AID-Puriﬁer: A Light Auxiliary Network for Boosting Adversarial Defense
Abstract
We propose an AID-puriﬁer that can boost the robustness of adversarially-trained networks by purifying their inputs.
AID-puriﬁer is an auxiliary network that works as an add-on to an already trained main classiﬁer.
To keep it computationally light, it is trained as a discriminator with a binary cross-entropy loss.
To obtain additionally useful information from the adversarial examples, the architecture design is closely related to information maximization principles where two layers of the main classiﬁcation network are piped to the auxiliary network.
To assist the iterative optimization procedure of puriﬁcation, the auxiliary network is trained with AVmixup.
AID-puriﬁer can be used together with other puriﬁers such as PixelDefend for an extra enhancement.
The overall results indicate that the best performing adversarially-trained networks can be enhanced by the best performing puriﬁcation networks, where AID-puriﬁer is a competitive candidate that is light and robust.
1. Introduction
Deep neural networks are vulnerable to adversarial examples generated by adding imperceptible adversarial perturbations to the original examples (Szegedy et al., 2013).
To address this problem, various adversarial defense schemes have been proposed, where a vast majority of them can be grouped into three categories.
The ﬁrst category is gradient masking (Xiao et al., 2020; Athalye et al., 2018).
The second category is adversarial training (Madry et al., 2017;
Zhang et al., 2019; Lee et al., 2020).
The third category is adversarial puriﬁcation (Samangouei et al., 2018;
Song et al., 2018;
Meng & Chen, 2017; Shi et al., 2021).
In this study we focus on the third category, adversarial puriﬁcation.
Our objective is to develop a computationally light and easily attachable puriﬁer such that it can be utilized as an add-on.
Speciﬁcally, we show that we can boost the performance of Madry et al.
; Zhang et al.
(2019), and Lee et al.
(2020) with a light auxiliary network named
AID-Puriﬁer .
AID-Puriﬁer utilizes A Vmixup, I nformation maximization principles, and D iscriminative task as the underlying foundations.
Before describing AID-Puriﬁer, we ﬁrst summarize previous works on adversarial puriﬁcation methods.
Adversarial puriﬁcation modiﬁes input examples to increase adversarial robustness, and four well-known puriﬁcation methods are shown in Figure 1.
In (a), a denoising puriﬁer ,
MagNet (Meng & Chen, 2017), is shown.
It uses an autoencoder, called a reformer, as an auxiliary network.
The resulting network as a whole, however, becomes just another feedforward network that is vulnerable to auxiliary-aware white-box attacks (Tramer et al., 2020).
In (b), a generative puriﬁer , Defense-GAN (Samangouei et al., 2018), is shown.
Defense-GAN is not easy to train, and its performance is worse than that of another well-known generative puriﬁer.
In (c), another generative puriﬁer, PixelDefend (Song et al., 2018), is shown.
PixelDefend is computationally heavy owing to its pixel-wise operation.
In (d), a self-supervisedlearning-based puriﬁer , SOAP (Shi et al., 2021), is shown.
SOAP yields competitive robust accuracy against state-ofthe-art adversarial training and puriﬁcation methods, but it needs to be jointly trained with the main classiﬁer C .
Of the four puriﬁcation methods in Figure 1, SOAP is the only one that requires joint training and thus cannot be used as an add-on.
We herein propose a discriminative puriﬁer named AIDPuriﬁer.
To the best of our knowledge, this is the ﬁrst successful puriﬁcation method based on a discrimination task.
AID-Puriﬁer uses an auxiliary discriminator network
D to project x adv to a puriﬁed example x pur that belongs to a low p adv ( x ) region.
Compared to the four methods in Figure 1, AID-Puriﬁer is distinct because it has all the advantages of the four methods.
Unlike denoising puriﬁers, it is robust against auxiliary-aware attacks.
Unlike generative puriﬁers, it requires light computation and is easy to train.
Unlike SOAP, it is an add-on that can be attached to any frozen state-of-the-art network.
AID-Puriﬁer is an effective stand-alone defense method; however, it can also create synergies with adversarially-trained networks or other
[Figure]
puriﬁer networks such as PixelDefend.
For all experiments we performed, AID-Puriﬁer was able to boost the robustness of state-of-the-art adversarial training and puriﬁcation methods.
2. Related Works 2.1. Detecting adversarial examples with an auxiliary network
For humans, it is difﬁcult to tell the difference between a clean example and its adversarial example.
The difference, however, can be detected well by training a binary classiﬁcation network (Gong et al., 2017; Metzen et al., 2017).
A standard binary cross-entropy (BCE) loss can be used for training, where the loss is interpreted as the probability of an adversarial example.
In this study, we extend the idea of adversarial detector and show that a light auxiliary network can improve the adversarial robustness.
2.2. Information maximization principles
Following the principle of maximum information preservation in (Linsker, 1988) and the information maximization approach in (Bell & Sejnowski, 1995), Hjelm et al.
(2018) demonstrated that unsupervised learning of representations is possible by maximizing mutual information between a lower layer’s representation
h low ( x ) and a higher layer’s representation h high ( x ) for a given in- put image x .
Unfortunately, the precise estimation of mutual information is known to be difﬁcult (McAllester & Stratos, 2020; Song & Ermon, 2020).
A known workaround for this problem is to evaluate BCE loss or
Jensen-Shannon divergence between the positive example pairs of ( h low ( x i ) , h high ( x i )) and the negative example pairs of ( h low ( x i ) , h high ( x j ))
(Hjelm et al., 2018; Brakel & Bengio, 2017; Veliˇckovi´c et al., 2019; Ravanelli & Bengio, 2018), known as contrastive learning (Hadsell et al., 2006).
In our AID-Puriﬁer, we also use a BCE loss but we discriminate between ( h low ( x adv ) , h high ( x adv )) and ( h low ( x clean ) , h high ( x clean )) instead.
This can be a natural choice for adversarial defense, because the information theoretic relationship between h low ( x ) and h high ( x ) should be different for clean examples and adversarial examples.
In particular, the perturbation of features induced by x adv increases gradually as it passes through the network (Guo et al., 2017; Liao et al., 2018; Xie et al., 2019).
The auxiliary network is denoted as D ( h low ( x ) , h high ( x )) .
2.3. AVmixup
Zhang et al.
(2018) proposed mixup that is a data augmentation scheme with linearly interpolated training examples for regularizing deep networks.
Mixup can be considered as a derivative of label smoothing (Szegedy et al., 2016).
As a variant of the mixup, Lee et al.
(2020) proposed AVmixup for performing data augmentation of adversarial examples.
While AVmixup was shown to be effective for the adversarial training of the main classiﬁcation network C ( x ) , we apply AVmixup to train the auxiliary discriminator network
D ( h low ( x ) , h high ( x )) .
This data augmentation with linear interpolation plays a pivotal role in training AID-Puriﬁer.
As a basic iterative procedure is applied at the inference time for puriﬁcation, the discriminator needs to learn how to purify not only a strong adversarial example but also a weak adversarial example.
Ideally, we would like the discriminator to learn a continuous path for purifying an adversarial example with an iterative procedure.
3. AID-Puriﬁer 3.1. Discriminator: D ( h low ( x ) , h high ( x ))
A diagram of AID-Puriﬁer is shown in Figure 3.
The main classiﬁcation network C ( x ) can be any naturally or adversarially-trained network.
The main network was frozen before attaching our auxiliary discriminator network
D ( h low ( x ) , h high ( x )) .
Following the information maximization principles, a lower layer representation h low ( x ) and a higher layer representation h high ( x ) are passed from classiﬁer C to discriminator D .
In contrast to the work in (Hjelm et al., 2018), we apply global average pooling as the ﬁrst operation in the discriminator.
Despite the loss of spatial resolution in each feature map, global average pooling is helpful for making D computationally light for two reasons.
First, the size of the representation is signiﬁcantly reduced by averaging the spatial dimensions where puriﬁcation can still enforce spatial variations over the channels.
Second, as the resulting representations are invariant to spatial translations (Lin et al., 2013), we can simply use a
Algorithm
[Table]
fully connected network of a small size as the discriminator.
Fully connected layers follow the global average pooling.
The discriminator is trained with a standard BCE loss over adversarial and clean examples, and the loss function is as L D = − t log( D ( h low ( x ) , h high ( x )))
− (1 − t ) log(1 −
D ( h low ( x ) , h high ( x ))) , where x is the input example and t is the corresponding binary label (adversarial or clean).
See
Appendix A for the architecture details.
3.2. Training: AVmixup
To train the discriminator, we apply AVmixup (Lee et al., 2020) such that the discriminator learns how to purify any strength of adversarial example.
As explained in Section 2.3, this is an essential requirement for the iterative puriﬁcation procedure to work well.
The details of the AVmixup training are shown in Algorithm 1.
We use only PGD to generate adversarial examples because PGD is the worst case attack for most scenarios.
3.3. Inference: iterative puriﬁcation
For inference, the auxiliary discriminator network D is used to purify x into x pur .
The puriﬁcation is applied to any x including both clean and adversarial examples.
As in the
PGD attack, a basic iterative procedure is applied, and the puriﬁcation is summarized in Algorithm 2.
Speciﬁcally, an iterative gradient sign method is applied with the goal of reducing the probability of an adversarial attack, p adv ( x ) .
We constrain the algorithm to keep the puriﬁed image x pur within the ε -ball of x , because an x pur far from x might alter the class output of the main classiﬁcation network C ( x ) .
4. Experiments
It is certainly possible to use a puriﬁer as a stand-alone defense, but some of the puriﬁers can be also used as an add-on defense for boosting the performance of another adversarial defense.
In this section, we investigate the performance of AID-Puriﬁer as a stand-alone defense and as an add-on defense.
As explained in Section 1, MagNet is vulnerable to auxiliary-aware attack and SOAP cannot be used as an add-on.
Thus, we only focus on Defense-GAN and PixelDefend.
For the baseline adversarial training models of add-on experiments, we use Madry (Madry et al., 2017),
Zhang (Zhang et al., 2019), and Lee (Lee et al., 2020) as the
Algorithm 2 Puriﬁcation at inference time
[Table]
[Table] [Table] [Table]
[Table] [Table]
[Table] [Table]
[Table]
most representative set of defense models.
Implementation details are described in Appendix A.
Robust accuracy: The robust accuracy results for SVHN are shown in Table 1.
Defense-GAN performs well as a stand-alone, but its performance as an add-on is inferior to the other puriﬁers.
In fact, as an add-on, it usually undermines the baseline performance for complex datasets as shown in Appendix B. For this reason, Defense-GAN is not investigated any further for the add-on performance.
When both of PixelDefend and AID-Puriﬁer are utilized together, however, they achieve 42 .
67% of robust accuracy that is better than Madry or Zhang as a stand-alone.
As an add-on, the best performance is also achieved when both are utilized together.
This synergy is due to the diversity between the two puriﬁers.
While PixelDefend attempts to purify an example by pushing it to a high p data ( x ) region,
AID-Puriﬁer is more adventurous because it is willing to utilize out-of-distribution regions as well.
Computational load: We have measured the puriﬁcation time and training time of the puriﬁers, and the results are shown in Table 2.
For the puriﬁcation time, both DefenseGAN and AID-Puriﬁer perform well but PixelDefend is up to 277 times slower than AID-Puriﬁer due to the pixelwise operation of PixelDefend.
For the training time, AIDPuriﬁer is deﬁnitely faster than the other two puriﬁers.
Boosting performance as an add-on: As a deep dive, we provide add-on experiment results for PixelDefend and
AID-Puriﬁer in Table 3.
Exhaustive results are provided in
Appendix C. The most important ﬁnding is that each of the two adversarial puriﬁers provides a positive enhancement for almost any individual combination of dataset and attack method.
To investigate if AID-Puriﬁer can create a positive synergy with puriﬁers other than PixelDefend, we have [Table] [Figure] [Table]
[Figure]
[Table]
carried out an extra experiment.
For NRP, that is a type of adversarial puriﬁer and trains a conditional GAN to learn an optimal input processing function, the experimental results are shown in Table 9 of Appendix D and they are similar to PixelDefend’s results.
For the case of Defense-GAN, we have tried using AID-Puriﬁer together with Defense-GAN, and we have found that the loss by Defense-GAN can be mitigated by AID-Puriﬁer as shown in Appendix G.
Additional experiments: We have performed auxiliaryaware attack, a complete white-box attack where both of the main classiﬁcation network and the auxiliary network are known to the attacker (Shi et al., 2021), as a strong adaptive attack (Tramer et al., 2020) to show that the puriﬁcation addon is robust to the attack as shown in Figure 4 in Appendix E.
Furthermore, we have investigated the inﬂuence of attack hyperparameters, attack epsilon, and the number of attack iterations for PGD attack as shown in Appendix J. We additionally investigate the sensitivities of the attack method, the defense epsilon, and the number of iterations for training discriminator.
The results can be found in Appendix H and I.
Moreover, we show that the black-box attack is not effective to AID-Puriﬁer as shown in Table 10 of Appendix F. To verify that the key features of AID-Puriﬁer are effective, we have performed ablation tests as shown in Table 15 of
Appendix K. All of the three key features are helpful for enhancing the performance of AID-Puriﬁer.
5. Conclusion
In this study, we have proposed AID-Puriﬁer, a light auxiliary network for purifying adversarial examples.
To the best of our knowledge, AID-Puriﬁer is the ﬁrst successful puriﬁcation method that is based on a simple discriminator.
It has a quite different characteristics from the previously known puriﬁers in terms of the puriﬁcation objective, where a puriﬁed image x pur is allowed to lie in an out-of-distribution region.
It can consistently boost the performance of adversarially-trained networks, and it can create synergies with other adversarial puriﬁers such as PixelDefend and NRP.
Whether adversarially-trained networks should be always used with one or more adversarial puriﬁers remains as an open question.
A. Experimental details
In this appendix, we provide the details of the experiments conducted in our study.
We perform the experiments over four datasets - SVHN (Netzer et al., 2011), CIFAR-10 (Krizhevsky & Hinton, 2009), CIFAR-100 (Krizhevsky & Hinton, 2009), and TinyImageNet (Le & Yang, 2015).
As in other studies (Madry et al., 2017; Zhang et al., 2019), we use a 10-widen
Wide-ResNet-34 (Zagoruyko & Komodakis, 2016) as the main classiﬁcation network C ( x ) .
For the white-box adversarial attack, we consider PGD (Madry et al., 2017), C&W (Carlini & Wagner, 2017), DeepFool (DF) (Moosavi-Dezfooli et al., 2016), and MIM (Dong et al., 2018).
A.1. Other adversarial puriﬁers
The puriﬁers used in this paper are:
• Defense-GAN (Samangouei et al.
(2018), Apache License) : https://github.com/kabkabm/defensegan .
• PixelDefend
(Song et al.
(2018), MIT License) : https://github.com/microsoft/PixelDefend .
A.2. AID-Puriﬁer : discriminator architecture
For training discriminator, we ﬁrst apply global average pooling to h low ( x ) and h high ( x ) .
Then, we pass the results to a fully-connected network described below in Table 4.
In the case of SVHN, we use three hidden layers instead of two.
[Table]
Output
Concat (
[Table]
[Table]
Linear
ReLU
Linear
ReLU
Linear
Sigmoid
A.3. AID-Puriﬁer : discriminator hyperparameters
Training hyperparameters: We train the network using SGD with learning rate 0 .
01 , weight decay 2 e − 4 , and momentum 0 .
9 for 1 epoch.
We use γ = 2 for SVHN and γ = 1 . 5 for CIFAR-10, CIFAR-100, and TinyImageNet.
Puriﬁcation hyperparameters: For SVHN, we use ε pur = 12 / 255 , α = 3 / 255 , N = 10 .
For CIFAR-10, we use ε pur = 8 / 255 , α = 2 / 255 , N = 10 .
For CIFAR-100, we use ε pur = 16 / 255 , α = 2 / 255 , N = 20 .
For TinyImageNet, we use ε pur = 8 / 255 , α = 2 / 255 , N = 20 .
A.4. Attack hyperparameters
All attacks are evaluated under the l 2 metric for C&W and the l ∞ metric for the others.
For SVHN, we use the perturbation size 12/255 and the step size 2/255.
For CIFAR-10, CIFAR-100, and TinyImageNet, we use the perturbation size 8/255 and the step size 1/255.
We use Foolbox (Rauber et al., 2017), a third-party toolbox for evaluating adversarial robustness.
All other parameters are set by Foolbox to be its default values.
B. Comparison with other puriﬁers on various datasets
We repeated the same experiment of Table 1 for CIFAR-10 (Table 5), CIFAR-100 (Table 6) [Table] and TinyImageNet (Table 7) [Table]
[Table] [Table] [Table] [Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table] [Table] [Table] [Table]
AID
[Table]
Ours)
[Table]
[Table]
[Table]
C. Boosting performance as an add-on
We provide exhaustive add-on experiment results for PixelDefend and AID-Puriﬁer in Table 8.
D. Boosting performance as an add-on to NRP
We provide exhaustive add-on experiment results for NRP (Neural Representation Puriﬁer (Naseer et al., 2020)) and
AID-Puriﬁer in Table 9.
For the worst performance column, which can be interpreted as the overall conclusion for each dataset, AID-Puriﬁer boosts the robustness in most scenarios.
[Table]
E. Auxiliary-aware attack
Following the approach in (Shi et al., 2021), we generate auxiliary-aware attack as
[Equation]
where λ is a trade-off parameter between the main cross entropy loss L C and the auxiliary (discriminator) loss L D .
The results are shown in Figure 4.
Puriﬁcation provides positive improvement for all the evaluated cases.
F. Black-box attack
We generate black-box adversarial examples using a pre-trained VGG19 network (Simonyan & Zisserman, 2014).
PGD,
C&W, DF, and MIM attacks are used to evaluate black-box robustness on SVHN.
We report only the worst black-box accuracy in Table 10.
For the case of Mardy, a large improvement is achieved.
G. Boosting performance of AID-Puriﬁer as an add-on to the Defense-GAN
The robust accuracy results are shown in Table 11.
Defense-GAN is actually harmful, but AID-Puriﬁer can recover part of the performance loss created by Defense-GAN.
[Table]
H. Various attack methods for training discriminator D
When training the discriminator, the attack method for generating adversarial examples need to be decided.
The sensitivity study results are shown in Table 12 for SVHN dataset.
I. Defense epsilon and defense iteration
The robust accuracy results for SVHN are shown in Figure 5 and Table 13.
J. Attack epsilon and attack iteration
The robust accuracy results for SVHN are shown in Table 14.
K. Ablation study
To verify that the key features of AID-Puriﬁer are effective, we have performed ablation tests.
The results are shown in
Table 15.
All of the three key features are helpful for enhancing the performance of AID-Puriﬁer, where the choice of training target and the choice of data augmentation scheme are crucial for AID-Puriﬁer’s performance.
Additionally, the
[Table]
ablation test results of the intermediate layers connected from C ( x ) to the discriminator D are presented in Table
[Table] [Table]
[Table] [Table]
Attack eps
Madry
Madry + AID-Puriﬁer 1/ 57.
12/255 (our work) 38.
Madry
Madry + AID-Puriﬁer 40 (our work) 38.
[Figure] [Figure]
[Table]
Used intermediate representation
[Table]
(cid:88)
[Table]
(cid:88)
[Table]
(cid:88)
[Table]
(cid:88)
[Table]
(cid:88) (cid:88) 44.
[Table]
(cid:88) (cid:88) [Table]
[Table] (cid:88) (cid:88) [Table]
[Table]
(cid:88) (cid:88) 44.
[Table]
(cid:88) (cid:88) 45.
(cid:88) (cid:88) 50.