Defending Against Adversarial Attacks via Neural Dynamic System
Abstract
Although deep neural networks (DNN) have achieved great success, their applications in safety-critical areas are hindered due to their vulnerability to adversarialattacks.
Some recent works have accordingly proposed to enhance the robustness of DNN from a dynamic system perspective.
Following this line of inquiry,and inspired by the asymptotic stability of the general nonautonomous dynamical system, we propose to make each clean instance be the asymptotically stableequilibrium points of a slowly time-varying system in order to defend againstadversarial attacks.
We present a theoretical guarantee that if a clean instance isan asymptotically stable equilibrium point and the adversarial instance is in theneighborhood of this point, the asymptotic stability will reduce the adversarialnoise to bring the adversarial instance close to the clean instance.
Motivated byour theoretical results, we go on to propose a nonautonomous neural ordinarydifferential equation (ASODE) and place constraints on its corresponding lineartime-variant system to make all clean instances act as its asymptotically stableequilibrium points.
Our analysis suggests that the constraints can be convertedto regularizers in implementation.
The experimental results show that ASODEimproves robustness against adversarial attacks and outperforms the state-of-the-artmethods.
Introduction
Deep neural networks (DNNs) have achieved great success in a range of tasks, including imagerecognition [1], scene segmentation [2] and action recognition[3].
However, their performance can besignificantly affected by human-imperceptible perturbations that can drastically change the network’soutput [4, 5].
This phenomenon seriously restricts the application of DNN in safety-critical fieldssuch as automatic driving.
Recently, some methods have been proposed to defend against adversarial attacks from the perspectiveof dynamic systems.
The paper [6] proposes a time-invariant steady neural ODE (TisODE) to limitthe evolution of the curves by forcing the integrand to be close to zero.
However, this approach doesnot guarantee that small perturbations of the initial point will lead to small perturbations in the outputat time T .
To reduce perturbations on the initial point, SODEF [7] causes the extracted features to belocated within a neighborhood of the Lyapunov-stable equilibrium points of the autonomous ODE.
However, there are still some drawbacks of SODEF: 1.
In the papers [1, 8, 9], the general dynamicalsystem explicitly depends on the argument t and is referred to as a nonautonomous dynamical system.
However, SODEF only considers the autonomous case, which is simply a special class of ODE.2.
As shown in Figure 1 (a), Lyapunov stability only controls the perturbations of the input rather than eliminating the effects of perturbations; simply maintaining the perturbations may still lead {+0 t 0 .0 .
 .2 .z ( t ) } δ+}
{+RealTrend (a) Lyapunov stability for ˙ z ( t ) =0 .2 .5 .
 0 t 0 .0 .
+}
.2 .z ( t ) } δ EquilibriumTrend
[Figure]
to the misclassification of SODEF. SODEF ensures that the output of the extractor is locatedin the neighborhood of the Lyapunov-stable equilibrium points; thus, the performance of SODEFdepends on the extractor. Specifically, if the extracted features deviate from real features, SODEFwould regard the false features as the Lyapunov-stable equilibrium points; accordingly, the perturbedinput of neural ODE will converge to the incorrect features, which would lead to misclassification of SODEF.
To solve the problems, in this paper, we first divide the instances into clean instance x , perturbedinstance (cid:101) x , and contaminated instance ˆ x , which are shown in Figure 2.
Instances in the yellowand blue region of the same ball naturally have the same label y .
Then, the vulnerability of DNNto perturbation can be illustrated as following:
The function f is constructed by DNN.
f makescorrect prediction when the input instance is clean, but makes wrong prediction when the input iscontaminated.
In other words, we have f ( x ) =
y and f (ˆ x ) ̸
= y .
Therefore, we make ˆ x convergeto x by dynamic system to improve the robustness of DNN.
Compared with SODEF, we consider amore general nonautonomous case:
[Equation]
As shown in Figure 1 (b), asymptotic stability helps to reduce the perturbation as t increases.
Therefore, we make each clean instance into an asymptotically stable equilibrium point and locatethe perturbed instance in its neighborhood.
In order to do this, we transform the nonautonomous
ODE (1) into a time-variant linear state-space equation, as follows:
[Equation]
According to nonlinear dynamic system theory [10], (2) is exponentially stable if the nonautonomous
ODE (1) is a slowly varying system and the Jacobian matrix A to which each frozen system
˙ z ( t ) =
h ( z ( t ) , τ ) corresponds is exponentially stable.
This holds because if all eigenvalues of Ahave negative real parts, A is exponentially stable.
We use the Levy-Desplanques theorem [11] to addconstraints to the elements of Jacobian matrix A to ensure that all eigenvalues of A have negativereal parts.
We solve the stability of (1) by imposing constraints on its linearization.
Additionally,rather than applying neural ODE to the output of the extractor, we instead apply neural ODE directlyon the instance x ∈ X to eliminate the effects of perturbations.
The process is also illustratedin Figure 2, where the perturbed instance x + δ converges to the clean instance x along the redtrajectory.
Based on the theoretical analysis above, we propose a stable neural ODE (ASODE)with asymptotic stable equilibrium points for defending against adversarial attacks, and furtherconstruct an optimization formulation to make it satisfy the asymptotic stability.
Moreover, weconduct experiments to compare the robustness of ASODE with ODE-Net [8], TisODE-Net [6] and
SODEF [7] under different adversaril attacks on the CIFAR-10, CIFAR-100 [12] and MNIST [13]datasets.
The results shows that ASODE outperforms the state-of-the-art SODEF.
Moreover, both
ASODE and SODEF are far more robust than ODE-Net and TisODE-Net.
For example, comparedwith the state-of-the-art neural ODE network SODEF under PGD attack on the MNIST, CIFAR-10,and CIFAR-100 datasets, our ASODE improves the classification accuracy of adversarial examplesby 1 .
76% , and 1 . 23% , respectively.
Furthermore, compared with the TisODE-Net on the samedatasets under PGD attack, ASODE improves the classification accuracy of adversarial examples by45 .
53% , and 16 .
76% , respectively.
Related WorkNeural ODEs
The relationship between the ODEs and neural networks has been illustrated by [14, 8].
The papers [15, 16, 17] regard residual networks as a form of explicit Euler discretization with aunit step size.
Based on this, various perspectives and methods from numerical analysis have beenemployed to improve the network architecture [14, 18], reduce training time [19], minimize memoryoverload [8], and facilitate invertibility [20] and adaptivity to other models (e.g., recurrent neuralnetworks [21], transformers [22]).
In addition, more accurate numerical ODE methods have beendeveloped to improve the network performance [23, 24].
Adversarial Defense
Many methods have been proposed to improve the robustness of neuralnetworks via training using different strategies, including generative model-based defense [25],
Bayesian adversarial learning [26], various regularization [27, 28], and adversarial training and itsvariants [29, 30, 31].
Moreover, some works explore adversarial robustness from the perspectiveof the stability of the numerical ODE or dynamic system.
For example, [32] reduces feature noiseusing ODE to develop a robust architecture.
[9] proposes a new robust architecture, improving therobustness of the original residual network family via the implicit Euler method of ODE.
Among the works, [33] is the first work to use control theory and dynamic systems to improverobustness, which is different from our work in the types of nonlinear system and the inputs.
[34] usesthe property of radial basis function (RBF) to improve the robust, not ODE.
In the work most closelyrelated to ours, [7] designs a stable neural autonomous ODE with Lyapunov-stable equilibrium pointsfor defending against adversarial attacks.
The Lyapunov-stability of the autonomous ODE ensuresthat the input features from the extractor with a small perturbation converge to the unperturbedinput features.
We study a more general case called a nonautonomous system.
Based on this, wedirectly reduce the adversarial noise on the instance by ensuring that the perturbed instances are inthe neighborhood of asymptotically stable equilibrium points of nonautonomous ODE.
Therefore, wepurify the sample and improve the network robustness.
Preliminaries
Let D be a probability distribution over X × Y , where X is the instance domain set and Y is the 101 set of labels.
( x n , y n ) is sampled from D , where x n ∈ R d , y n ∈ R m and n = 1 , 2 , · · · , N .
D xis the marginal distribution of x over y .
h ( z ( t ) , t ) is a continuous function of R d × R + into R d ;here, t ∈ R + , R + = { t ∈ R : t ≥ 0 } , z ∈ R d , z ( t ) :
R + → R d .
Moreover, we use ∇ h ( z , t )to denote its Jacobian at z .
C 1 represents the function with first-order derivative; || · || denotes the Euclidean norm; I is a d -dimensional vector in which each element is equal to 1 .
Finally,
B δ ( x ∗ ) = { x ∈ R d : || x − x ∗ || < δ } .
The d -dimensional instance x ∈ X can be seen as a point in the space R d .
However, as shownin Figure 3 (c), not every point of R d has the label y .
Figure 3 (b) is the perturbed Figure 3 (a),in which the perturbation can be arbitrarily small.
Figure 3 (b) naturally has the label " 6 " and isin the instance domain.
For each x ∈ X , there exists a continuous bounded neighborhood B δ ( x )
such that B δ ( x ) ⊂ X
and the instances in B δ ( x ) have the same label y .
Thus, the instance domain
X corresponds to the bounded ball cloud in R d , which is represented by the yellow balls in thecoordinate space of Figure 2.
In addition, if we apply perturbation to each x ∈ X to form a newinstance domain (cid:101) X the elements of which are denoted by (cid:101) x , then we can determine that (cid:101)
X includesthe adversarial samples and X ⊂ (cid:101) X .
We make D (cid:101) x
the marginal distribution of (cid:101) x over y .
Theseconclusions are directly demonstrated in the magnified ball of Figure 2.
Based on the analysis of thismagnified ball, we define a clean instance for x ∈ X , perturbed instance for (cid:101) x ∈ (cid:101) X , and contaminatedinstance for ˆ x ∈ { (cid:101) x : (cid:101) x ∈ (cid:101) X , (cid:101) x / ∈ X} .
[Figure]
Consider a nonautonomous initial value ODE problem,
[Equation] [Equation]
Suppose the function h satisfies a global Lipschitz condition [10, section 2.4.2], then, the solution of(3) is exist and unique over t ∈ [0 , ∞ ) .
The solution of (1) is denoted as z ( t ) with input z (0)
andoutput z ( T ) .
In (3), z 0 is the initial value of z ( t ) at t = t 0 .
If t = t 0 = 0 , we have z (0) =
z
= x .
Meanwhile, let s ( z 0 , t 0 , t ) denote the solution of (3) corresponding to the initial input z 0 at t 0 .
Forsimplicity, we use s ( x , t ) to denote s ( z 0 , 0 , t ) .
Obviously, if the initial value for ODE (1) is given byz (0) =
x , the two representations are equivalent, and we have z ( t )
= s ( x , t ) , z (0)
=
s ( x , 0)
= x ,z ( T ) =
s ( x , T ) .
Definition 1 (Equilibrium [10])
A vector x ∗ is said to be an equilibrium of (1)
if, h ( x ∗ , t ) = 0 ,∀ t ≥ 0 .
According to Definition 1, for any given x ∈ X , if the solution of (3) is z ( t ) =
x , t ≥ 0 , thenh ( x , t ) =
d x dt = 0 , and x is an equilibrium of (1).
On the other hand, if x is an equilibrium, (1) hasthe unique solution z ( t ) = x , t ≥ 0 for the initial value z (0) = x .
In other words, if a system startsin an equilibrium, it remains in that state thereafter.
Definition 2 (Stability [35])
A constant vector x ∗ ∈ R d is a stable equilibrium point for (1) if, foreach ϵ > 0 and each t 0 ∈ R + , there exists δ ( ϵ, t 0 ) such that for each z 0 ∈ B
δ ( x ∗ ) , || s ( z 0 , t 0 , t ) −x ∗ || <
ϵ , ∀ t ≥ t 0 .
As shown in Figure 1 (a), whose ODE is ˙ z ( t ) = 0 with z (0) =
x ∈ X (here, x =1), for each ϵ > 0 ,there exists δ =
ϵ d I such that || s ( x + δ, t ) − x
|| =
|| x
+ δ − x ||
=
|| x
+ ϵ d
I − x || ≤ ϵ .
Therefore, 139 x ∈ X is the stable equilibrium point of ODE (1) and also the Lyapunov-stable equilibrium point.
Definition 3 (Attractivity [35])
A constant vector x ∗ ∈ R d is an attractive equilibrium point for (1)if for each t 0 ∈ R + , there exists δ ( t 0 ) > 0 such that for each z 0 ∈ B
δ ( x ∗ ) , lim t → + ∞ || s ( z 0 , t 0 , t ) −x ∗ || = 0 .
Definition 4 (Asymptotic stability [35])
A constant vector x ∗ ∈ R d is asymptotically stable if it isboth stable and attractive.
It is worth noting that if an equilibrium is exponentially stable, then it is also asymptotically stablewith exponential convergence.
As shown in Figure 1, x = 1 in Figure 1 (b) is an attractive equilibriumpoint, but x = 1 in Figure 1 (a) is not.
Moreover, x = 1 is also asymptotically stable in Figure 1 (b).
Based on the notation above, we aim to make the contaminated instance ˆ x converge to the cleaninstance x .
In order to accomplish this evolution, we impose constraints on the ODE (1) to outputz ( T ) =
x when the input is z (0) =
ˆ x ∈ B δ ( x ) .
In order to let lim t → + ∞ || s (ˆ x , t ) − x ||
=
whereˆ x ∈ B δ ( x ) , we make all x ∈ X the asymptotically stable equilibrium points.
Theorem 1 Suppose the perturbed instance (cid:101) x is produced by adding perturbation smaller than δ onthe clean instance.
If all the clean instances x ∈ X are the asymptotically stable equilibrium pointsof ODE (1), there exists δ > 0 , for each contaminated instance ˆ x ∈ { (cid:101)
x : (cid:101) x ∈ (cid:101) X , (cid:101) x / ∈ X} , there existsx ∈ X
such that lim t → + ∞ || s (ˆ x , t ) − x ||
= 0 .
See proof in Appendix A.1.
Theorem 1 guarantees that if we make clean instance x into the asymptotically stable equilibriumpoint, nonautonomous ODE can shrink the perturbation and make the perturbed instance approachto the clean instance, which could help improve the robustness of the DNN and aid the DNN indefending against adversarial attack.
Next, we talk about how to ensure the ODE has asymptoticstability.
Linearization and Stability of ODE
In order to make the nonautonomous ODE (1) have asymptotic stability, we linearize ODE (1) using
Lyapunov’s linearization method.
We then impose constraints on the linearization to make ODE (1)asymptotically stable.
Suppose x ∗ is an equilibrium point of nonautonomous systems (1),
[Equation] [Equation]
and h is a C 1 function.
We define
[Equation] [Equation]
Then, by the definition of the Jacobian, it follows that for each fixed t ≥ 0 , it is true that
[Equation]
However, it may not be true that
[Equation]
In other words, the convergence in (7) may not be uniform in t .
Provided that (8) holds, the systemd z ( t
[Equation]
is referred to as the linearization of (1) around the equilibrium x ∗
Theorem 2 Suppose that (4) holds and h ( z , t ) is continuously differentiable.
Define A ( t ) , h r ( z , t )as in (5), (6), respectively, and assume that (8) holds and A ( t ) is bounded.
If x ∗ is an exponentiallystable equilibrium of the linear system (9), then it is also an exponentially stable equilibrium of thesystem (1).
See proof in Appendix A.2.
In order to make all the equilibrium points of (9) asymptotically stable, we deduce the stability of thenonautonomous system (1) by studying only the "frozen" systems; that is, the ODE (1) with time"frozen" at r .
In other words, if r ∈ R + is any fixed number, we can think of the autonomous system
[Equation]
If x ∗ is the equilibrium point, then A =
[ ∂ h ( z ,r ) ∂
z ]
z = x ∗ is a constant matrix and the linearization(9) becomes ˙
z ( t ) =
A ( z − x ∗ ) .
Moreover, we use s r ( x , t ) to denote the solution of frozen system(10), starting at time 0 and state x , and evaluated at time t .
Even if each of the frozen systems (10)is exponentially stable, the overall system can be unstable [10].
Next, we will prove that if eachfrozen system is exponentially stable and the system is slowly varying, the overall system is indeedexponentially stable.
Theorem 3 Suppose ( i ) h is C 1 , h
( x ∗ , t )
= 0 , ∀ t ≥ 0 , and ( ii ) sup z ∈ R n sup t ≥
||∇ h ( z − x ∗ , t ) ||
=:
η < ∞ ,( iii ) there exist constants µ , δ such that | s r ( z − x ∗ , t ) || ≤ µ || z − x ∗ || exp ( − δt ) , ∀ t ≥ 0 , ∀ z ∈ 189 R n , ∀ r ∈ R + .
( iv ) suppose there is a constant ϵ > 0 such that
[Equation]
Then the nonautonomous systems (1) is exponentially stable provided ϵ <
δ [( p − 1) δ − η ] pµ p , where p > 1 191 is any number such that ( p − 1) δ − η > 0 .
See proof in Appendix A.
Based on Theorems 2 and 3, we impose constraints on ODE (1) to be a slowly varying systems andlinearize it to be (9).
In order to make (9) stable, we transform the study of nonautonomous system(1) to the study of autonomous system (10); in other words, we should make ˙
z
( t ) =
A ( z − x ∗ )asymptotically stable.
The following two theorems provide ideas for solving this problem.
Theorem 4 ([10])
The equation ˙ z ( t ) =
Az is asymptotically stable if and only if all eigenvalues of
A have negative real parts.
Theorem 5 (Levy–Desplanques theorem [11]) Let A =
[ a ij ] ∈ M n , if | a ii | ≥ (cid:80) i ̸
=
j | a ij | and a ii ≤0 for all i = 1 , · · · n , then every eigenvalue of A has a negative real part.
According to theorem 4, we need to make all eigenvalues of each Jabobian matrix A of (10) atequilibrium points have negative real parts.
In addition, in the light of the Levy–Desplanques theorem[11], rather than computing the eigenvalues, we instead add constraints to the elements of Jacobianmatrix A to make all its eigenvalues have negative real parts.
Finally, we make all equilibrium pointsof the nonautonomous system (1) asymptotically stable by adding constraints on its linearization.
To sum up, we linearize the slowly varying nonautonomous ODE (1) and impose constraints on itslinearization (9) to make all clean instances be the asymptotically stable equilibrium points of (1).
ASODE Architecture
This section proposes a stable neural ODE (ASODE) with asymptotically stable equilibrium pointsfor defending against adversarial attacks.
To make all clean instances into the asymptotically stableequilibrium points of neural ODE, we construct an optimization problem according to the constraintsmentioned in section 4.
To solve this optimization problem, we propose an objective with constraintsimposed on its regularizer.
5.1 Architecture
Most physical systems are nonlinear and time-varying.
If we apply DNNs to dynamic systems, someof them can be described by nonlinear differential equations of the form,
[Equation]
where h θ is a neural ODE layer with parameter θ and defined as R d × R + → R d .
Similarly, f (cid:101) θ is aneural network with parameter (cid:101) θ and defined as R d → R m .
Because the evolutionary time of neural
ODE cannot be infinity, we set the final evolutionary time T and t ∈ [0 , T ] , where T is a positiveinteger.
Inspired by the neural dynamical forms, we propose the ASODE architecture and present itin Figure 4.
The ASODE can be simplified as follows: ODE + model.
The ODE part can be regardedas a denoiser, which helps to reduce the noise, including the adversarial noise, to rectify the perturbedinstance x n + δ .
The output of ODE is a rectified instance z ( T ) =
x n when T is sufficiently large.
Subsequently, the rectified instance z ( T ) enters the grafted model f (cid:101) θ , and the final output label is notaffected.
5.2 Asymptotic Stable Guarantee
As mentioned in section 3, we make all x ∈ X the asymptotically stable equilibrium points of neural
ODE (12).
According to the analysis in section 4, we transform the slowly time-varying ODE (12) tothe linear time-varying state equation ˙ z ( t ) =
A ( t )( z ( t ) − x ) and simplify the nonautonomous system(12) to an autonomous system d z ( t ) dt
= h
θ ( z ( t ) , r ) .
We then make ˙
z
( t ) =
A ( z − x ) asymptoticallystable, where A = [ ∂ h θ ( z ,r ) ∂
z ] z = x .
Next, we apply the Levy–Desplanques theorem to add constraintson the elements of Jacobian matrix A to make all its eigenvalues have negative real parts.
Therefore,we have the following optimization problem for the ODE part of ASODE: [Equation] [Equation] i
[Equation]
where Φ is the cross-entropy loss, ϵ 1 and ϵ 2 are small constants, and I B δ ( x ) ( (cid:101) x )
=
[Equation]
δ
[Equation]
x ) .
The optimization objective (14) can be illustrated as follows:
For any x ∈ X , if the perturbedinstance (cid:101) x ∈ B δ ( x ) , we want the the neural ODE (12) to make (cid:101) x converge to x .
Therefore, ourobjective is to minimize the distance between s ( (cid:101) x , T ) and x .
The constraint (15) means that weset each x ∈ X as the asymptotically stable equilibrium point of neural ODE (12), which requiresh θ ( x, t )
=
according to Definition 1.
The constraint (16) implies that we make the neural ODE(12)
the slowly time varying system, which requires || ∂ h θ ( z ,t ) ∂t || ≤ ϵ ||
z || according to the formulation 241 (11) in Theorem 3.
The other conditions for Theorem 3 are implicitly satisfied when t is bounded.
Besides, the constraints (17) and (18) follows the Levy–Desplanques Theorem 5 to make neural ODE(12) asymptotically stable.
5.3 Implementation
Rather than solving the optimization problem (14), we optimize the following empirical Lagrangianwith a training set ( x n , y n ) , n = 1 , 2 , · · · , N .
Moreover, x (1) n , x (2) n , · · · , x ( K ) n are K samples from
B δ ( x n ) used to represent (cid:101) x .
In addition, τ = 0 , 1 , · · · , T − 1 are the discrete time points.
Thecorrespondence and transformation between (14) and (19) can be found in the appendix B
Based on the above analysis, we make the following empirical loss L ODE :
[Equation]
According to our proposed ASODE, finding the optimal θ is the first phase in making the ODE (12) agood denoiser that is capable of reducing the adversarial noise.
We then fix the neural ODE (12) andtrain the grafted model as: min
[Equation]
E
[Equation]
x [Equation] y )
∼D [Φ
[Equation]
f
[Equation]
θ ( z ( T )) , y )] .
Its empirical loss is L model :
[Equation] [Equation]
In sum, our ASODE has two parts: the neural part plays the role of denoiser, and the grafted modelhas the ability of recognition.
In order to obtain the dynamic systems as we expected, we proposetwo related optimization problems (19) and (20).
Finally, we solve these two optimization problems(19) and (20) to make all the clean instances be the asymptotically stable equilibrium points of theneural ODE (12), thereby improving the robustness of our ASODE.
The pseudo code of ASODEalgorithm is illustrated in Appendix C, which is from bring the process above all together.
Experiments
In this section, we conduct experiments on the CIFAR-10, CIFAR-100 [12], and MNIST [13] datasetsto evaluate the robustness of ASODE under different adversarial attacks.
We follow the standardtraining, validation, and test splits in our experiments.
Moreover, we compare the robustness of
ASODE with ODE-Net [8], TisODE-Net [6], and SODEF [7].
6.1 Setup
We apply different attack methods to attack our model, namely FGSM [30], PGD [29], and anensemble AutoAttack [36].
Among them, AutoAttack includes three white-box attacks ( APGD CE ,
APGD TDLR , and FABT [37]) and one black-box Square attack [38].
Details of attack methodsare mentioned in the Appendix D. Following the same experimental settings as for SODEF, weimplement the following settings.
For the CIFAR-10 task, we use the model provided in [39].
For the CIFAR-100 task, we use the model provided in [40].
For the MNIST task, we use the
ResNet18 model provided in PyTorch.
The baselines are re-implemented according to the originalpaper.
The neural ODE function h θ is made up of three fully connected layers whose input and outputlayers have the same dimension.
During the training of ASODE, we first train the neural ODE for50 epochs, after which we fix h θ and train f (cid:101) θ for another 100 epochs.
The reasons why we set 100epochs is illustrated in
Appendix E. We set the parameters α 1 = 0 .
1 and α 2 = 0 .
05 when training
ASODE.
In the below, the best results are marked in bold ; more experiments about the sensitivity ofparameters are presented in the Appendix F.
6.2 Performance Comparison Under AutoAttack
We set the final evolutionary time as T .
Moreover, we validate the influence of T and presentsthe results in Table T2 of Appendix G. From Table T2 of Appendix G, it can be observed that theclassification accuracy of both ASODE and SODEF under AutoAttack on adversarial CIFAR100examples increase with T .
Besides, the best classification accuracy of ASODE along T is higherthan the best value obtained by of SODEF.
We also find that the accuracy changes little when
T ≥ 8 .
Therefore, we set T = 10 and make more comparisons to validate the robustness of
ASODE.
Specifically, we perform experiments to compare the robustness of ASODE with ODE-Net,
TisODE-Net and SODEF under APGD CE , APGD TDLR , FABT , Square and AutoAttack attackson CIFAR-100.
The results are presented in Table 1.
From the Table 1, it can be seen that
our
ASODE outperforms the state-of-the-art SODEF.
Moreover, both ASODE and SODEF outperform
ODE-Net and TisODE-Net by a significant margin.
For example, compared with SODE underthe APGD CE , APGD TDLR , FABT , Square and AutoAttack attacks, our ASODE improves theclassification accuracy of adversarial CIFAR-100 examples by 1 .
76% , and1 .
84% , respectively.
In addition, compared with TisODE-Net under the APGD CE , APGD TDLR ,and AutoAttack attacks on the adversarial CIFAR-100 examples, the classification accuracy obtainedby SODEF are increased by 74 .
79% , and 76 .
71% , respectively.
[Table] [Table]
6.3 Performance Under PGD and FGSM Attacks
We also evaluate the robustness of our ASODE under PGD attack and FGSM attack.
Specifically,we compare the robustness of ASODE with ODE-Net, TisODE-Net and SODEF on the MNIST,
CIFAR-10 and CIFAR-100 datasets.
To facilitate fair comparison, we set T = 5 based on the originalpapers of the comparison models.
The results on MNIST, CIFAR-10 and CIFAR-100 are presentedin Table 2, Table 3, and Table 4 respectively.
As the results show, under PGD and FGSM attacks,our model ASODE outperforms the state-of-the-art SODE; moreover, ASODE also performs muchbetter than ODE-Net and TisODE-Net.
For example, compared with SODEF under PGD attack onthe MNIST, CIFAR-10, and CIFAR-100 datasets, our ASODE improves the classification accuracyof adversarial examples by 1 . 6% , 1 .
76% , and 1 . 23% , respectively.
Furthermore, compared with
TisODE-Net on the same datasets, the classification accuracy obtained by SODEF are increased by45 .
53% , and 16 .
76% , respectively.
The “NO ODE” in Tables 2-4 corresponds to ASODEwithout the ODE part.
For ablation studies, we find that ASODE is more robust than NO ODE, whichindicates that ODE helps improve the robustness.
[Table]
[Table] [Table]
Conclusion
In this paper, we develope a novel nonautonomous time-slowing varying neural ODE, ASODE,that makes all clean instances be its asymptotically stable equilibrium points.
ASODE shrinks theadversarial noise and forces the adversarial instance to be close to the clean instance.
The experimentalresults show that ASODE improves the robustness against adversarial attacks and outperforms thestate-of-the-art methods.
Checklist
For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper’s
contributions and scope?
[Yes]
(b) Did you describe the limitations of your work?
[N/A]
Answer: The limitation of our work is that ASODE couldn’t be applied to safetycritical fields directly.
It is imperative to study how to apply ASODE in real-world applications.
(c) Did you discuss any potential negative societal impacts of your work?
[N/A]
Answer: Our works has no potential negative societal impacts.
(d) Have you read the ethics review guidelines and ensured that your paper conforms tothem?
[Yes]
If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results?
[Yes]
(b) Did you include complete proofs of all theoretical results?
[Yes]3.
If you ran experiments...
(a) Did you include the code,
data, and instructions needed to reproduce the main experimental results (either in the supplemental material or as a URL)?
[N/A]
Answer: We have strict protocols for code release as this research is partially funded bycorporate funding.
We will upload the training code as soon as permission is granted.
(b) Did you specify all the training details (e
g., data splits, hyperparameters, how they
were chosen)?
[Yes]
Answer:
Thanks for your suggestion.
According to the official pytorch encapsulateddataset,for MINIST, CIFAR-10 and CIFAR-100, we use 50000 for training dataset and10000 for test dataset.
We use a batch size of 128 for training.
For optimizer, we use
SGD with momentum= 0 .
9 , learning rate= 0 .
1 and weight decay 5 e − 4 .
(c) Did you report error bars (e
g., with respect to the random seed after running experi-
ments multiple times)?
[N/A]
Answer: We didn’t report error bars.
As models take a significant amount of time to
train, averaging over many seeds would be computationally impractical.
(d) Did you include the total amount of compute and the type of resources used (e.g., type
of GPUs, internal cluster, or cloud provider)?
[N/A]
Answer: We use a internal cluster with 8 NVIDIA GeForce RTX 2080Ti.
If you are using existing assets (e
g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators?
[Yes]
(b) Did you mention the license of the assets?
[N/A]
(c) Did you include any new assets either in the supplemental material or as a URL?
[N/A]
(d) Did you discuss whether and how consent was obtained from people whose data you’re
using/curating?
[N/A]
(e) Did you discuss whether the data you are using/curating contains personally identifiable
information or offensive content?
[N/A]
If you used crowdsourcing or conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, if
applicable?
[N/A]
(b) Did you describe any potential participant risks, with links to Institutional Review
Board (IRB) approvals, if applicable?
[N/A]
(c) Did you include the estimated hourly wage paid to participants and the total amount
spent on participant compensation?
[N/A]