Defending Against Adversarial Examples by Regularized Deep Embedding

1 INTRODUCTION . Deep neural networks ( DNNs ) have been widely used for tackling numerous machine learning problems that were once believed to be challenging . With their remarkable ability of fitting training data , DNNs have achieved revolutionary successes in many fields such as computer vision , natural language progressing , and robotics . However , they were shown to be vulnerable to adversarial examples that are generated by adding carefully crafted perturbations to original images . The adversarial perturbations can arbitrarily change the network ’ s prediction but often too small to affect human recognition ( Szegedy et al. , 2013 ; Kurakin et al. , 2016 ) . This phenomenon brings out security concerns for practical applications of deep learning . Two main types of attack settings have been considered in recent research ( Goodfellow et al . ; Carlini & Wagner , 2017a ; Chen et al. , 2017 ; Papernot et al. , 2017 ) : black-box and white-box settings . In the black-box setting , the attacker can provide any inputs and receive the corresponding predictions . However , the attacker can not get access to the gradients or model parameters under this setting ; whereas in the white-box setting , the attacker is allowed to analytically compute the model ’ s gradients , and have full access to the model architecture and weights . In this paper , we focus on defending against the white-box attack which is the harder task . Recent work ( Simon-Gabriel et al. , 2018 ) presented both theoretical arguments and an empirical one-to-one relationship between input dimension and adversarial vulnerability , showing that the vulnerability of neural networks grows with the input dimension . Therefore , reducing the data dimension may help improve the robustness of neural networks . Furthermore , a consensus in the highdimensional data analysis community is that , a method working well on the high-dimensional data is because the data is not really of high-dimension ( Levina & Bickel , 2005 ) . These high-dimensional data , such as images , are actually embedded in a low dimensional space . Hence , carefully reducing the input dimension may improve the robustness of the model without sacrificing performance . Inspired by the observation that the intrinsic dimension of image data is actually much smaller than its pixel space dimension ( Levina & Bickel , 2005 ) and the vulnerability of a model grows with its input dimension ( Simon-Gabriel et al. , 2018 ) , we propose a defense framework that embeds input images into a low-dimensional space using a deep encoder and performs classification based on the latent embedding with a classifier network . However , an arbitrary projection does not guarantee improving the robustness of the model , because there are a lot of mapping functions including non-robust ones from the raw input space to the low-dimensional space capable of minimizing the classification loss . To constrain the mapping function , we employ distribution regularization in the embedding space leveraging optimal transport theory . We call our new classification framework Embedding Regularized Classifier ( ER-Classifier ) . To be more specific , we introduce a discriminator in the latent space which tries to separate the generated code vectors from the encoder network and the ideal code vectors sampled from a prior distribution , i.e. , a standard Gaussian distribution . Employing a similar powerful competitive mechanism as demonstrated by Generative Adversarial Networks ( Goodfellow et al. , 2014 ) , the discriminator enforces the embedding space of the model to follow the prior distribution . In our ER-Classifier framework , the encoder and discriminator structures together project the input data to a low-dimensional space with a nice shape , then the classifier performs prediction based on the lowdimensional embedding . Based on the optimal transport theory , the proposed ER-Classifier minimizes the discrepancy between the distribution of the true label and the distribution of the framework output , thus only retaining important features for classification in the embedding space . With a small embedding dimension , the effect of the adversarial perturbation is largely diminished through the projection process . We compare ER-Classifier with other state-of-the-art defense methods on MNIST , CIFAR10 , STL10 and Tiny Imagenet . Experimental results demonstrate that our proposed ER-Classifier outperforms other methods by a large margin . To sum up , this paper makes the following three main contributions : • A novel unified end-to-end robust deep neural network framework against adversarial attacks is proposed , where the input image is first projected to a low-dimensional space and then classified . • An objective is induced to minimize the optimal transport cost between the true class distribution and the framework output distribution , guiding the encoder and discriminator to project the input image to a low-dimensional space without losing important features for classification . • Extensive experiments demonstrate the robustness of our proposed ER-Classifier framework under the white-box attacks , and show that ER-Classifier outperforms other state-ofthe-art approaches on several benchmark image datasets . As far as we know , our approach is the first that applies optimal transport theory , i.e. , a Wasserstein distance regularization , to a bottleneck embedding layer of a deep neural network in a purely supervised learning setting without considering any reconstruction loss , although optimal transport theory or a discriminator loss has been applied to generative models in an unsupervised learning setting ( Makhzani et al. , 2015 ; Tolstikhin et al. , 2017 ) ; ( 2 ) Our method is also the first that establishes the connection between a Wasserstein distance regularization and the robustness of deep neural networks for defending against adversarial examples . 2 RELATED WORK . In this section , we summarize related work into three categories : attack methods , defense mechanisms and optimal transport theory . We first discuss different white-box attack methods , followed by a description of different defense mechanisms against , and finally optimal transport theory . 2.1 ATTACK METHODS . Under the white-box setting , attackers have all information about the targeted neural network , including network structure and gradients . Most white-box attacks generate adversarial examples based on the gradient of loss function with respect to the input . An algorithm called fast gradient sign method ( FGSM ) was proposed in ( Goodfellow et al . ) which generates adversarial examples based on the sign of gradient . Many other white-box attack methods have been proposed recently ( Moosavi-Dezfooli et al. , 2016 ; Chen et al. , 2018 ; Madry et al. , 2017 ; Carlini & Wagner , 2017b ) , and among them C & W and PGD attacks have been widely used to test the robustness of machine learning models . C & W attack : The adversarial attack method proposed by Carlini and Wagner ( Carlini & Wagner , 2017b ) is one of the strongest white-box attack methods . They formulate the adversarial example generating process as an optimization problem . The proposed objective function aims at increasing the probability of the target class and minimizing the distance between the adversarial example and the original input image . Therefore , C & W attack can be viewed as a gradient-descent based adversarial attack . PGD attack : The projected gradient descent attack is proposed by ( Madry et al. , 2017 ) , which finds adversarial examples in an -ball of the image . The PGD attack updates in the direction that decreases the probability of the original class most , then projects the result back to the -ball of the input . An advantage of PGD attack over C & W attack is that it allows direct control of distortion level by changing , while for C & W attack , one can only do so indirectly via hyper-parameter tuning . Both C & W attack and PGD attack have been frequently used to benchmark the defense algorithms due to their effectiveness ( Athalye et al. , 2018 ) . In this paper , we mainly use l∞-PGD untargeted attack to evaluate the effectiveness of the defense method under white-box setting . Instead of crafting different adversarial perturbation for different input image , an algorithm was proposed by ( Moosavi-Dezfooli et al. , 2017 ) to construct a universal perturbation that causes natural images to be misclassified . However , since this universal perturbation is image-agnostic , it is usually larger than the image-specific perturbation generated by PGD and C & W . 2.2 DEFENSE MECHANISMS . Many works have been done to improve the robustness of deep neural networks . To defend against adversarial examples , defenses that aim to increase model robustness fall into three main categories : i ) augmenting the training data with adversarial examples to enhance the existing classifiers ( Madry et al. , 2017 ; Na et al. , 2017 ; Goodfellow et al . ) ; ii ) leveraging model-specific strategies to enforce model properties such as smoothness ( Papernot et al. , 2016 ) ; and , iii ) trying to remove adversarial perturbations from the inputs ( Xie et al. , 2017 ; Samangouei et al. , 2018 ; Meng & Chen , 2017 ) . We select three representative methods that are effective under white-box setting . Adversarial training : Augmenting the training data with adversarial examples can increase the robustness of the deep neural network . Madry et al . ( Madry et al. , 2017 ) recently introduced a minmax formulation against adversarial attacks . The proposed model is not only trained on the original dataset but also adversarial example in the -ball of each input image . Random Self-Ensemble : Another effective defense method under white-box setting is RSE ( Liu et al. , 2017 ) . The authors proposed a “ noise layer ” , which fuses output of each layer with Gaussian noise . They empirically show that the noise layer can help improve the robustness of deep neural networks . The noise layer is applied in both training and testing phases , so the prediction accuracy will not be largely affected . Defense-GAN : Defense-GAN ( Samangouei et al. , 2018 ) leverages the expressive capability of GANs to defend deep neural networks against adversarial examples . It is trained to project input images onto the range of the GAN ’ s generator to remove the effect of the adversarial perturbation . Another defense method that uses the generative model to filter out noise is MagNet proposed by ( Meng & Chen , 2017 ) . However , the differences between ER-Classifier and the two methods are obvious . ER-Classifier focuses on reducing the dimension , and performing classification based on the low-dimensional embedding , while Defense-GAN and MagNet mainly apply the generative model to filter out the adversarial noise , and both Defense-GAN and MagNet perform classification on the original dimension space . ( Samangouei et al. , 2018 ) showed that Defense-GAN is more robust than MagNet , so we only compare with Defense-GAN in the experiments . Other Related Methods : Zhang et al . ( 2018 ) regularizes the latent space with Gaussian Mixture Model and applies KL-divergence to do the optimization . However , our method employs a simple but nice-shaped Gaussian prior for Wasserstein distance minimization to constrain the global shape of the latent embeddings , while permitting high freedom for the shapes of individual class distributions of latent embeddings . We want the classifier to decide the optimal class-specific distributions of latent embeddings . Miyato et al . ( 2018 ) shares a similar idea to adversarial learning , but it employs virtual labels generated by a current classifier to identify search directions that can smooth the output label distribution of the classifier and is best suitable for semi-supervised learning . Please note that both methods in ( Zhang et al. , 2018 ; Miyato et al. , 2018 ) are designed for improving generalization performance but not for defending against adversarial examples . A recent paper ( Ilyas et al. , 2019 ) shows that adversarial examples are purely human phenomenon and models tend to learn features that are not robust yet generalize well . We show that our Wasserstein distance regularization helps to identify robust features , which will be discussed later . Notations In this paper , we use l∞ and l2 distortion metrics to measure similarity . We report l∞ distance in the normalized [ 0 , 1 ] space , so that a distortion of 0.031 corresponds to 8/256 , and l2 distance as the total root-mean-square distortion normalized by the total number of pixels . We use calligraphic letters for sets ( i.e. , X ) , capital letters for random variables ( i.e. , X ) , and lower case letters for their values ( i.e. , x ) . The probability distributions are denoted with capital letters ( i.e. , PX ) and corresponding densities with lower case letters ( i.e. , pX ) .

Summary: This paper proposes a new regularization technique called Embedding Regularization to improve the adversarial robustness.  The idea is to use generative adversarial networks (GAN) to perform inference on the latent space by matching the aggregated posterior of the hidden space vector with a prior distribution. The proposed strategy could be combined with adversarial training to achieve state-of-the-art adversarial accuracy on several benchmark datasets.