Online Adversarial Purification based on Self-supervised Learning

1 INTRODUCTION . Deep neural networks have achieved remarkable results in many machine learning applications . However , these networks are known to be vulnerable to adversarial attacks , i.e . strategies which aim to find adversarial examples that are close or even perceptually indistinguishable from their natural counterparts but easily mis-classified by the networks . This vulnerability raises theory-wise issues about the interpretability of deep learning as well as application-wise issues when deploying neural networks in security-sensitive applications . Many strategies have been proposed to empower neural networks to defend against these adversaries . The current most widely used genre of defense strategies is adversarial training . Adversarial training is an on-the-fly data augmentation method that improves robustness by training the network not only with clean examples but adversarial ones as well . For example , Madry et al . ( 2017 ) propose projected gradient descent as a universal first-order attack and strengthen the network by presenting it with such adversarial examples during training ( e.g. , adversarial training ) . However , this method is computationally expensive as finding these adversarial examples involves sample-wise gradient computation at every epoch . Self-supervised representation learning aims to learn meaningful representations of unlabeled data where the supervision comes from the data itself . While this seems orthogonal to the study of adversarial vulnerability , recent works use representation learning as a lens to understand as well as improve adversarial robustness ( Hendrycks et al. , 2019 ; Mao et al. , 2019 ; Chen et al. , 2020a ; Naseer et al. , 2020 ) . This recent line of research suggests that self-supervised learning , which often leads to a more informative and meaningful data representation , can benefit the robustness of deep networks . In this paper , we study how self-supervised representation learning can improve adversarial robustness . We present Self-supervised Online Adversarial Purification ( SOAP ) , a novel defense strategy that uses an auxiliary self-supervised loss to purify adversarial examples at test-time , as illustrated in Figure 1 . During training , beside the classification task , we jointly train the network on a carefully selected self-supervised task . The multi-task learning improves the robustness of the network and more importantly , enables us to counter the adversarial perturbation at test-time by leveraging the label-independent nature of self-supervised signals . Experiments demonstrate that SOAP performs competitively on various architectures across different datasets with only a small computation overhead compared with vanilla training . Furthermore , we design a new attack strategy that targets both the classification and the auxiliary tasks , and show that our method is robust to this adaptive adversary as well . Code is available at https : //github.com/Mishne-Lab/SOAP . 2 RELATED WORK . Adversarial training Adversarial training aims to improve robustness through data augmentation , where the network is trained on adversarially perturbed examples instead of the clean original training samples ( Goodfellow et al. , 2014 ; Kurakin et al. , 2016 ; Tramèr et al. , 2017 ; Madry et al. , 2017 ; Kannan et al. , 2018 ; Zhang et al. , 2019 ) . By solving a min-max problem , the network learns a smoother data manifold and decision boundary which improve robustness . However , the computational cost of adversarial training is high because strong adversarial examples are typically found in an iterative manner with heavy gradient calculation . Compared with adversarial training , our method avoids solving the complex inner-max problem and thus is significantly more efficient in training . Our method does increase test-time computation but it is practically negligible per sample . Adversarial purification Another genre of robust learning focuses on shifting the adversarial examples back to the clean data representation , namely purification . Gu & Rigazio ( 2014 ) exploited using a general DAE ( Vincent et al. , 2008 ) to remove adversarial noises ; Meng & Chen ( 2017 ) train a reformer network , which is a collection of autoencoders , to move adversarial examples towards clean manifold ; Liao et al . ( 2018 ) train a UNet that can denoise adversarial examples to their clean counterparts ; Samangouei et al . ( 2018 ) train a GAN on clean examples and project the adversarial examples to the manifold of the generator ; Song et al . ( 2018 ) assume adversarial examples have lower probability and learn the image distribution with a PixelCNN so that they can maximize the probability of a given test example ; Naseer et al . ( 2020 ) train a conditional GAN by letting it play a min-max game with a critic network in order to differentiate between clean and adversarial examples . In contrast to above approaches , SOAP achieves better robust accuracy and does not require a GAN which is hard and inefficient to train . More importantly , our approach exploits a wider range of self-supervised signals for purification and conceptually can be applied to any format of data and not just images , given an appropriate self-supervised task . Self-supervised learning Self-supervised learning aims to learn intermediate representations of unlabeled data that are useful for unknown downstream tasks . This is done by solving a selfsupervised task , or pretext task , where the supervision of the task comes from the data itself . Recently , a variety of self-supervised tasks have been proposed on images , including data reconstruction ( Vincent et al. , 2008 ; Rifai et al. , 2011 ) , relative positioning of patches ( Doersch et al. , 2015 ; Noroozi & Favaro , 2016 ) , colorization ( Zhang et al. , 2016 ) , transformation prediction ( Dosovitskiy et al. , 2014 ; Gidaris et al. , 2018 ) or a combination of tasks ( Doersch & Zisserman , 2017 ) . More recently , studies have shown how self-supervised learning can improve adversarial robustness . Mao et al . ( 2019 ) find that adversarial attacks fool the networks by shifting latent representation to a false class . Hendrycks et al . ( 2019 ) observe that PGD adversarial training along with an auxiliary rotation prediction task improves robustness , while Naseer et al . ( 2020 ) use feature distortion as a self-supervised signal to find transferable attacks that generalize across different architectures and tasks . Chen et al . ( 2020a ) combine adversarial training and self-supervised pre-training to boost fine-tuned robustness . These methods typically combine self-supervised learning with adversarial training , thus the computational cost is still high . In contrast , our approach achieves robust accuracy by test-time purification which uses a variety of self-supervised signals as auxiliary objectives . 3 SELF-SUPERVISED PURIFICATION . 3.1 PROBLEM FORMULATION . As aforementioned , Mao et al . ( 2019 ) observe that adversaries shift clean representations towards false classes to diminish robust accuracy . The small error in input space , carefully chosen by adversaries , gets amplified through the network , and finally leads to wrong classification . A natural way to solve this is to perturb adversarial examples so as to shift their representation back to the true classes , i.e . purification . In this paper we only consider classification as our main task , but our approach should be easily generalized to other tasks as well . Consider an encoder z = f ( x ; θenc ) , a classifier g ( z ; θcls ) on top of the representation z , and the network g ◦f a composition of the encoder and the classifier . We formulate the purification problem as follows : for an adversarial example ( xadv , y ) and its clean counterpart ( x , y ) ( unknown to the network ) , a purification strategy π aims to find xpfy = π ( xadv ) that is as close to the clean example x as possible : xpfy → x . However , this problem is underdetermined as different clean examples can share the same adversarial counterpart , i.e . there might be multiple or even infinite solutions for xpfy . Thus , we consider the relaxation min π Lcls ( ( g ◦ f ) ( xpfy ) , y ) s.t . ||xpfy − xadv|| ≤ adv , xpfy = π ( xadv ) , ( 1 ) i.e . we accept xpfy as long as Lcls is sufficiently small and the perturbation is bounded . Here Lcls is the cross entropy loss for classification and adv is the budget of adversarial perturbation . However , this problem is still unsolvable since neither the true label y nor the budget adv is available at testtime . We need an alternative approach that can lead to a similar optimum . 3.2 SELF-SUPERVISED ONLINE PURIFICATION . Let h ( z ; θaux ) be an auxiliary device that shares the same representation z with g ( z ; θcls ) , and Laux be the auxiliary self-supervised objective . The intuition behind SOAP is that the shift in representation z that hinders classification will hinder the auxiliary self-supervised task as well . In other words , large Laux often implies large Lcls . Therefore , we propose to use Laux as an alternative to Lcls in Eq . ( 1 ) . Then we can purify the adversarial examples using the auxiliary self-supervised signals , since the purified examples which perform better on the auxiliary task ( small Laux ) should perform better on classification as well ( small Lcls ) . During training , we jointly minimize the classification loss and self-supervised auxiliary loss min θ { Lcls ( ( g ◦ f ) ( x ; θenc , θcls ) , y ) + αLaux ( ( h ◦ f ) ( x ; θenc , θaux ) ) } , ( 2 ) where α is a trade-off parameter between the two tasks . At test-time , given fixed network parameters θ , we use the label-independent auxiliary objective to perform gradient descent in the input space . The purification objective is min π Laux ( ( h ◦ f ) ( xpfy ) ) s.t . ||xpfy − xadv|| ≤ pfy , xpfy = π ( xadv ) , ( 3 ) where pfy is the budget of purification . This is legitimate at test-time because unlike Eq . ( 1 ) , the supervision or the purification signal comes from data itself . Also , compared with vanilla training the only training increment of SOAP is an additional self-supervised regularization term . Thus , the computational complexity is largely reduced compared with adversarial training methods . In Sec . 4 , we will show that adversarial examples do perform worse on auxiliary tasks and the gradient of the auxiliary loss provides useful information on improving robustness . Note that adv is replaced with pfy in Eq . ( 3 ) , and we will discuss how to find appropriate pfy in the next section . Algorithm 1 PGD attack Input : x : a test example ; T : the number of attack steps Output : xadv : the adversarial example 1 : δ ← 0 2 : for t = 1 , 2 , . . . , T do 3 : ` ← Lcls ( ( g ◦ f ) ( x+ δ ; θenc , θcls ) , y ) 4 : δ ← δ + γ sign ( ∇x ` ) 5 : δ ← min ( max ( δ , − adv ) , adv ) 6 : δ ← min ( max ( x+ δ , 0 ) , 1 ) − x 7 : end for 8 : xadv ← x+ δ Algorithm 2 Multi-step purification Input : x : a test example ; T : the number of purification steps Output : xpfy : the purified example 1 : δ ← 0 2 : for t = 1 , 2 , . . . , T do 3 : ` ← Laux ( ( h ◦ f ) ( x+ δ ; θenc , θaux ) ) 4 : δ ← δ − γ sign ( ∇x ` ) 5 : δ ← min ( max ( δ , − pfy ) , pfy ) 6 : δ ← min ( max ( x+ δ , 0 ) , 1 ) − x 7 : end for 8 : xpfy ← x+ δ

Summary: Online defenses of adversarial examples is an old topic: Given an input x (potentially adversarially perturbed) at test time, we want to sanitize x to get x', on which the trained classifier $g \circ f$ gives the correct answer. This paper proposes a new architecture for online defenses via self supervision. There are two new things in the proposal: