A Direct Approach to Robust Deep Learning Using Adversarial Networks

1 INTRODUCTION . Deep neural networks have been successfully applied to a variety of tasks , including image classification ( Krizhevsky et al. , 2012 ) , speech recognition ( Graves et al. , 2013 ) , and human-level playing of video games through deep reinforcement learning ( Mnih et al. , 2015 ) . However , Szegedy et al . ( 2014 ) showed that convolutional neural networks ( CNN ) are extremely sensitive to carefully crafted small perturbations added to the input images . Since then , many adversarial examples generating methods have been proposed , including Jacobian based saliency map attack ( JSMA ) ( Papernot et al. , 2016a ) , projected gradient descent ( PGD ) attack ( Madry et al. , 2018 ) , and C & W ’ s attack ( Carlini & Wagner , 2017 ) . In general , there are two types of attack models : white box attack and black box attack . Attackers in white box attack model have complete knowledge of the target network , including network ’ s architecture and parameters . Whereas in black box attacks , attackers only have partial or no information on the target network ( Papernot et al. , 2017 ) . Various defensive methods have been proposed to mitigate the effect of the adversarial examples . Adversarial training which augments the training set with adversarial examples shows good defensive performance in terms of white box attacks ( Kurakin et al. , 2017 ; Madry et al. , 2018 ) . Apart from adversarial training , there are many other defensive approaches including defensive distillation ( Papernot et al. , 2016b ) , using randomization at inference time ( Xie et al. , 2018 ) , and thermometer encoding ( Buckman et al. , 2018 ) , etc . In this paper , we propose a defensive method based on generative adversarial network ( GAN ) ( Goodfellow et al. , 2014 ) . Instead of using the generative network to generate samples that can fool the discriminative network as real data , we train the generative network to generate ( additive ) adversarial noise that can fool the discriminative network into misclassifying the input image . This allows flexible modeling of the adversarial noise by the generative network , which can take in the original image or a random vector or even the class label to create different types of noise . The discriminative networks used in our approach are just the usual neural networks designed for their specific classification tasks . The purpose of the discriminative network is to classify both clean and adversarial example with correct label , while the generative network aims to generate powerful perturbations to fool the discriminative network . This approach is simple and it directly uses the minimax game concept employed by GAN . Our main contributions include : • We show that our adversarial network approach can produce neural networks that are robust towards black box attacks . In the experiments they show similar , and in some cases better , performance when compared to state-of-art defense methods such as ensemble adversarial training ( Tramèr et al. , 2018 ) and adversarial training with projected gradient descent ( Madry et al. , 2018 ) . To our best knowledge we are also the first to study the joint training of a generative attack network and a discriminative network . • We study the effectiveness of different generative networks in attacking a trained discriminative network , and show that a variety of generative networks , including those taking in random noise or labels as inputs , can be effective in attacks . We also show that training against these generative networks can provide robustness against different attacks . The rest of the paper is organized as follows . In Section 2 , related works including multiple attack and defense methods are discussed . Section 3 presents our defensive method in details . Experimental results are shown in Section 4 , with conclusions of the paper in Section 5 . 2 RELATED WORKS . In this section , we briefly review the attack and defense methods in neural network training . 2.1 ATTACK MODEL . Given a neural network model Dθ parameterized by θ trained for classification , an input image x ∈ Rd and its label y , we want to find a small adversarial perturbation ∆x such that x+ ∆x is not classified as y . The minimum norm solution ∆x can be described as : arg min ∆x ‖∆x‖ s.t . arg maxDθ ( x+ ∆x ) 6= y , ( 1 ) where arg maxDθ ( x ) gives the predicted class for input x. Szegedy et al . ( 2014 ) introduced the first method to generate adversarial examples by considering the following optimization problem , ∆x = arg min z λ‖z‖+ L ( Dθ ( x+ z ) , ŷ ) , x+ z ∈ [ 0 , 1 ] d ( 2 ) where L is a distance function measuring the closeness of the outputDθ ( x+z ) with some target ŷ 6= y . The objective is minimized using box-constrained L-BFGS . Goodfellow et al . ( 2015 ) introduced the fast gradient sign method ( FGS ) to generate adversarial examples in one step , which can be represented as ∆x = · sign ( ∇xl ( Dθ ( x ) , y ) ) , where l is the cross-entropy loss used in neural networks training . Madry et al . ( 2018 ) argues with strong evidence that projected gradient descent ( PGD ) , which can be viewed as an iterative version of the fast gradient sign method , is the strongest attack using only first-order gradient information . Papernot et al . ( 2017 ) presented a Jacobian-based saliency-map attack ( J-BSMA ) model to generate adversarial examples by changing a small number of pixels . Moosavi-Dezfooli et al . ( 2017 ) showed that there exist a single/universal small image perturbation that fools all natural images . Papernot et al . ( 2017 ) introduced the first demonstration of black-box attacks against neural network classifiers . The adversary has no information about the architecture and parameters of the neural networks , and does not have access to large training dataset . 2.2 DEFENSE MODEL . In order to mitigate the effect of the generated adversarial examples , various defensive methods have been proposed . Papernot et al . ( 2016b ) introduced distillation as a defense to adversarial examples . Lou et al . ( 2016 ) introduced a foveation-based mechanism to alleviate adversarial examples . The idea of adversarial training was first proposed by Szegedy et al . ( 2014 ) . The effect of adversarial examples can be reduced through explicitly training the model with both original and perturbed adversarial images . Adversarial training can be viewed as a minimax game , θ∗ = arg min θ Ex , y max ∆x l ( Dθ ( x+ ∆x ) , y ) . ( 3 ) The inner maximization requires a separate oracle for generating the perturbations ∆x . FGS is a common method for generating the adversarial perturbations ∆x due to its speed . Madry et al . ( 2018 ) advocates the use of PGD in generating adversarial examples . Moreover , a cascade adversarial training is presented in Na et al . ( 2018 ) , which injects adversarial examples from an already defended network added with adversarial images from the network being trained . There are a few recent works on using GANs for generating and defending against adversarial examples . Samangouei et al . ( 2018 ) and Ilyas et al . ( 2017 ) use GAN for defense by learning the manifold of input distribution with GAN , and then project any input examples onto this learned manifold before classification to filter out any potential adversarial noise . Our approach is more direct because we do not learn the input distribution and no input denoising is involved . Both Baluja & Fischer ( 2018 ) and Xiao et al . ( 2018 ) train neural networks to generate adversarial examples by maximizing the loss over a fixed pre-trained discriminative network . They show that they can train neural networks to effectively attack undefended discriminative networks while ensuring the generated adversarial examples look similar to the original samples . Our work is different from these because instead of having a fixed discriminative network , we co-train the discriminative network together with the adversarial generative network in a minimax game . Xiao et al . ( 2018 ) also train a second discriminative network as in typical GANs , but their discriminative network is used for ensuring the generated images look like the original samples , and not for classification . Lee et al . ( 2017 ) also considered the use of GAN to train robust discriminative networks . However , the inputs to their generative network is the gradient of the discriminative network with respect to the input image x , not just the image x as in our current work . This causes complex dependence of the gradient of the generative network parameters to the discriminative network parameters , and makes the parameter updates for the generative network more complicated . Also there is no single minimax objective that they are solving for in their work ; the update rules for the discriminative and generative networks optimize related but different objectives . 3 METHOD . In generative adversarial networks ( GAN ) ( Goodfellow et al. , 2014 ) , the goal is to learn a generative neural network that can model a distribution of unlabeled training examples . The generative network transforms a random input vector into an output that is similar to the training examples , and there is a separate discriminative network that tries to distinguish the real training examples against samples generated by the generative network . The generative and discriminative networks are trained jointly with gradient descent , and at equilibrium we want the samples from the generative network to be indistinguishable from the real training data by the discriminative network , i.e. , the discriminative network does no better than doing a random coin flip . We adopt the GAN approach in generating adversarial noise for a discriminative model to train against . This approach has already been hinted at in Tramèr et al . ( 2018 ) , but they decided to train against a static set of adversarial models instead of training against a generative noise network that can dynamically adapt in a truly GAN fashion . In this work we show that this idea can be carried out fruitfully to train robust discriminative neural networks . Given an input x with correct label y , from the viewpoint of the adversary we want to find additive noise ∆x such that x + ∆x will be incorrectly classified by the discriminative neural network to some other labels ŷ 6= y . We model this additive noise as G ( x ) , where G is a generative neural network that generates instance specific noise based on the input x and is the scaling factor that controls the size of the noise . Notice that unlike white box attack methods such as FGS or PGD , once trained G does not need to know the parameters of the discriminative network that it is attacking . G can also take in other inputs to generate adversarial noise , e.g. , Gaussian random vector z ∈ Rd as in typical GAN , or even the class label y . For simplicity we assume G takes in x as input in the descriptions below . Suppose we have a training set { ( x1 , y1 ) , . . . , ( xn , yn ) } of image-label pairs . Let Dθ be the discriminator network ( for classification ) parameterized by θ , and Gφ be the generator network parameterized by φ . We want to solve the following minimax game between Dθ and Gφ : min θ max φ n∑ i=1 l ( Dθ ( xi ) , yi ) + λ n∑ i=1 l ( Dθ ( xi + Gφ ( xi ) ) , yi ) , ( 4 ) where l is the cross-entropy loss , λ is the trade-off parameter between minimizing the loss on normal examples versus minimizing the loss on the adversarial examples , and is the magnitude of the noise . See Figure 1 for an illustration of the model . In this work we focus on perturbations based on ` ∞ norm . This can be achieved easily by adding a tanh layer as the final layer of the generator network Gφ , which normalizes the output to the range of [ −1 , 1 ] . Perturbations based on ` 1 or ` 2 norms can be accommodated by having the appropriate normalization layers in the final layer of Gφ . We now explain the intuition of our approach . Ideally , we would like to find a solution θ that has small risk on clean examples R ( θ ) = n∑ i=1 l ( Dθ ( xi ) , yi ) , ( 5 ) and also small risk on the adversarial examples under maximum perturbation of size Radv ( θ ) = n∑ i=1 max ∆x , ‖∆x‖≤ l ( Dθ ( xi + ∆x ) , yi ) . ( 6 ) However , except for simple datasets like MNIST , there are usually fairly large differences between the solutions ofR ( θ ) and solutions ofRadv ( θ ) under the same model classDθ ( Tsipras et al. , 2018 ) . Optimizing for the risk under white box attacks Radv ( θ ) involves tradeoff on the risk on clean data R ( θ ) . Note that Radv ( θ ) represent the risk under white box attacks , since we are free to choose the perturbation ∆x with knowledge of θ . This can be approximated using the powerful PGD attack . Instead of allowing the perturbations ∆x to be completely free , we model the adversary as a neural network Gφ with finite capacity RG ( θ ) = max φ n∑ i=1 l ( Dθ ( xi + Gφ ( xi ) ) , yi ) . ( 7 ) Here the adversarial noise Gφ ( xi ) is not allowed to directly depend on the discriminative network parameters θ . Also , the generative network parameter φ is shared across all examples , not computed per example like ∆x . We believe this is closer to the situation of defending against black box attacks , when the adversary does not know the discriminator network parameters . However , we still want Gφ to be expressive enough to represent powerful attacks , so that Dθ has a good adversary to train against . Previous work ( Xiao et al. , 2018 ; Baluja & Fischer , 2018 ) show that there are powerful classes of Gφ that can attack trained classifiers Dθ effectively . In traditional GANs we are most interested in the distributions learned by the generative network . The discriminative network is a helper that drives the training , but can be discarded afterwards . In our setting we are interested in both the discriminative network and the generative network . The generative network in our formulation can give us a powerful adversary for attacking , while the discriminative network can give us a robust classifier that can defend against adversarial noise .

Summary: The paper proposed a defensive mechanism against adversarial attacks using GANs. The general network structure is very much similar to a standard GANs -- generated perturbations are used as adversarial examples, and a discriminator is used to distinguish between them. The performance on MNIST, SVHN, and CIFAR10 demonstrate the effectiveness of the approach, and in general, the performance is on par with carefully crafted algorithms for such task.