EFFICIENT TWO-STEP ADVERSARIAL DEFENSE FOR DEEP NEURAL NETWORKS

In recent years , deep neural networks have demonstrated outstanding performance in many machine learning tasks . However , researchers have discovered that these state-of-the-art models are vulnerable to adversarial examples : legitimate examples added by small perturbations which are unnoticeable to human eyes . Adversarial training , which augments the training data with adversarial examples during the training process , is a well known defense to improve the robustness of the model against adversarial attacks . However , this robustness is only effective to the same attack method used for adversarial training . Madry et al . ( 2017 ) suggest that effectiveness of iterative multi-step adversarial attacks and particularly that projected gradient descent ( PGD ) may be considered the universal first order adversary and applying the adversarial training with PGD implies resistance against many other first order attacks . However , the computational cost of the adversarial training with PGD and other multi-step adversarial examples is much higher than that of the adversarial training with other simpler attack techniques . In this paper , we show how strong adversarial examples can be generated only at a cost similar to that of two runs of the fast gradient sign method ( FGSM ) , allowing defense against adversarial attacks with a robustness level comparable to that of the adversarial training with multi-step adversarial examples . We empirically demonstrate the effectiveness of the proposed two-step defense approach against different attack methods and its improvements over existing defense strategies . 1 INTRODUCTION . Despite the fact that deep neural networks demonstrate outstanding performance for many machine learning tasks , researchers have found that they are susceptible to attacks by adversarial examples ( Szegedy et al . ( 2014 ) ; Goodfellow et al . ( 2015 ) ) . Adversarial examples which are generated by adding crafted perturbations to legitimate input samples are indistinguishable to human eyes . For classification tasks , these perturbations may cause the legitimate samples to be misclassified by the model at the inference time . While there exists no widely agreed conclusion , several studies attempted to explain the underlying causes of the susceptibility of deep neural networks toward adversarial examples . The vulnerability is ascribed to the linearity of the model ( Goodfellow et al . ( 2015 ) ) , low flexibility ( Fawzi et al . ( 2018 ) ) , or the flatness/curvedness of the decision boundaries ( Moosavi-Dezfooli et al . ( 2017 ) ) , but a more general cause is still under research . The recent literature considered two types of threat models : black-box and white-box attacks . In black-box attacks , the attacker is assumed to have no access to the architecture and parameters of the model , whereas in white-box attacks , the attacker has complete access to such information . Several white-box attack methods were proposed ( Goodfellow et al . ( 2015 ) , Papernot et al . ( 2016a ) , Su et al . ( 2017 ) , Carlini & Wagner ( 2016 ) , Moosavi-Dezfooli et al . ( 2016 ) ) . In response , several defenses have been proposed to mitigate the effect of adversarial attacks . These defenses were developed along three main directions : ( 1 ) expanding the training data to make the classifier more robustly learn the underlying function , e.g. , by adversarial training which augments the training data set with adversarial examples generated by certain attack methods ( Szegedy et al . ( 2014 ) , Goodfellow et al . ( 2015 ) , Kurakin et al . ( 2016 ) ) ; ( 2 ) modifying the training procedure to reduce the gradients of the model w.r.t . the input such that the classifier becomes more robust to input perturbations , e.g. , via input gradient regularization ( Ross & Doshi-Velez , 2017 ) , or defensive distillation ( Papernot et al. , 2016c ) ; and ( 3 ) using external models as network add-ons when classifying unseen examples ( feature squeezing ( Wang et al. , 2018 ) , MagNet ( Meng & Chen , 2017 ) , and Defense-GAN ) ( Samangouei et al. , 2018 ) ) . Adversarial training , a simple but effective method to improve the robustness of a deep neural network against white-box adversarial attacks , uses the same white-box attack mechanism to generate adversarial examples for augmenting the training data set . However , if the attacker applies a different attack strategy , adversarial training does not work well due to gradient masking ( Papernot et al. , 2016b ) . Madry et al . ( 2017 ) have suggested the effectiveness of iterative multi-step adversarial attacks . In particular , it was suggested that projected gradient descent ( PGD ) PGD may be considered the strongest first-order attack so that the adversarial training with PGD can boost the resistance against many other first-order attacks . However , in the literature a large number ( e.g . 40 ) of steps of back propagation are typically used in the iterative attack method of PGD or its closely related variant iterative fast gradient ( IFGSM ) ( Kurakin et al. , 2016 ) to find strong adversarial examples to be used in each adversarial training step , incurring a prohibitively high computational complexity particularly for large DNNs or training datasets . In this paper , we propose an efficient two-step adversarial defense technique , called e2SAD , to facilitate defense against multiple types of whitebox and blackbox attacks with a quality on a par with the expensive adversarial training using the well-known multi-step attack the iterative fast gradient method ( IFGSM ) ( Kurakin et al. , 2016 ) . The first step of e2SAD is similar to the basic adversarial training , where an adversarial example is generated by applying a simple one-step attack method such as the fast gradient sign method ( FGSM ) . Then in the second step , e2SAD attemps to generate a second adversarial example at which the vulnerability of the current model is maximally revealed such that the resulting defense is at the same quality level of the much more expensive IFGSMbased adversarial training . Finally , the two adversarial examples are taken into consideration in the proposed loss function according to which a more robust model is trained , resulting strong defense to both one-step and multi-step iterative attacks with a training time much less less than that of the adversarial training using IFGSM . The main contributions of this paper are as follows : • We propose a computationally efficient method to generate two adversarial examples per input example while effectively revealing the vulnerability of the learned classifier in the neighborhood of each clean data point ; • We show that by considering the generated adversarial examples as part of a well-designed final loss function , the resulting model is robust to both one-step and iterative white box attacks ; • We further demonstrate that by adopting other techniques in our two-step approach like the use of soft labels and hyper parameter tuning , robust defense against black box attacks can be achieved . 2 BACKGROUND . We provide a brief overview of related existing attacks and defense methods , part of which will be also used to compare with the proposed e2SAD approach . Attack Models and Algorithms . The goal of all attack models is to find a perturbation δ to be added to a clean input x ∈ Rd , resulting in an adversarial example xadv = x + δ which may potentially lead to misclassification of the classifier . Typically , the noise level of the perturbation is constrained by the ` ∞ ball denoted by ε to make sure that the perturbation is sufficiently small . Based on the amount of information the attacker knows , there are two threat levels as follows : 1 . White box : the attacker has full information about the model including its architecture and parameters such that it is possible craft adversarial examples using techniques such as gradient based attacks to specifically target the model ; 2 . Black box : the attacker has no knowledge about the architecture and parameters of the model . Neither is the attacker able to query the model . Adversarial examples can be generated using a substitute model which is a white-box to the attacker . 2.1 WHITE BOX ATTACKS . The Fast Gradient Sign Method ( FGSM ) . Given a clean input x and its corresponding true label y , FGSM perturbs x by ( Goodfellow et al. , 2015 ) : xadv = x+ ε · sign ( ∇xJ ( θ , x , y ) ) ( 1 ) where J ( θ , x , y ) is the loss function and ε ∈ [ 0 , 1 ] is a constant value used to constrain the noise level of the perturbation . Iterative Fast Gradient Sign Method ( IFGSM ) and PGD IFGSM attack generates adversarial examples by iteratively applying FGSM attack multiple , sayN , times to a clean input x with a small constant a ( Kurakin et al. , 2016 ) xadvk = clampx , ε ( xadvk−1 + a · sign ( ∇xadvk−1J ( θ , x adv k−1 , y ) ) ) , xadv0 = x , k = [ 1 , · · · , N ] . ( 2 ) In our implementation , we set a = εN . Typically , each component of the input vector , e.g . a pixel , is normalized to be within [ 0 , 1 ] . The function clampx , ε is an elementwise clipping function which clips each element xi of input x into the range of [ max ( 0 , xi − ε ) , min ( 1 , xi + ε ) ] . Projected gradient descent ( PGD ) is a closely related variant of IFGSM . Typically , PGD first randomly picks a point within a confined small ball around each clean input and then applies the multistep IFGSM to generate adversarial examples for that clean input . 2.2 REPRESENTATIVE EXISTING DEFENSE METHODS . Adversarial Training . This is a popular defense approach which augments the training dataset with adversarial examples ( Goodfellow et al . ( 2015 ) , Kurakin et al . ( 2016 ) ) . In our implementation , we adopt the adversarial training equation proposed in ( Goodfellow et al. , 2015 ) as the loss function Jadv ( θ , x , y ) = α · J ( θ , x , y ) + ( 1− α ) · J ( θ , xadv , y ) , ( 3 ) where α is a constant specifying the relative importance of the adversarial examples . In our latter comparison , we choose two methods , FGSM and IFGSM , for generating the adversarial examples . Minmax . There exist defense methods ( Huang et al . ( 2015 ) ; Madry et al . ( 2017 ) ) which view the process of training a robust model as solving a minmax optimization problem arg min θ E ( x , y ) ∼D [ max δ J ( θ , x+ δ , y ) ] , ( 4 ) where D is the underlying training data distribution , J ( θ , x , y ) is the loss function , and θ is the parameters of the model . In ( Huang et al . ( 2015 ) ) and Madry et al . ( 2017 ) ) , the maximization with respect to δ is approximated by a specific attack method , for example , by PGD Madry et al . ( 2017 ) . Hamm ( 2018 ) proposes a new approach which can instead of targeting the saddle points like previous methods , find the true optimal solution of the minmax optimization problem . Hamm ( 2018 ) chooses FGSM to approximate the inner maximization step and for the outer minimization step , instead of plugging the adversarial version of the clean data directly and solving the optimization problem , changes the minimization objective function to arg min θ [ J ( θ , xadv , y ) + εN 2 ∥∥∥∥∂J ( θ , xadv , y ) ∂xadv ∥∥∥∥ ] , ( 5 ) where ε is a constant restricting the level of input perturbation , and N is the number of the training examples in each minibatch .

Summary: . The authors propose a novel adversarial training method, e2SAD, that relies on a two-step process for generating sets of two training adversarial samples for each clean training sample. The first step is a classical FGSM that yields the first adversarial sample. The second adversarial sample is calculated with a FGSM that is based on the cross-entropy between the probabilities generated by the first adversarial sample and the probabilities generated by the second adversarial sample. The method is computationally efficient (two forward/backward passes per clean sample) w.r.t. powerful iterative attacks such as IFGSM or PGD requiring 40+ steps and the authors claim it gives comparable results to adversarial training with multi-step attacks methods in white and black-box settings.