O NLINE A DVERSARIAL P URIFICATION BASED ON S ELF -S UPERVISED L EARNING
A BSTRACT
Deep neural networks are known to be vulnerable to adversarial examples, where a perturbation in the input space leads to an ampliﬁed shift in the latent network representation.
In this paper, we combine canonical supervised learning with selfsupervised representation learning, and present Self-supervised Online Adversarial Puriﬁcation (SOAP), a novel defense strategy that uses a self-supervised loss to purify adversarial examples at test-time.
Our approach leverages the labelindependent nature of self-supervised signals, and counters the adversarial perturbation with respect to the self-supervised tasks.
SOAP yields competitive robust accuracy against state-of-the-art adversarial training and puriﬁcation methods, with considerably less training complexity.
In addition, our approach is robust even when adversaries are given knowledge of the puriﬁcation defense strategy.
To the best of our knowledge, our paper is the ﬁrst that generalizes the idea of using self-supervised signals to perform online test-time puriﬁcation.
I NTRODUCTION
Deep neural networks have achieved remarkable results in many machine learning applications.
However, these networks are known to be vulnerable to adversarial attacks, i e. strategies which aim to ﬁnd adversarial examples that are close or even perceptually indistinguishable from their natural counterparts but easily mis-classiﬁed by the networks.
This vulnerability raises theory-wise issues about the interpretability of deep learning as well as application-wise issues when deploying neural networks in security-sensitive applications.
Many strategies have been proposed to empower neural networks to defend against these adversaries.
The current most widely used genre of defense strategies is adversarial training.
Adversarial training is an on-the-ﬂy data augmentation method that improves robustness by training the network not only with clean examples but adversarial ones as well.
For example, Madry et al.
(2017) propose projected gradient descent as a universal ﬁrst-order attack and strengthen the network by presenting it with such adversarial examples during training (e.g., adversarial training).
However, this method is computationally expensive as ﬁnding these adversarial examples involves sample-wise gradient computation at every epoch.
Self-supervised representation learning aims to learn meaningful representations of unlabeled data where the supervision comes from the data itself.
While this seems orthogonal to the study of adversarial vulnerability, recent works use representation learning as a lens to understand as well as improve adversarial robustness (Hendrycks et al., 2019; Mao et al., 2019; Chen et al., 2020a; Naseer et al., 2020).
This recent line of research suggests that self-supervised learning, which often leads to a more informative and meaningful data representation, can beneﬁt the robustness of deep networks.
In this paper, we study how self-supervised representation learning can improve adversarial robustness.
We present Self-supervised Online Adversarial Puriﬁcation (SOAP), a novel defense strategy that uses an auxiliary self-supervised loss to purify adversarial examples at test-time, as illustrated in Figure 1.
During training, beside the classiﬁcation task, we jointly train the network on a carefully selected self-supervised task.
The multi-task learning improves the robustness of the network and more importantly, enables us to counter the adversarial perturbation at test-time by leveraging the label-independent nature of self-supervised signals.
Experiments demonstrate that SOAP performs competitively on various architectures across different datasets with only a small computation
[Figure]
overhead compared with vanilla training.
Furthermore, we design a new attack strategy that targets both the classiﬁcation and the auxiliary tasks, and show that our method is robust to this adaptive adversary as well.
Code is available at https://github.com/Mishne-Lab/SOAP.
R ELATED WORK
Adversarial training Adversarial training aims to improve robustness through data augmentation, where the network is trained on adversarially perturbed examples instead of the clean original training samples (Goodfellow et al., 2014;
Kurakin et al., 2016; Tram`er et al., 2017; Madry et al., 2017; Kannan et al., 2018; Zhang et al., 2019).
By solving a min-max problem, the network learns a smoother data manifold and decision boundary which improve robustness.
However, the computational cost of adversarial training is high because strong adversarial examples are typically found in an iterative manner with heavy gradient calculation.
Compared with adversarial training, our method avoids solving the complex inner-max problem and thus is signiﬁcantly more efﬁcient in training.
Our method does increase test-time computation but it is practically negligible per sample.
Adversarial puriﬁcation Another genre of robust learning focuses on shifting the adversarial examples back to the clean data representation , namely puriﬁcation.
Gu & Rigazio (2014) exploited using a general DAE (Vincent et al., 2008) to remove adversarial noises; Meng & Chen (2017) train a reformer network, which is a collection of autoencoders, to move adversarial examples towards clean manifold; Liao et al.
(2018) train a UNet that can denoise adversarial examples to their clean counterparts; Samangouei et al.
(2018) train a GAN on clean examples and project the adversarial examples to the manifold of the generator; Song et al.
(2018) assume adversarial examples have lower probability and learn the image distribution with a PixelCNN so that they can maximize the probability of a given test example; Naseer et al.
(2020) train a conditional GAN by letting it play a min-max game with a critic network in order to differentiate between clean and adversarial examples.
In contrast to above approaches, SOAP achieves better robust accuracy and does not require a GAN which is hard and inefﬁcient to train.
More importantly, our approach exploits a wider range of self-supervised signals for puriﬁcation and conceptually can be applied to any format of data and not just images, given an appropriate self-supervised task.
Self-supervised learning Self-supervised learning aims to learn intermediate representations of unlabeled data that are useful for unknown downstream tasks.
This is done by solving a selfsupervised task, or pretext task, where the supervision of the task comes from the data itself.
Recently, a variety of self-supervised tasks have been proposed on images, including data reconstruction (Vincent et al., 2008; Rifai et al., 2011), relative positioning of patches (Doersch et al., 2015;
Noroozi & Favaro, 2016), colorization (Zhang et al., 2016), transformation prediction (Dosovitskiy et al., 2014; Gidaris et al., 2018) or a combination of tasks (Doersch & Zisserman, 2017).
More recently, studies have shown how self-supervised learning can improve adversarial robustness.
Mao et al.
ﬁnd that adversarial attacks fool the networks by shifting latent representation to a false class.
Hendrycks et al.
(2019) observe that PGD adversarial training along with an auxiliary rotation prediction task improves robustness, while Naseer et al.
(2020) use feature distortion as a self-supervised signal to ﬁnd transferable attacks that generalize across different architectures and tasks.
Chen et al.
(2020a) combine adversarial training and self-supervised pre-training to boost ﬁne-tuned robustness.
These methods typically combine self-supervised learning with adversarial training, thus the computational cost is still high.
In contrast, our approach achieves robust accuracy by test-time puriﬁcation which uses a variety of self-supervised signals as auxiliary objectives.
S ELF - SUPERVISED PURIFICATION 3. P ROBLEM FORMULATION
As aforementioned, Mao et al.
(2019) observe that adversaries shift clean representations towards false classes to diminish robust accuracy.
The small error in input space, carefully chosen by adversaries, gets ampliﬁed through the network, and ﬁnally leads to wrong classiﬁcation.
A natural way to solve this is to perturb adversarial examples so as to shift their representation back to the true classes, i.e. puriﬁcation.
In this paper we only consider classiﬁcation as our main task, but our approach should be easily generalized to other tasks as well.
Consider an encoder z
= f ( x ; θ enc ) , a classiﬁer g ( z ; θ cls ) on top of the representation z , and the network g ◦ f a composition of the encoder and the classiﬁer.
We formulate the puriﬁcation problem as follows: for an adversarial example ( x adv , y ) and its clean counterpart ( x, y ) (unknown to the network), a puriﬁcation strategy π aims to ﬁnd x pfy =
π ( x adv ) that is as close to the clean example x as possible:
x pfy → x .
However, this problem is underdetermined as different clean examples can share the same adversarial counterpart, i.e. there might be multiple or even inﬁnite solutions for x pfy .
Thus, we consider the relaxation
[Equation]
i.e. we accept x pfy as long as L cls is sufﬁciently small and the perturbation is bounded.
Here L cls is the cross entropy loss for classiﬁcation and (cid:15) adv is the budget of adversarial perturbation.
However, this problem is still unsolvable since neither the true label y nor the budget (cid:15) adv is available at testtime.
We need an alternative approach that can lead to a similar optimum.
3. S ELF - SUPERVISED O NLINE P URIFICATION
Let h ( z ; θ aux ) be an auxiliary device that shares the same representation z with g ( z ; θ cls ) , and L aux be the auxiliary self-supervised objective.
The intuition behind SOAP is that the shift in representation z that hinders classiﬁcation will hinder the auxiliary self-supervised task as well.
In other words, large L aux often implies large L cls .
Therefore, we propose to use L aux as an alternative to L cls in
Eq.
Then we can purify the adversarial examples using the auxiliary self-supervised signals, since the puriﬁed examples which perform better on the auxiliary task (small L aux ) should perform better on classiﬁcation as well (small L cls ).
During training, we jointly minimize the classiﬁcation loss and self-supervised auxiliary loss
[Equation]
where α is a trade-off parameter between the two tasks.
At test-time, given ﬁxed network parameters θ , we use the label-independent auxiliary objective to perform gradient descent in the input space .
The puriﬁcation objective is
[Equation]
where (cid:15) pfy is the budget of puriﬁcation.
This is legitimate at test-time because unlike Eq.
(1), the supervision or the puriﬁcation signal comes from data itself.
Also, compared with vanilla training the only training increment of SOAP is an additional self-supervised regularization term.
Thus, the computational complexity is largely reduced compared with adversarial training methods.
In Sec. 4, we will show that adversarial examples do perform worse on auxiliary tasks and the gradient of the auxiliary loss provides useful information on improving robustness.
Note that (cid:15) adv is replaced with (cid:15) pfy in Eq.
(3), and we will discuss how to ﬁnd appropriate (cid:15) pfy in the next section.
Input: x : a test example;
T : the number of attack steps
Output: x adv : the adversarial example 1: δ ←2: for t = 1 , 2 , . .
, T do 3: (cid:96) ← L cls (( g ◦ f )( x + δ ; θ enc , θ cls ) , y ) 4: δ ← δ + γ sign( ∇ x (cid:96) ) 5: δ ← min(max( δ, − (cid:15) adv ) , (cid:15) adv ) 6: δ ← min(max( x + δ, 0) , 1) − x 7: end for 8: x adv ← x + δ
Input: x : a test example;
T : the number of puriﬁcation steps
Output: x pfy : the puriﬁed example 1: δ ←2: for t = 1 , 2 , . . .
, T do 3: (cid:96) ← L aux (( h ◦ f )( x + δ ; θ enc , θ aux )) 4: δ ← δ − γ sign( ∇ x (cid:96) ) 5: δ ← min(max( δ, − (cid:15) pfy ) , (cid:15) pfy ) 6: δ ← min(max( x + δ, 0) , 1) − x 7: end for 8: x pfy ← x + δ
3. O NLINE P URIFICATION
Inspired by the PGD (Madry et al., 2017) attack (see Alg. 1), we propose a multi-step puriﬁer (see
Alg. 2) which can be seen as its inverse.
In contrast to a PGD attack, which performs projected gradient ascent on the input in order to maximize the cross entropy loss L cls , the puriﬁer performs projected gradient descent on the input in order to minimize the auxiliary loss L aux .
The puriﬁer achieves this goal by perturbing the adversarial examples, i.e. π ( x adv ) =
x adv + δ , while keeping the perturbation under a budget, i.e. || δ || ∞ ≤ (cid:15) pfy .
Note that it is also plausible to use optimizationbased algorithms in analogue to some (cid:96) 2 adversaries such as CW (Carlini & Wagner, 2017), however this would require more steps of gradient descent at test-time.
Taking the bound into account, the ﬁnal objective of the puriﬁer is to minimize the following
[Equation]
For a multi-step puriﬁer with step size γ , at each step we calculate
[Equation]
For step size γ = (cid:15) pfy and number of steps T = 1 , the multi-step puriﬁer becomes a single-step puriﬁer.
This is analogous to PGD degrading to FGSM (Goodfellow et al., 2014) when the step size of the adversary γ = (cid:15) adv and the number of projected gradient ascent steps T = 1 in Alg. 1.
A remaining question is how to set (cid:15) pfy when (cid:15) adv is unknown.
If (cid:15) pfy is too small compared to the attack, it will not be sufﬁcient to neutralize the adversarial perturbations.
In the absence of knowledge of the attack (cid:15) adv , we can use the auxiliary loss as a proxy to set the appropriate (cid:15) pfy .
In
Figure 3 we plot the average auxiliary loss (green plot) of the puriﬁed examples for a range of (cid:15) pfy values.
The “elbows” of the auxiliary loss curves almost identify the unknown (cid:15) adv in every case with slight over-estimation.
This suggests that the value for which the auxiliary loss approximately stops decreasing is a good estimate of (cid:15) adv .
Empirically, we ﬁnd that using a slightly over-estimated (cid:15) pfy beneﬁts the accuracy after puriﬁcation, similar to the claim by Song et al.
This is because our network is trained with noisy examples and thus can handle the new noise introduced by puriﬁcation.
At test-time, we use the auxiliary loss to set (cid:15) pfy in an online manner, by trying a range of values for (cid:15) pfy and selecting the smallest one which minimizes the auxiliary loss for each individual example.
In the experiment section we refer to the output of this selection procedure as (cid:15) min-aux .
We also empirically ﬁnd for each sample the (cid:15) pfy that results in the best adversarial accuracy, denoted (cid:15) oracle in the experiment section.
This is an upper-bound on the performance SOAP can achieve.
3. S ELF - SUPERVISED SIGNALS
Theoretically, any existing self-supervised objective can be used for puriﬁcation.
However, due to the nature of puriﬁcation and also for the sake of efﬁciency, not every self-supervised task is suitable.
A suitable auxiliary task should be sensitive to the representation shift caused by adversarial perturbation, differentiable with respect to the entire input, e.g. every pixel for an image, and also efﬁcient in both train and test-time.
In addition, note that certain tasks are naturally incompatible with certain datasets.
For example, a rotation-based self-supervised task cannot work on a rotationinvariant dataset.
In this paper, we exploit three types of self-supervised signals: data reconstruction, rotation prediction and label consistency.
Data reconstruction Data reconstruction (DR), including both deterministic data compression and probabilistic generative modeling, is probably one of the most natural forms of self-supervision.
The latent representation, usually lying on a much lower dimensional space than the input space, is required to be comprehensive enough for the decoder to reconstruct the input data.
To perform data reconstruction, we use a decoder network as the auxiliary device h and require it to reconstruct the input from the latent representation z .
In order to better learn the underlying data manifold, as well as to increase robustness, the input is corrupted with additive Gaussian noise η (and clipped) before fed into the encoder f .
The auxiliary loss is the (cid:96) 2 distance between examples and their noisy reconstruction via the autoencoder h ◦ f :
[Equation]
In Figure 2, we present the outputs of an autoencoder trained using Eq.
(4), for clean, adversarial and puriﬁed inputs.
The puriﬁcation shifts the representation of the adversarial examples closer to their original class (for example, 2 4, 8 and 9).
Note that SOAP does not use the output of the autoencoder as a defense, but rather uses the autoencoder loss to purify the input.
We plot the autoencdoer output here as we consider it as providing insight to how the trained model ‘sees’ these samples.
Rotation prediction Rotation prediction (RP), as an image self-supervised task, was proposed by
Gidaris et al.
The authors rotate the original images in a dataset by a certain degree, then use a simple classiﬁer to predict the degree of rotation using high-level representation by a convolutional neural network.
The rationale is that the learned representation has to be semantically meaningful for the classiﬁer to predict the rotation successfully.
Following Gidaris et al.
(2018), we make four copies of the image and rotate each of them by one of four degrees: Ω = { 0 ◦ , 90 ◦ , 180 ◦ , 270 ◦ } .
The auxiliary task is a 4-way classiﬁcation using representation z
= f ( x ) , for which we use a simple linear classiﬁer as the auxiliary device h .
The auxiliary loss is the summation of 4-way classiﬁcation cross entropy of each rotated copy
[Equation]
where x ω is a rotated input, and h ( · ) ω is the predictive probability of it being rotated by ω .
While the standard rotation prediction task works well for training, we found that it tends to under-estimate (cid:15) pfy at test-time.
Therefore, for puriﬁcation we replace the cross entropy classiﬁcation loss by the mean square error between predictive distributions and one-hot targets.
This increases the difﬁculty of the rotation prediction task and leads to better robust accuracy.
Label consistency The rationale of label consistency (LC) is that different data augmentations of the same sample should get consistent prediction from the network.
This exact or similar concept is widely used in semi-supervised learning (Sajjadi et al., 2016; Laine & Aila, 2016), and also successfully applied in self-supervised contrastive learning (He et al., 2020; Chen et al., 2020b).
We adopt label consistency to perform puriﬁcation.
The auxiliary task here is to minimize the (cid:96)distance between two augmentations a 1 ( x ) and a 2 ( x ) of a given image x , in the logit space given by g ( · ) .
The auxiliary device of LC is the exact classiﬁer, i.e. h
= g , and the auxiliary loss
[Equation] [Equation]
E XPERIMENTS
We evaluate SOAP on the MNIST, CIFAR10 and CIFAR100 datasets following Madry et al.
[Figure]
MNIST (LeCun et al., 1998)
For MNIST, we evaluate our method on a fully-connected network (FCN) and a convolutional neural network (CNN).
For the auxiliary task, we evaluate the efﬁcacy of data reconstruction.
For the FCN g ( · ) is a linear classiﬁer and h ( · ) is a fully-connected decoder; for the CNN g ( · ) is a 2-layer MLP and h ( · ) is a convolutional decoder.
The output of the decoder is squashed into the range of [0 , 1] by a sigmoid function.
During training, the input digits are corrupted by an additive Gaussian noise ( µ = 0 , σ = 0 . 5 ).
At test-time, L aux of the reconstruction is computed without input corruption.
SOAP runs T = 5 iterations with step size γ = 0 .
CIFAR10 & CIFAR100 (Krizhevsky & Hinton, 2009)
For CIFAR10 and CIFAR100, we evaluate our method on a ResNet-18 (He et al., 2016) and a 10-widen Wide-ResNet-28 (Zagoruyko & Komodakis, 2016).
For the auxiliary task, we evaluate rotation prediction and label consistency.
To train on rotation prediction, each rotated copy is corrupted by an additive Gaussian noise ( µ = 0 , σ = 0 . 1 ), encoded by f ( · ) , and classiﬁed by a linear classiﬁer g ( · ) for object recognition and by an auxiliary linear classiﬁer h ( · ) for degree prediction.
This results in a batch size 4 times larger than the original.
At test-time, similar to DA, we compute L aux on clean input images.
To train on label consistency, we augment the input images twice using a composition of random ﬂipping, random cropping and additive Gaussian corruption ( µ = 0 , σ = 0 . 1 ).
Both of these two augmentations are used to train the classiﬁer, therefore the batch size is twice as large as the original.
At test-time, we use the input image as one copy and ﬂip-crop the image to get another copy.
Using the input image ensures that every pixel in the image is puriﬁed, and using deﬁnite ﬂipping and cropping ensures there is enough difference between the input image and its augmentation.
For both rotation prediction and label consistency, SOAP runs T = 5 iterations with step size γ = 4 / 255 .
Note that we did not apply all auxiliary tasks on all datasets due to the compatibility issue mentioned in Sec. 3.4.
DR is not suitable for CIFAR as reconstruction via an autoencdoer is typically challenging on more realistic image datasets.
RP is naturally incompatible with MNIST because the digits 0, 1, and 8 are self-symmetric; and digits 6 and 9 are interchangeable with 180 degree rotation.
Similarly, LC is also not appropriate for MNIST because common data augmentations such as ﬂipping and cropping are less meaningful on digits.
4. W HITE - BOX ATTACKS
In Tables 1- 3 we compare SOAP against widely-used adversarial training (Goodfellow et al., 2014;
Madry et al., 2017) and puriﬁcation methods (Samangouei et al., 2018; Song et al., 2018) on a variety of (cid:96) 2 and (cid:96) ∞ bounded attacks: FGSM, PGD, CW, and DeepFool (Moosavi-Dezfooli et al., 2016).
For MNIST, both FGSM and PGD are (cid:96) ∞ bounded with (cid:15) adv = 0 .
3 , and the PGD runs 40 iterations with a step size of 0 .
01 ; CW and DeepFool are (cid:96) 2 bounded with (cid:15) adv = 4 .
For CIFAR10, FGSM and
PGD are (cid:96) ∞ bounded with (cid:15) adv
= 8 / 255 , and PGD runs 20 iterations with a step size of 2 / 255 ; CW and DeepFool are (cid:96) 2 bounded with (cid:15) adv
= 2 .
For CW and DeepFool which are optimization-based, resulted attacks that exceed the bound are projected to the (cid:15) -ball.
We mark the best performance for each attack by an underlined and bold value and the second best by bold value .
We do not mark out the oracle accuracy but it does serves as an empirical upper bound of puriﬁcation.
For MNIST, SOAP-DR has great advantages over FGSM and PGD adversarial training on all attacks when the model has small capacity (FCN).
This is because adversarial training typically requires a large parameter set to learn a complex decision boundary while our method does not have this constraint.
When using a larger CNN, SOAP outperforms FGSM adversarial training and comes close to Defense-GAN and PGD adversarial training on (cid:96) ∞ attacks.
SOAP also achieves better clean accuracy compared with all other methods.
Note that FGSM AT achieves better accuracy under FGSM attacks than when there is no attack for the large capacity networks.
This is due to the label leaking effect (Kurakin et al., 2016): the model learns to classify examples from their perturbations rather than the examples themselves.
[Table] [Table]
[Table] [Table]
[Table]
For CIFAR10, on ResNet-18 SOAP-RP beats Pixel-Defend on all attacks except for FGSM and beats
PGD adversarial training on (cid:96) 2 attacks; on Wide-ResNet-28 it performs superiorly or equivalently
[Figure]
against other methods on all attacks.
SOAP-LC achieves superior accuracy compared with other methods, where the capacity is either small or large.
Note that we choose Pixel-Defend as our puriﬁcation baseline since Defense-GAN does not work on CIFAR10.
Speciﬁcally, our method achieves over 50% accuracy under strong PGD attack, which is 10% higher than PGD adversarial training.
SOAP also exhibits great advantages over adversarial training on the (cid:96) 2 attacks.
Also, compared with vanilla training (‘No Def’)
the multi-task training of SOAP improves robustness without puriﬁcation ( (cid:15) pfy = 0 ), which is similar on MNIST.
Examples are shown in Figure 4.
For CIFAR100, SOAP shows similar advantages over other methods.
SOAP-RP beats PGD adversarial training on PGD attacks when using large Wide-ResNet-28 model and on (cid:96) 2 attacks in all cases; SOAP-LC again achieves superior accuracy compared with all other methods, where the capacity is either small or large.
Our results demonstrate that SOAP is effective under both (cid:96) ∞ and (cid:96) 2 bounded attacks, as opposed to adversarial training which only defends effectively against (cid:96) 2 attacks for MNIST with a CNN.
This implies that while the formulation of the puriﬁcation in Eq.
(4) mirrors an (cid:96) ∞ bounded attack, our defense is not restricted to this speciﬁc type of attack, and the bound in Eq.
(4) serves merely as a constraint on the puriﬁcation perturbation rather than a-prior knowledge of the attack.
Auxiliary-aware attacks
Previously, we focus on standard adversaries which only rely on the classiﬁcation objectives.
A natural question is: can an adversary easily ﬁnd a stronger attack given the knowledge of our puriﬁcation defense?
In this section, we introduce a more ‘complete’ whitebox adversary which is aware of the puriﬁcation method, and show that it is not straightforward to attack SOAP even with the knowledge of the auxiliary task used for puriﬁcation.
In contrast to canonical adversaries, here we consider adversaries that jointly optimize the cross entropy loss and the auxiliary loss with respect to the input.
As SOAP aims to minimize the auxiliary loss, the auxiliary-aware adversaries maximize the cross entropy loss while also minimizing the auxiliary loss at the same time.
The intuition behind this is that the auxiliary-aware adversaries try to ﬁnd the auxiliary task “on-manifold” (Stutz et al., 2019) examples that can fool the classiﬁer.
The auxiliary-aware adversaries perform gradient ascent on the following combined objective
[Equation]
where β is a trade-off parameter between the cross entropy loss and the auxiliary loss.
An auxiliaryaware adversary degrades to a canonical one when β
= 0 in the combined objective.
[Figure]
As shown in Figure 5, an adversary cannot beneﬁt from the knowledge of the defense in a straightforward way.
When the trade-off parameter β is negative (i.e. the adversary is attacking the auxiliary device as well), the attacks are weakened (blue plot) and puriﬁcation based on all three auxiliaries achieves better robust accuracy (orange plot) as the amplitude of β increases.
When β is positive, the accuracy of SOAP using data reconstruction and label consistency increases with β .
The reason for this is that the auxiliary component of the adapted attacks obfuscates the cross entropy gradient, and thus weakens canonical attacks.
The accuracy of rotation prediction stays stable as β varies, i.e. it is more sensitive to this kind of attack compared to the other tasks.
4. B LACK - BOX ATTACKS
Table 4 compares SOAP-DR with adversarial training against FGSM black-box attacks (Papernot et al., 2017).
Following their approach, we let white-box adversaries, e.g. FGSM, attack a substitute model, with potentially different architecture, to generate the black-box adversarial examples for the target model.
The substitute model is trained on a limited set of 150 test images unseen by the target model.
These images are further labeled by the target model and augmented using a Jacobian-based method.
SOAP signiﬁcantly out-performs adversarial training on FCN; for CNN it out-performs
FGSM adversarial training and comes close to PGD adversarial training.
[Table]
C ONCLUSION
In this paper, we introduced SOAP: using self-supervision to perform test-time puriﬁcation as an online defense against adversarial attacks.
During training, the model learns a clean data manifold through joint optimization of the cross entropy loss for classiﬁcation and a label-independent auxiliary loss for puriﬁcation.
At test-time, a puriﬁer counters adversarial perturbation through projected gradient descent of the auxiliary loss with respect to the input.
SOAP is consistently competitive across different network capacities as well as different datasets.
We also show that even with knowledge of the self supervised task, adversaries do not gain an advantage over SOAP.
While in this paper we only explore how SOAP performs on images, our puriﬁcation approach can be extended to any data format with suitable self-supervised signals.
We hope this paper can inspire future exploration on a broader range of self-supervised signals for adversarial puriﬁcation.
A A PPENDIX A. I LLUSTRATION OF SELF - SUPERVISED TASKS
For those readers who are not familiar with self-supervised representation learning, we detailed the self-supervised tasks here.
As data reconstruction is straight-forward to understand, we simply illustrate rotation prediction and label consistency in Figure 6.
As shown on the left-hand side, to perform rotation prediction, we duplicate a input image to 4 copies and rotate them by one of the four degrees.
We then use the auxiliary classiﬁer to predict the rotation of each copy.
For the label consistency auxiliary task on the right-hand side, we duplicate a input image to 2 copies and apply separate data augmentation to each of them.
The left copy is augmented with random cropping and the right copy is augmented with random cropping as well as horizontal ﬂipping.
We require the predictive distributions of these 2 augmented copies to be close.
[Figure]
A. H YPER - PARAMETERS OF THE PURIFIER
Beyond (cid:15) pfy , the two additional hyper-parameters of SOAP are the step size of the puriﬁer γ , and the number of iterations performed by the puriﬁer T .
The selection of these hyper-parameters is important for the efﬁcacy of puriﬁcation.
A step size that is too small or a number of iterations that is too large can cause the puriﬁer to get stuck in a local minimum neighboring the perturbed example.
This is conﬁrmed by our empirical ﬁnding that using a relatively large step size for a small number of iterations is better than using a relatively small step size for a large number of iterations.
Although a large step size makes it hard to get the cleanest puriﬁed examples, this drawback is compensated by adding noise in training.
Training the model on corrupted examples makes the model robust to the residual noise left by puriﬁcation.
A. T RAINING DETAILS
[Table]
Conv( m , k × k , s ) 2-D convolutional layer with m feature maps, k × k kernel size, and stride s on both directions
Maxpool( s ) 2-D maxpooling layer with stride s on both directions
FC( m )
Fully-connected layer with m outputs
ReLU
Rectiﬁed linear unit activation
BN 1-D or 2-D batch normalization
Dropout( p )
Dropout layer with probability p
ShortCut
Residual addition that bypasses the basic block
[Table] [Table]
The architectures of the networks and training details are described as followed.
Table 5 describes the basic modules and their speciﬁcs
[Table]
and Table 6 describes the low-level building blocks of residual networks.
Full architectures of the networks are listed in Table 7.
For MNIST, we evaluate on a 2 hidden layer FCN and a CNN which has the same architecture as in
Madry et al.
FCN is trained for 100 epochs with an initial learning rate of 0 .
01 and CNN for 200 epochs with an initial learning rate of 0 .
1 using SGD.
The learning rate is decreased 10 times at halfway in both cases.
The batch size is 128.
In both FGSM and PGD adversarial training, the adversaries are l ∞ bounded with (cid:15) adv = 0 .
For PGD adversarial training, the adversary runssteps of projected gradient descent with a step size of 0 . 01 .
To train SOAP, the trade-off parameter α in Eq.
(1) is 100.
For CIFAR10, we evaluate our method on a regular residual network ResNet-18 and a 10-widen residual network Wide-ResNet-28-10.
Both networks are trained for 200 epochs using a SGD optimizer.
The initial learning rate is 0.1, which is decreased by a factor of 0.1 at the 100 andepochs.
We use random crop and random horizontal ﬂipping for data augmentation on CIFAR10.
(cid:15) adv = 8 / 255 for both FGSM and PGD adversarial training.
For PGD adversarial training, the adversary runs 7 steps of projected gradient descent with a step size of 2 / 255 .
The trade-off parameter of SOAP for rotation prediction and label consistency α are 0.5 and 1 respectively.
While we implement adversarial training and SOAP ourselves, we use authors’ implementation for both Defense-GAN and Pixel-Defend.
Notice that our white-box Defense-GAN accuracy is lower than the accuracy reported in (Samangouei et al., 2018).
Part of the reason is the difference in architecture and training scheme, but we are still not able to replicate their accuracy using the exact same architecture following their instructions.
Nonetheless, our results are close to (Hwang et al., 2019) where the authors also reported lower accuracy.
A. T RAINING EFFICIENCY
The comparison of training efﬁciency between SOAP and other methods is shown in Figure 7.
To measure the training complexity, we run each training method for 30 epochs on a single Nvidia
Quadro RTX 8000 GPU, and report the average epoch time consumption.
When the network capacity is small, the training complexity of SOAP is close to FGSM adversarial training and much lower than PGD adversarial training.
When the network capacity is large, the training complexity
[Figure]
Note that it is hard to compare with other puriﬁcation methods because they are typically trained in 2 stages, the training of the classiﬁer and the training of another puriﬁer such as a GAN.
While the training of those puriﬁers is typically difﬁcult and intense, SOAP does not suffer from this limitation as the encoder is shared between the main classiﬁcation network and the puriﬁer.
Therefore it is reasonable to claim that SOAP is more efﬁcient than other puriﬁcation methods.
A. P URIFIED EXAMPLES
We have shown some PGD examples of adversarial images puriﬁed images by SOAP in Figure 4.
In Figures 8-10 we present some examples of every attack.
The adversary is shown on the top of each column.
The network prediction is shown at the bottom of each example.
[Figure] [Figure]
[Figure]
A. S UCCESS RATE OF (cid:96) 2 ATTACKS
To provide more details about the robustness under (cid:96) 2 attacks, in Tables 8 and 9 we report the success rate of generating (cid:96) 2 attacks.
For the MNIST dataset, generating an (cid:96) 2 attack is considered a success if the (cid:96) 2 norm of the perturbation is smaller than 4; for the CIFAR10 dataset, the bound is set as 2.
PGD adversarial training typically results in low success rate compared with other methods; SOAP, on the other hand, is typically “easy” to attack before puriﬁcation because there is no adversarial training involved.
Notice that the Wide-ResNet-28 model trained on label consistency is robust to the DeepFool attack even before puriﬁcation.
This explains why SOAP-LC robust accuracy in
Table 2 is relatively low because its DeepFool perturbations are larger than other cases
[Table]
[Table] [Table]