Neural Networks with Structural Resistance to Adversarial Attacks

1 INTRODUCTION . Machine learning via deep neural networks has been remarkably successful in a wide range of applications , from speech recognition to image classification and language processing . While very successful , deep neural networks are affected by adversarial examples : small , especially crafter modifications of correctly classified input that are misclassified ( Szegedy et al . ( 2013 ) ) . The trouble with adversarial examples is twofold . The modifications to regular input are so small as to be difficult or impossible to detect for a human : this has been shown both in the case of images ( Szegedy et al . ( 2013 ) ; Nguyen et al . ( 2015 ) ) and sounds ( Kurakin et al . ( 2016a ) ; Carlini & Wagner ( 2018 ) ) . Further , the adversarial examples are in some measure transferable from one neural network to another ( Goodfellow et al . ( 2014 ) ; Nguyen et al . ( 2015 ) ; Papernot et al . ( 2016a ) ; Tramèr et al . ( 2017b ) ) , so they can be crafted even without precise knowledge of the weights of the target neural network . At a fundamental level , it is hard to provide guarantees about the behavior of a deep neural network , when every correctly classified input is tightly encircled by very similar , yet misclassified , inputs . Thus far , the approach for obtaining neural networks that are more resistant to adversarial attacks has been to feed to the networks , as training data , an appropriate mix of the original training data , and adversarial examples ( Goodfellow et al . ( 2014 ) ; Madry et al . ( 2017 ) ) . In training neural networks using adversarial examples , if the examples are generated via efficient heuristics such as the fast gradient sign method , the networks learn to associate the specific adversarial examples to the original input from which they were derived , in a phenomenon known as label leaking ( Kurakin et al . ( 2016b ) ; Madry et al . ( 2017 ) ; Tramèr et al . ( 2017a ) ) . This does not result in increased resistance to general adversarial attacks ( Madry et al . ( 2017 ) ; Carlini & Wagner ( 2017b ) ) . If the adversarial examples used in training are generated via more general optimization techniques , as in ( Madry et al . ( 2017 ) ) , networks with markedly increased resistance to adversarial attacks can be obtained , at the price of a more complex and computationally expensive training regime , and an increase in required network capacity . We pursue here a different approach , proposing the use of neural network types that are , due to their structure , inherently impervious to adversarial attacks , even when trained on standard input only . In ( Goodfellow et al . ( 2014 ) ) , the authors connect the presence of adversarial examples to the ( local ) linearity of neural networks . In a purely linear form ∑n i=1 xiwi , we can perturb each xi by , taking xi+ if wi > 0 , and xi− if wi < 0 . This causes an output perturbation of magnitude ∑n i=1 |wi| , or nw̄ for w̄ the average modulus of wi . When the number of inputs n is large , as is typical of deep neural networks , a small input perturbation can cause a large output change . Of course , deep neural networks are not globally linear , but the insight of ( Goodfellow et al . ( 2014 ) ) is that they may be sufficiently locally linear to allow adversarial attacks . Following this insight , we develop networks composed of units that are highly non-linear . The networks on which we settled after much experimentation are a variant of the well known radial basis functions ( RBFs ) ( Broomhead & Lowe ( 1988a ) ; Chen et al . ( 1991 ) ; Orr ( 1996 ) ) ; we call our variant RBFI units . RBFI units are similar to classical Gaussian RBFs , except for two differences that are crucial in obtaining both high network accuracy , and high resistance to attacks . First , rather than being radially symmetrical , RBFIs can scale each input component individually ; in particular , they can be highly sensitive to some inputs while ignoring others . This gives an individual RBFI unit the ability to cover more of the input space than its symmetrical variants . Further , the distance of an input from the center of the Gaussian is measured not in the Euclidean , or ` 2 , norm , but in the infinity norm ` ∞ , which is equal to the maximum of the differences of the individual components . This eliminates all multi-input linearity from the local behavior of a RBFI : at any point , the output depends on one input only ; the n in the above discussion is always 1 for RBFIs , so to say . The “ I ” in RBFI stands for the infinity norm . Using deeply nonlinear models is hardly a new idea , but the challenge has been that such models are typically difficult to train . Indeed , we show that networks with RBFI units can not be satisfactorily trained using gradient descent . To get around this , we show that the networks can be trained efficiently , and to high accuracy , using pseudogradients . A pseudogradient is computed just as an ordinary gradient , except that we artificially pretend that some functions have a derivative that is different from the true derivative , and especially crafted to facilitate training . In particular , we use pseudoderivatives for the exponential function , and for the maximum operator , that enter the definition of Gaussian RBFI units . Gaussians have very low derivative away from their center , which makes training difficult ; our pseudoderivative artificially widens the region of detectable gradient around the Gaussian center . The maximum operator appearing in the infinity norm has non-zero derivative only for one of its inputs at a time ; we adopt a pseudogradient that propagates back the gradient to all of its inputs , according to their proximity in value to the maximum input . Tampering with the gradient may seem unorthodox , but methods such as AdaDelta ( Zeiler ( 2012 ) ) , and even gradient descent with momentum , cause training to take a trajectory that does not follow pure gradient descent . We simply go one step further , devising a scheme that operates at the granularity of the individual unit . We show that with these two changes , RBFIs can be easily trained with standard random ( pseudo ) gradient descent methods , yielding networks that are both accurate , and resistant to attacks . To conduct our experiments , we have implemented RBFI networks on top of the PyTorch framework ( Paszke et al . ( 2017 ) ) . The code will be made available in a final version of the paper . We consider permutation invariant MNIST , which is a version of MNIST in which the 28× 28 pixel images are flattened into a one-dimensional vector of 784 values and fed as a feature vector to neural networks ( Goodfellow et al . ( 2014 ) ) . On this test set , we show that for nets of 512,512,512,10 units , RBFI networks match the classification accuracy of networks of sigmoid units ( ( 96.96±0.14 ) % for RBFI vs. ( 96.88 ± 0.15 ) % for sigmoid ) , and are close to the performance of network with ReLU units ( ( 98.62± 0.08 ) % ) . When trained over standard training sets , RBFI networks retain accuracies over 75 % for adversarial attacks that reduce the accuracy of ReLU and sigmoid networks to below 2 % ( worse than random ) . We show that RBFI networks trained on normal input are superior to ReLU and sigmoid networks trained even with adversarial examples . Our experimental results can be summarized as follows : • In absence of adversarial attacks , RBFI networks match the accuracy of sigmoid networks , and are slightly lower in accuracy than ReLU networks . • When networks are trained with regular input only , RBFI networks are markedly more resistant to adversarial attacks than sigmoid or ReLU networks . • In presence of adversarial attacks , RBFI networks trained on regualar input provide higher accuracy than sigmoid or ReLU networks , even when the latter are trained also on adversarial examples , and even when the adversarial examples are obtained via general projected gradient descent ( Madry et al . ( 2017 ) ) . • RBFI networks can be successfully trained with pseudogradients ; the training via standard gradient descent yields instead markedly inferior results . • Appropriate regularization helps RBFI networks gain increased resistance to adversarial attacks . Much work remains to be done , including experimenting with convolutional networks using RBFI units for images . However , the results seem promising , in that RBFI seem to offer a viable alternative to current adversarial training regimes in achieving robustness to adversarial attacks . 2 RELATED WORK . Adversarial examples were first noticed in Szegedy et al . ( 2013 ) , where they were generated via the solution of general optimization problems . In Goodfellow et al . ( 2014 ) , a connection was established between linearity and adversarial attacks . A fully linear form ∑n i=1 xiwi can be perturbed by using xi+ sign ( wi ) , generating an output change of magnitude · ∑n i=1 |wi| . In analogy , Goodfellow et al . ( 2014 ) introduced the fast gradient sign method ( FGSM ) method of creating adversarial perturbations , by taking xi + · sign ( ∇iL ) , where ∇iL is the loss gradient with respect to input i . The work also showed how adversarial examples are often transferable across networks , and it asked the question of whether it would be possible to construct non-linear structures , perhaps inspired by RBFs , that are less linear and are more robust to adversarial attacks . This entire paper is essentially a long answer to the conjectures and suggestions expressed in Goodfellow et al . ( 2014 ) . It was later discovered that training on adversarial examples generated via FGSM does not confer strong resistance to attacks , as the network learns to associate the specific examples generated by FGSM to the original training examples in a phenomenon known as label leaking Kurakin et al . ( 2016b ) ; Madry et al . ( 2017 ) ; Tramèr et al . ( 2017a ) . The FGSM method for generating adversarial examples was extended to an iterative method , I-FGSM , in Kurakin et al . ( 2016a ) . In Tramèr et al . ( 2017a ) , it is shown that using small random perturbations before applying FSGM enhances the robustness of the resulting network . The network trained in Tramèr et al . ( 2017a ) using I-FSGM and ensemble method won the first round of the NIPS 2017 competition on defenses with respect to adversarial attacks . Carlini and Wagner in a series of papers show that training regimes based on generating adversarial examples via simple heuristics , or combinations of these , in general fail to convey true resistance to attacks Carlini & Wagner ( 2017a ; b ) . They further advocate measuring the resistance to attacks with respect to attacks found via more general optimization processes . In particular , FGSM and I-FGSM rely on the local gradient , and training techniques that break the association between the local gradient and the location of adversarial examples makes networks harder to attack via FGSM and I-FGSM , without making the networks harder to attack via general optimization techniques . In this paper , we follow this suggestion by using a general optimization method , projected gradient descent ( PGD ) , to generate adversarial attacks and evaluate network robustness . Carlini & Wagner ( 2016 ; 2017b ) also shows that the technique of defensive distillation , which consists in appropriately training a neural network on the output of another Papernot et al . ( 2016b ) , protects the networks from FGSM and I-FGSM attacks , but does not improve network resistance in the face of general adversarial attacks . In Madry et al . ( 2017 ) it is shown that by training neural networks on adversarial examples generated via PGD , it is possible to obtain networks that are genuinely more resistant to adversarial examples . The price to pay is a more computationally intensive training , and an increase in the network capacity required . We provide an alternative way of reaching such resistance , one that does not rely on a new training regime .

Summary: This paper introduces a new neural network layer for the purposes of defending against "white-box" adversarial attacks (in which the adversary is provided access to the neural network parameters). The new network unit and its activation function are constructed in such a way that the local gradient is sparse and therefore is difficult to exploit to add adversarial shifts to the input. To train the networks in the presence of a sparse gradient signal, the authors introduce a "pseudogradient", and optimize this proxy-gradient to optimize the parameters. This training procedure shows competitive performance (after training) on the permutation-invariant MNIST dataset versus other more standard network architectures, but is more robust to both adversarial attacks and random noise.