to be beneficial for adversarial defense . If we can model the relationship , we can infer clean data information by exploiting the adversarial data and the relationship . Processing the input data to remove the adversarial noise is a representative strategy to estimate the relationship . However , data pre-processing based methods may suffer from high dimensionality problems . To avoid the problem , we would like to model adversarial noise in the low-dimensional label space . Adversarial noise can be modeled because it have imperceptible but well-generalizing features . Specifically , classifiers are usually trained to solely maximize accuracy for natural data . They tend to use any available signal including those that are well-generalizing , yet brittle . Adversarial noise can arise as a result of perturbing these features ( Ilyas et al. , 2019 ) , and it controls the flip from natural labels to adversarial labels . Thus , adversarial noise contains well-generalizing features which can be modeled by learning the label transition from the adversarial labels to natural labels . Note that the adversarial noise depends on many factors , such as data distribution , the adversarial attack strategy , and the target model . Modeling adversarial noise in label space is capable to take into account of these factors . Specifically , since that the label transition is dependent of the adversarial instance , we can model how the patterns of data distribution and adversarial noise affect label flipping , and exploit the modeling to correct the flipping of the adversarial label . In addition , we can model adversarial noise crafted by the stronger white-box adaptive attack , because the label transition can be seamlessly embedded with the target model . By jointly training the transition matrix with the target model , it can also be adaptive to adversarial attacks . We employ a deep neural network to learn the complex label transition from the well-generalizing and misleadingly predictive features of instance-dependent adversarial noise . Motivated by the value of modeling adversarial noise for adversarial defense , we propose a defense method based on Modeling Adversarial Noise ( MAN ) by exploiting label transition relationship .

Summary: This paper proposes an adversarial defense method MAN by learning an instance-dependent transition matrix exploiting the transition relationship of adversarial labels and natural labels.  MAN generates the transition matrix by training a parameterized deep neural network which takes the mixture data (adversarial and natural data) as input and outputs the instance-dependent transition matrix. During inference, we can infer the natural labels with the adversarial labels and the transition matrix.  The authors evaluate MAN under three adaptive attacks scenarios and show the improved adversarial accuracy with the proposed method.