Fighting Gradients with Gradients: Dynamic Defenses against Adversarial Attacks

Adversarial attacks optimize against models to defeat defenses . Existing defenses1 are static , and stay the same once trained , even while attacks change . We argue2 that models should fight back , and optimize their defenses against attacks at test3 time . We propose dynamic defenses , to adapt the model and input during testing,4 by defensive entropy minimization ( dent ) . Dent alters testing , but not training , for5 compatibility with existing models and train-time defenses . Dent improves the6 robustness of adversarially-trained defenses and nominally-trained models against7 white-box , black-box , and adaptive attacks on CIFAR-10/100 and ImageNet . In8 particular , dent boosts state-of-the-art defenses by 20+ points absolute against9 AutoAttack on CIFAR-10 at ∞ = 8/255.10 1 Introduction : Attack , Defend , and Then ? 11 Deep networks are vulnerable to adversarial attacks : input perturbations that alter natural data to12 cause errors or exploit predictions [ 54 ] . As deep networks are deployed in real systems , these attacks13 are real threats [ 63 ] , and so defenses are needed . The challenge is that every new defense is followed14 by a new attack , in a loop [ 56 ] . The strongest attacks , armed with gradient optimization , update to15 circumvent defenses that do not . Such iterative attacks form an even tighter loop to ensnare defenses.16 In a cat and mouse game , the mouse must keep moving to survive.17 Current defenses , deterministic or stochastic , stand still : once trained , they are static and do not adapt18 during testing . Adversarial training [ 18 , 30 ] learns from attacks during training , but can not learn19 from test data . Stochastic defenses alter the network [ 11 ] or input [ 20 , 7 ] , but their randomness is20 independent of test data . Static defenses do not adapt , and so they may fail as attacks update.21 Our dynamic defense fights adversarial updates with defensive updates by adapting during testing22 ( Figure 1 ) . In fact , our defense updates on every input , whether natural or adversarial . Our defense23 objective is entropy minimization , to maximize model confidence , so we call our method dent for24 defensive entropy . Our updates rely on gradients and batch statistics , inspired by test-time adaptation25 approaches [ 53 , 43 , 28 , 29 , 58 ] . In pivoting from training to testing , dent is able to keep changing , so26 the attacker never hits the same defense twice . Dent has the last move advantage , as its update always27 follows each attack.28 Dent connects adversarial defense and domain adaptation , which share an interest in the sensitivity of29 deep networks to input shifts . Just as models fail on adversarial attacks , they fail on natural shifts30 like corruptions . Adversarial data is a particularly hard shift , as evidenced by the need for more31 parameters and optimization for adversarial training [ 30 ] , and its negative side effect of reducing32 Submitted to 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . Do not distribute . ( a ) train ( b ) static defense ( c ) dynamic defense ✔ ✔ ✔ < latexit sha1_base64= '' 2rOUSCw5QBt4CukzW0lP28fPN44= '' > AAAB7XicbVDLSgNBEOz1GeMr6tHLYBA8hV0R9Rjw4jGCeUCyhNnJbDJmdmaZ6RXCkn/w4kERr/6G3+DNv3HyOGhiQUNR1U13V5RKYdH3v72V1bX1jc3CVnF7Z3dvv3Rw2LA6M4zXmZbatCJquRSK11Gg5K3UcJpEkjej4c3Ebz5yY4VW9zhKeZjQvhKxYBSd1OjggCPtlsp+xZ+CLJNgTsowR61b+ur0NMsSrpBJam078FMMc2pQMMnHxU5meUrZkPZ521FFE27DfHrtmJw6pUdibVwpJFP190ROE2tHSeQ6E4oDu+hNxP+8dobxdZgLlWbIFZstijNJUJPJ66QnDGcoR45QZoS7lbABNZShC6joQggWX14mjfNKcFnx7y7K1ehzFkcBjuEEziCAK6jCLdSgDgwe4Ale4NXT3rP35r3PWle8eYRH8Afexw/oPZAN < /latexit > ✓ < latexit sha1_base64= '' AhwyGtIuXiSBnj0qtFaaFkQkbRE= '' > AAACM3icbVBLSwMxGMz6rPVV9eglWARBKdla1/ZW8CKeKtgHbJeSTdM2NPsgyYpl2f/kxbu/wYMgHhTx6n8w2/ZgWwc+GGYmyZdxQ86kQujNWFpeWV1bz2xkN7e2d3Zze/sNGUSC0DoJeCBaLpaUM5/WFVOctkJBsedy2nSHV6nfvKdCssC/U6OQOh7u+6zHCFZa6uRu2uM7bNF3nRgV0Nl0EvhwGs96lQoqmZY2LxAqWpU0dV4sW1bS7lKucNLJ5bU0Blwk5pTkwRS1Tu6l3Q1I5FFfEY6ltE0UKifGQjHCaZJtR5KGmAxxn9qa+tij0onHOyXwWCtd2AuEHl/Bsfr3RIw9KUeeq5MeVgM576Xif54dqV7ZiZkfRor6ZPJQL+JQBTAtEHaZoETxkSaYCKZ3hWSABSZK15zVJZjzX14kjWLBtArotpSvus+TOjLgEByBE2CCS1AF16AG6oCAR/AKPsCn8WS8G1/G9yS6ZEwrPAAzMH5+AUAHpoE= < /latexit > x + < latexit sha1_base64= '' 2rOUSCw5QBt4CukzW0lP28fPN44= '' > AAAB7XicbVDLSgNBEOz1GeMr6tHLYBA8hV0R9Rjw4jGCeUCyhNnJbDJmdmaZ6RXCkn/w4kERr/6G3+DNv3HyOGhiQUNR1U13V5RKYdH3v72V1bX1jc3CVnF7Z3dvv3Rw2LA6M4zXmZbatCJquRSK11Gg5K3UcJpEkjej4c3Ebz5yY4VW9zhKeZjQvhKxYBSd1OjggCPtlsp+xZ+CLJNgTsowR61b+ur0NMsSrpBJam078FMMc2pQMMnHxU5meUrZkPZ521FFE27DfHrtmJw6pUdibVwpJFP190ROE2tHSeQ6E4oDu+hNxP+8dobxdZgLlWbIFZstijNJUJPJ66QnDGcoR45QZoS7lbABNZShC6joQggWX14mjfNKcFnx7y7K1ehzFkcBjuEEziCAK6jCLdSgDgwe4Ale4NXT3rP35r3PWle8eYRH8Afexw/oPZAN < /latexit > ✓ < latexit sha1_base64= '' 2rOUSCw5QBt4CukzW0lP28fPN44= '' > AAAB7XicbVDLSgNBEOz1GeMr6tHLYBA8hV0R9Rjw4jGCeUCyhNnJbDJmdmaZ6RXCkn/w4kERr/6G3+DNv3HyOGhiQUNR1U13V5RKYdH3v72V1bX1jc3CVnF7Z3dvv3Rw2LA6M4zXmZbatCJquRSK11Gg5K3UcJpEkjej4c3Ebz5yY4VW9zhKeZjQvhKxYBSd1OjggCPtlsp+xZ+CLJNgTsowR61b+ur0NMsSrpBJam078FMMc2pQMMnHxU5meUrZkPZ521FFE27DfHrtmJw6pUdibVwpJFP190ROE2tHSeQ6E4oDu+hNxP+8dobxdZgLlWbIFZstijNJUJPJ66QnDGcoR45QZoS7lbABNZShC6joQggWX14mjfNKcFnx7y7K1ehzFkcBjuEEziCAK6jCLdSgDgwe4Ale4NXT3rP35r3PWle8eYRH8Afexw/oPZAN < /latexit > ✓ < latexit sha1_base64= '' 2rOUSCw5QBt4CukzW0lP28fPN44= '' > AAAB7XicbVDLSgNBEOz1GeMr6tHLYBA8hV0R9Rjw4jGCeUCyhNnJbDJmdmaZ6RXCkn/w4kERr/6G3+DNv3HyOGhiQUNR1U13V5RKYdH3v72V1bX1jc3CVnF7Z3dvv3Rw2LA6M4zXmZbatCJquRSK11Gg5K3UcJpEkjej4c3Ebz5yY4VW9zhKeZjQvhKxYBSd1OjggCPtlsp+xZ+CLJNgTsowR61b+ur0NMsSrpBJam078FMMc2pQMMnHxU5meUrZkPZ521FFE27DfHrtmJw6pUdibVwpJFP190ROE2tHSeQ6E4oDu+hNxP+8dobxdZgLlWbIFZstijNJUJPJ66QnDGcoR45QZoS7lbABNZShC6joQggWX14mjfNKcFnx7y7K1ehzFkcBjuEEziCAK6jCLdSgDgwe4Ale4NXT3rP35r3PWle8eYRH8Afexw/oPZAN < /latexit > ✓ attacker defender < latexit sha1_base64= '' ppjlPDcyu4VwLDDqZq2kE4xaNjg= '' > AAACV3icbVHLTgIxFO2MqIgv1KWbRmJioiEdRISdiRuXmIiYwEg6pWBjpzNp7xjJZP7NbzBu+BU32gEW+DjJTU7Oub29PQ1iKQwQMnXclcLq2npxo7S5tb2zW97bvzdRohnvsEhG+iGghkuheAcESP4Qa07DQPJu8Hyd+90Xro2I1B1MYu6HdKzESDAKVhqUVX82o6fHgZ+SKjlbVIZfT9OfXqtV8y4azUbtsn5BWk3vDJNqvdUk50t6ri035WbWH3IJ9DGFLBuUK3b4DPgv8RakghZoD8rv/WHEkpArYJIa0/NIDH5KNQgmeVbqJ4bHlD3TMe9ZqmjIjZ/O9s7wsVWGeBRpWwrwTF0+kdLQmEkY2M6QwpP57eXif14vgVHTT4WKE+CKzS8aJRJDhPOQ8VBozkBOLKFMC7srZk9UUwb2K0o2BO/3k/+S+1rVa1TJbb1yFbzN4yiiQ3SETpCHLtEVukFt1EEMfaBPZ8UpOFPny11zi/NW11lEeIB+wN37Buxpqzg= < /latexit > x + t < latexit sha1_base64= '' nBInVXJwAgBXrV95v+J1waqiBYM= '' > AAACW3icbVHLSgMxFM1MfdTxVRVXboJFENQy04dtdwU3LhWsLbRjyaRpG8w8SO6IZZh/8xtc6cJfEdNpQateuHByzr25NydeJLgC2343zNzK6tp6fsPa3Nre2S3s7d+rMJaUtWkoQtn1iGKCB6wNHATrRpIR3xOs4z1ezfTOE5OKh8EdTCPm+mQc8BGnBDQ1KMh+dkdPjj03sUv2+SJT/HyWLGtNp35Zrdu1RqNcqZWb1XNslyrfR0fLtRnnLFVp2kr7QyaAPCRw4aTpoFDUA7LAf4GzAEW0iJtB4bU/DGnsswCoIEr1HDsCNyESOBUstfqxYhGhj2TMehoGxGfKTbLdU3yimSEehVJnADhjf3YkxFdq6nu60icwUb+1Gfmf1oth1HATHkQxsIDOB41igSHEM6PxkEtGQUw1IFRyvSumEyIJBf0dljbB+f3kv+C+rN0s2bfVYst7mduRR0foGJ0iB9VRC12jG9RGFL2hT2PdyBsfZs60zK15qWksLDxAS2EefgGe+Krr < /latexit > x + t 1 < latexit sha1_base64= '' aXlGNmGpUtm/2tH4c4aPucVYgsk= '' > AAACXHicbVHLahsxFNVM08ZxmsZpoJtuRE2h0NRI4/E8doFuukwgTgL21Ghk2RHRPJDulJph/q3f0F02+ZVWHnuR14ELh3OudK+O0lJJA4TcOe6rnddvdjt73f23B+8Oe0fvL01RaS7GvFCFvk6ZEUrmYgwSlLgutWBZqsRVevt97V/9EtrIIr+AVSmSjC1zuZCcgZVmPTNt75joZZrUZEBOttXg31/rx17kD+kw9EZ+TGgckOgEkwENosAL/RGJIzKMPRq2YhR5w5EX+5SGgR+SoNtM50IB+1nDN69pZr2+ndACPyd0S/poi7NZ7+90XvAqEzlwxYyZUFJCUjMNkivRdKeVESXjt2wpJpbmLBMmqdvlG/zZKnO8KLStHHCrPjxRs8yYVZbazozBjXnqrcWXvEkFiyipZV5WIHK+GbSoFIYCr5PGc6kFB7WyhHEt7a6Y3zDNONj/6NoQ6NMnPyeXno14QM79/mn6ZxNHB31En9AXRFGITtEPdIbGiKM79M/pOHvOvbvj7rsHm1bX2UZ4jB7B/fAfKhyrJg== < /latexit > x + t 2 < latexit sha1_base64= '' ppjlPDcyu4VwLDDqZq2kE4xaNjg= '' > AAACV3icbVHLTgIxFO2MqIgv1KWbRmJioiEdRISdiRuXmIiYwEg6pWBjpzNp7xjJZP7NbzBu+BU32gEW+DjJTU7Oub29PQ1iKQwQMnXclcLq2npxo7S5tb2zW97bvzdRohnvsEhG+iGghkuheAcESP4Qa07DQPJu8Hyd+90Xro2I1B1MYu6HdKzESDAKVhqUVX82o6fHgZ+SKjlbVIZfT9OfXqtV8y4azUbtsn5BWk3vDJNqvdUk50t6ri035WbWH3IJ9DGFLBuUK3b4DPgv8RakghZoD8rv/WHEkpArYJIa0/NIDH5KNQgmeVbqJ4bHlD3TMe9ZqmjIjZ/O9s7wsVWGeBRpWwrwTF0+kdLQmEkY2M6QwpP57eXif14vgVHTT4WKE+CKzS8aJRJDhPOQ8VBozkBOLKFMC7srZk9UUwb2K0o2BO/3k/+S+1rVa1TJbb1yFbzN4yiiQ3SETpCHLtEVukFt1EEMfaBPZ8UpOFPny11zi/NW11lEeIB+wN37Buxpqzg= < /latexit > x + t < latexit sha1_base64= '' nBInVXJwAgBXrV95v+J1waqiBYM= '' > AAACW3icbVHLSgMxFM1MfdTxVRVXboJFENQy04dtdwU3LhWsLbRjyaRpG8w8SO6IZZh/8xtc6cJfEdNpQateuHByzr25NydeJLgC2343zNzK6tp6fsPa3Nre2S3s7d+rMJaUtWkoQtn1iGKCB6wNHATrRpIR3xOs4z1ezfTOE5OKh8EdTCPm+mQc8BGnBDQ1KMh+dkdPjj03sUv2+SJT/HyWLGtNp35Zrdu1RqNcqZWb1XNslyrfR0fLtRnnLFVp2kr7QyaAPCRw4aTpoFDUA7LAf4GzAEW0iJtB4bU/DGnsswCoIEr1HDsCNyESOBUstfqxYhGhj2TMehoGxGfKTbLdU3yimSEehVJnADhjf3YkxFdq6nu60icwUb+1Gfmf1oth1HATHkQxsIDOB41igSHEM6PxkEtGQUw1IFRyvSumEyIJBf0dljbB+f3kv+C+rN0s2bfVYst7mduRR0foGJ0iB9VRC12jG9RGFL2hT2PdyBsfZs60zK15qWksLDxAS2EefgGe+Krr < /latexit > x + t 1 < latexit sha1_base64= '' aXlGNmGpUtm/2tH4c4aPucVYgsk= '' > AAACXHicbVHLahsxFNVM08ZxmsZpoJtuRE2h0NRI4/E8doFuukwgTgL21Ghk2RHRPJDulJph/q3f0F02+ZVWHnuR14ELh3OudK+O0lJJA4TcOe6rnddvdjt73f23B+8Oe0fvL01RaS7GvFCFvk6ZEUrmYgwSlLgutWBZqsRVevt97V/9EtrIIr+AVSmSjC1zuZCcgZVmPTNt75joZZrUZEBOttXg31/rx17kD+kw9EZ+TGgckOgEkwENosAL/RGJIzKMPRq2YhR5w5EX+5SGgR+SoNtM50IB+1nDN69pZr2+ndACPyd0S/poi7NZ7+90XvAqEzlwxYyZUFJCUjMNkivRdKeVESXjt2wpJpbmLBMmqdvlG/zZKnO8KLStHHCrPjxRs8yYVZbazozBjXnqrcWXvEkFiyipZV5WIHK+GbSoFIYCr5PGc6kFB7WyhHEt7a6Y3zDNONj/6NoQ6NMnPyeXno14QM79/mn6ZxNHB31En9AXRFGITtEPdIbGiKM79M/pOHvOvbvj7rsHm1bX2UZ4jB7B/fAfKhyrJg== < /latexit > x + t 2 < latexit sha1_base64= '' hRRmoBqyNB/m3sMmuTH2eEiEI1k= '' > AAACYXicbVHLbtswEKTUtE3cJlHTYy5EjAIFmhqU/JJvAdpDjykQJwEs1aDotU2EeoBcBTEE/Vu/IbdceumPlLJ9yKMDLDCYWXKXw6RQ0iBjD477auf1m7e7e6137/cPDr0PR5cmL7WAschVrq8TbkDJDMYoUcF1oYGniYKr5OZb41/dgjYyzy5wVUCc8kUm51JwtNLUu4vWd0z0Iokr1mGn26pphEtA/qV62hD4/nDQG7J+GAbdfjDqnVLWGQTDXp+NQtYdBX5/MGq0hoSPjG6rjr6DQv6rwq9BXU+9th2zBn1J/C1pky3Op959NMtFmUKGQnFjJj4rMK64RikU1K2oNFBwccMXMLE04ymYuFovX9NPVpnRea5tZUjX6uMTFU+NWaWJ7Uw5Ls1zrxH/501KnIdxJbOiRMjEZtC8VBRz2sRNZ1KDQLWyhAst7a5ULLnmAu2ntGwI/vMnvySXQccfdNjPXvss+b2JY5cckxPymfhkSM7ID3JOxkSQP86Os+8cOH/dPddzjzatrrON8CN5Avf4H21BrDk= < /latexit > ✓ + t 2 < latexit sha1_base64= '' A9WiZ+bK/7LW5jA/gnGgQJ1REHg= '' > AAACYHicbVHLbhMxFPVMeYTQ0rTsYGMRISFRInsyz10lWLAsEmkrZYbI4ziJVc9D9h2qaDT/xjewY8GGL8F5LGjLka50dM617/VxXitpgJBfjnvw6PGTp71n/eeHRy+OByenl6ZqNBcTXqlKX+fMCCVLMQEJSlzXWrAiV+Iqv/m48a++C21kVX6FdS2ygi1LuZCcgZVmg9t0e8dUL/OsJSNytq8Op7ASwN63dxs8Mk48GoRx6EV+QJL4DJNRGJEgjr1x4CU+pVG40YJx5AV+QmgSkij2x/0u/SQUsG8tfKBdNxsM7ZQt8ENC92SI9riYDX6m84o3hSiBK2bMlJIaspZpkFyJrp82RtSM37ClmFpaskKYrN3u3uG3VpnjRaVtlYC36r8nWlYYsy5y21kwWJn73kb8nzdtYBFnrSzrBkTJd4MWjcJQ4U3aeC614KDWljCupd0V8xXTjIP9k74Ngd5/8kNy6Y1oOCJf/OF5/mMXRw+9Rm/QO0RRhM7RZ3SBJoij386Bc+gcOX/cnnvsnuxaXWcf4Ut0B+6rv9kLq/o= < /latexit > ✓ + t 1 < latexit sha1_base64= '' C+y4zG3KVrZ+ZpUXBqcomtU3aGw= '' > AAACXnicbVFNa9tAEF2pbZIqTeO2l0AvS02h0GBWsmTZt0By6DGFOglYqlmtx/aS1Qe7o4IR+m/9Db2VXvpTsv441EkfDDzem92ZfZtVShpk7LfjPnv+4uDw6KV3/Ork9WnnzdsbU9ZawFiUqtR3GTegZAFjlKjgrtLA80zBbXZ/ufZvf4A2siy+4aqCNOeLQs6l4GilaadONndM9CJLG9Zj57tqaYJLQP652W/wRwMWD8O+34+DKByx4JyyXsT25GitxX48CGMWDYdBPwpGodcmV6CQf2+wbaedrp2xAX1K/B3pkh2up51fyawUdQ4FCsWNmfiswrThGqVQ0HpJbaDi4p4vYGJpwXMwabPZvKUfrTKj81LbKpBu1H9PNDw3ZpVntjPnuDSPvbX4P29S43yYNrKoaoRCbAfNa0WxpOus6UxqEKhWlnChpd2ViiXXXKD9Ec+G4D9+8lNyE/T8QY99DbsX2c9tHEfkPflAPhGfxOSCfCHXZEwE+eM4juccO3/dA/fEPd22us4uwndkD+7ZA690q38= < /latexit > ✓ + t Experiments evaluate dent against white-box attacks ( APGD , FAB ) , black-box attack ( Square ) , and35 adaptive attacks that are aware of its updates . Dent boosts state-of-the-art adversarial training defenses36 on CIFAR-10 by 20+ points against AutoAttack [ 9 ] at ∞ = 8/255 . Ablations inspect the effects of37 iteration , parameterization , and batch size . Our code is included in the supplement.38 Our contributions39 • We highlight an opportunity for dynamic defense : the last move advantage.40 • We propose the first fully test-time dynamic defense : dent adapts both the model and input41 during testing without needing to alter training.42 • Dent augments state-of-the-art adversarial training methods , improving robustness by 30 % 43 relative , and tops the AutoAttack leaderboard by 15+ points.44 • We devise two adaptive attacks against dent : denying updates and mixing batches.45 2 Related Work46 Adversarial Defense For adaptive adversaries , which change in response to defenses , it is natural47 to consider dynamic defenses , which adapt in turn . Evans et al . [ 14 ] explain dynamic defenses are48 promising in principle but caution they may not be effective in practice . Their analysis concerns49 randomized defenses , which do change , but their randomization does not adapt to the input . We argue50 for dynamic defenses that depend on the input to keep adapting along with the attacks . Goodfellow51 [ 17 ] supports dynamic defenses for similar reasons , but does not develop a specific defense . We52 demonstrate the first defense to optimize the model and input during testing for improved robustness.53 Most defenses for deep learning focus on first-order adversaries [ 18 , 30 ] that are equipped with54 gradient optimization but constrained by ` p-norm bounds . Adversarial training and randomization55 are the most effective defenses against such attacks , but are nevertheless limited , as they are fixed56 during testing . Adversarial training [ 18 , 30 ] trains on attacks , but a different or stronger adversary57 ( by norm or bound ) can overcome the trained defense [ 46 , 55 ] . Randomizing the input [ 37 , 7 , 32 ] 58 or network [ 11 ] requires the adversary to optimize in expectation [ 3 ] , but can still fail with more59 iterations . Furthermore , these defenses gain adversarial robustness by sacrificing accuracy on natural60 data . Dent adapts during testing to defend against various attacks without more harm to natural61 accuracy.62 Generative , self-supervised , and certified defenses try to align testing with training but are still63 static . Generative defenses optimize the input w.r.t . autoregressive [ 50 ] , GAN [ 42 ] , or energy [ 23 ] 64 models , but the models do not adapt , and may be attacked by approximating their gradients [ 3 ] .65 Self-supervised defenses optimize the input w.r.t . auxiliary tasks [ 49 ] , but again the models do not66 adapt . Certified defenses [ 7 , 66 ] guarantee robustness within their training scope , but are limited67 to small perturbations by specific types of attacker during testing . Changing data distributions or68 adversaries requires re-training all of these defenses . Dent adapts during testing , without requiring69 ( re- ) training , and is the only method to update the model itself against attack.70 Domain Adaptation Domain adaptation mitigates input shifts between the source ( train ) and target71 ( test ) to maintain model accuracy [ 34 , 41 ] . Adversarial attacks are such a shift , and adversarial72 error is related to natural generalization error [ 51 , 15 ] . How then can adaptation inform dynamic73 defense ? Train-time adaptation is static , like adversarial training , with the same issues of capacity,74 optimization , and re-computation when the data/adversary changes . We instead turn to test-time75 adaptation methods.76 Test-time adaptation keeps updating the model as the data changes . Model parameters and statistics77 can be updated by self-supervision [ 53 ] , normalization [ 43 ] , and entropy minimization [ 58 ] . These78 methods improve robustness to natural corruptions [ 22 ] , but their effect on adversarial perturbations79 is not known . We base our defense on entropy minimization as it enables optimization during testing80 without altering model architecture or training ( as needed for self-supervision ) . For defense , we ( 1 ) 81 extend the parameterization of adaptation with model and input transformations , ( 2 ) optimize for82 additional iterations , and ( 3 ) investigate usage on data that is adversarial , natural , or mixed . We are83 the first to report test-time model adaptation improves robustness to adversarial perturbations.84 Dynamic Inference A dynamic model conditionally changes inference for each input , while a85 static model unconditionally fixes inference for all inputs . There are various dynamic inference86 techniques , with equally varied goals , such as expressivity with more parameters or efficiency with87 less computation . All static models are alike ; each dynamic model is dynamic in its own way.88 Selection techniques learn to choose a subset of components [ 1 , 57 ] . Halting techniques learn to89 continue or end computation [ 19 , 59 ] . Mixing techniques learn to combine parameters [ 47 , 33 , 62 ] .90 Implicit techniques learn to iteratively update [ 6 , 4 ] . While these methods learn to adapt during91 training , our method keeps adapting by directly optimizing during testing.92 3 Dynamic Defense by Test-Time Adaptation93 Adversarial attacks optimize against defenses at test time , so defenses should fight back , and counter-94 optimize against attacks . Defensive entropy minimization ( dent ) does exactly this for dynamic95 defense by test-time adaptation.96 In contrast to many existing defenses , dent alters testing , but not training . Dent only needs differen-97 tiable parameters for gradient optimization and probabilistic predictions for entropy measurement.98 As such , it applies to both adversarially-trained and nominally-trained models.99 3.1 Preliminaries on Attacks and Defenses100 Let x ∈ Rd and y ∈ { 1 , . . . , C } be an input sample and its corresponding ground truth . Given a101 model f ( · ; θ ) : Rd → RC parameterized by θ , the goal of the adversary is to craft a perturbation102 δ ∈ Rd such that the perturbed input x̃ = x+ δ causes a prediction error f ( x+ δ ; θ ) 6= y.103 A targeted attack aims for a specific prediction of y′ , while an untargeted attack seeks any incorrect104 prediction . The perturbation δ is constrained by a choice of ` p norm and threshold : { δ ∈ Rd |105 ‖δ‖p < } . We consider the two most popular norms for adversarial attacks : ` ∞ and ` 2.106 Adversarial training is a standard defense , formulated by Madry et al . [ 30 ] as a saddle point problem,107 argmin θ E ( x , y ) max δ L ( f ( x+ δ ; θ ) , y ) , ( 1 ) which the model minimizes and the adversary maximizes with respect to the loss L ( ŷ , y ) , such as108 cross-entropy for classification . The adversary iteratively optimizes δ by projected gradient descent109 ( PGD ) , a standard algorithm for constrained optimization , for each step t via110 δt = Πp ( δ t−1 + α · sign ( ∇δt−1L ( f ( x+ δt−1 ; θ ) , y ) ) ) , ( 2 ) for projection Πp onto the norm ball for ` p < , step size hyperparameter α , and random initialization111 δ0 . The model optimizes θ against δ to minimize the loss of its predictions on perturbed inputs . This112 is accomplished by augmenting the training set with adversarial inputs from PGD attack.113 Adversarial training is state-of-the-art , but static . Dynamic defenses offer to augment its robustness.114 3.2 Defensive Entropy Minimization115 Defensive entropy minimization ( dent ) counters attack updates with defense updates . While adver-116 saries optimize to cross decision boundaries , entropy minimization optimizes to distance predictions117 from decision boundaries , interfering with attacks . As the adversary optimizes its perturbation δ , dent118 optimizes its adaptation ∆ , Σ . Figure 2 shows dent ’ s model ( ∆ ) and input ( Σ ) updates.119 Dent is dynamic because both ∆ , Σ depend on the testing data , whether natural x or adversarial120 x+ δ . On the contrary , static defenses depend only on training data through the model parameters θ.121 Figure 3 contrasts static and dynamic defenses across the steps of attack optimization.122 Entropy Objective Test-time optimization requires an unsupervised objective . Following tent [ 58 ] ,123 we adopt entropy minimization as our adaptation objective . Specifically , our defense objective is to124 minimize the Shannon entropy [ 45 ] H ( ŷ ) of the model prediction during testing ŷ = f ( x ; θ ) for the125 probability ŷc of class c:126 H ( ŷ ) = − ∑ c∈1 , ... , C p ( ŷc ) log p ( ŷc ) ( 3 ) Adaptation Parameters Dent adapts the model by ∆ and input by Σ ( Figure 2 ) . For the model , dent127 adapts affine scale γ and shift β parameters by gradient updates and adapts mean µ and variance σ2128 statistics by estimation . These are a small portion of the full model parameters θ , in only the batch129 normalization layers [ 25 ] . However , they are effective for conditioning a model on changes in the130 task [ 33 ] or data [ 43 , 58 ] . For the input , dent updates Gaussian smoothing g by gradient updates131 of the parameter Σ , while adjusting the filter size for efficiency [ 48 ] . This controls the degree of132 smoothing dynamically , unlike defense by static smoothing [ 7 ] .133 In standard models the scale γ and shift β parameters are shared across inputs , and so adaptation134 updates batch-wise . For further adaptation , dent can update sample-wise , with different affine135 parameters for each input . In this way , it adapts more than prior test-time adaptation methods with136 batch-wise parameters [ 58 , 43 ] .137 Our model and input parameters are differentiable , so end-to-end optimization coordinates them138 against attacks as layered defenses . This coordination is inspired by CyCADA [ 24 ] , for domain139 adaptation , but dent differs in its purpose and its unified loss . CyCADA also optimizes input and140 model transformations but does so in parallel with separate losses . Our defensive optimization is141 joint and shares the same loss.142

Summary: The paper proposes a novel test-time dynamic defense method, which adapts the model and input during testing by defensive entropy minimization (named dent). Given an input, the proposed method minimizes the entropy of the model prediction to adapt the input and updates parameters in batch normalization layers. Empirical results show that the proposed method improves the robustness of adversarially/nominally-trained models against various attacks including AutoAttack.