Defending Adversaries Using Unsupervised Feature Clustering VAE
Abstract
We propose a modiﬁed VAE (variational autoencoder) as a denoiser to remove adversarial perturbations for image classiﬁcation.
Vanilla VAE’s purpose is to make latent variables approximating normal distribution, which reduces the latent inter-class distance of data points.
Our proposed
VAE modiﬁes this problem by adding a latent variable cluster.
So the VAE can guarantee inter-class distance of latent variables and learn class-wised features.
Our Feature Clustering VAE performs better on removing perturbations and reconstructing the image to defend adversarial attacks.
1. Introduction
Adversarial examples become a major challenge for the task of image classiﬁcation and recognition (Yuan et al., 2019).
Several countermeasures have been proposed against adversarial examples, mainly including model-speciﬁc hardening strategies and model-agnostic defenses.
Typical modelspeciﬁc solutions like “adversarial training” (Kurakin et al., 2017a; Papernot et al., 2016; Xie et al., 2020;
Wong et al., 2020; Shafahi et al., 2019) can rectify the model parameters to mitigate the attacks by using the iterative retraining procedure or modifying the inner architecture.
Model-agnostic solutions like input dimensionality reduction or direct lossy image compression (Dziugaite et al., 2016; Das et al., 2017), which attempt to remove adversarial perturbations by input transformations before feeding them into neural network classiﬁers.
In this paper, we focus on looking for an effective modelagnostic defense strategy (1) can aggressively remove the adversarial perturbations from input images, (2) can reserve sufﬁcient features in input images to ensure the classiﬁcation accuracy, (3) is still robust to those adversaries which have information about the defense strategy being used.
Because the autoencoder are learning to extract useful features and discards useless features to reconstruct the data point.
This process gives the autoencoder the potential to remove the adversarial perturbations.
In this paper, we augment the autoencoder with feature clustering.
We show that our modiﬁed autoencoder can not only defend adversarial attacks but also improve the classiﬁcation accuracy on clean images.
2. Related Work 2.1. Autoencoder
Variational autoencder (VAE) (Kingma & Welling, 2014) provides a probabilistic manner for describing an observation in latent space.
Thus, rather than building an encoder which outputs a single deterministic value to describe each latent state attribute, VAE formulate the encoder to describe a probability distribution for each latent attribute.
With this approach, each latent attribute for a given input will be a probability distribution.
When generating output, the encoder is dropped and the decoder randomly samples from latent state distribution to generate a variable as input.
Such a randomly sampling process is non-differentiable, so that the training process includes a reparameterization trick.
VAE minimizes the negative evidence low bound of log p θ ( x ) :
[Equation]
Different from the generating process of traditional VAE during test, in our work, we preserve the encoder to achieve the goal of removing the perturbation.
2.2. Adversarial Attacks
One of the ﬁrst and simple but quite effective attack is the Fast gradient sign method ( FGSM (Goodfellow et al., 2015)).
It simply takes the sign of the gradient of loss function J (e.g., cross-entropy loss) w.r.t the input image x and multiplies with magnitude (cid:15) as perturbations,
[Equation]
where θ is the parameters set of neural network and y is the ground truth label of x .
The parameter (cid:15) is the magnitude of perturbation which controls the similarity of adversarial examples and original image.
By trying to ﬁnd a high success rate adversarial example but having as small dissimilarity with original image as possible, (Kurakin et al., 2017b) proposed an iterative version of FGSM, I-FGSM .
It iteratively applies FGSM in [Figure] (cid:450) [Figure]
[Figure] (cid:304) p [Figure] [Figure]
[Figure] c
[Figure]
(cid:450) (2) (cid:450) (c-1) (cid:450) (c) every iteration and clips the value to ensure per-pixel perturbation below the attack magnitude. PGD (Madry et al., 2018) is short for Projected Gradient Descent. Adversarial examples generated by PGD are restarted from different starting point (e.g. by adding tiny random noise to the initial input) for each iteration.
MI-FGSM
(Dong et al., 2018) is called Momentum Iterative Fast Gradient Sign Method which leverages momentum during optimization process.
The authors argued that the use of momentum helps to stabilize the update directions for perturbations, and helps to escape from weak local maxima.
BPDA (Athalye et al., 2018) works by ﬁnding a differentiable approximation for non-differentiable pre-processing transformation g ( · ) or a non-differentiable network layer, possibly via an engineered guess.
3. Unsupervised Clustering VAE
Recall the loss function of VAE is simply minimizing the
Kullback-Leibler divergence between Q ( z | x ) and P ( z | x ) , where Q ( z | x ) is a variational distribution parameterized by the encoder and P ( z | x ) denotes the true posterior.
Q ( z | x ) is optimized to approximate the P ( z | x ) .
Generally, VAE for images generates blurred images, so the VAE is often used as feature extractor.
(Ilyas et al., 2019) proposed that adversaries are features, not bugs and there exists robust features and non-robust features in images.
That gives us the intuition that we could use a clustering VAE to extract robust features (CVA, 2018; Xie et al., 2016).
In addition to the latent coding variables z , we add a discrete value y as the cluster index.
The cluster index is obtained through training by clustering the features in the latent space, which represents that the representation of the input having the same characteristics is close to each other, beneﬁting the feature extraction and generation for images of different classes.
Thus our Clustering VAE’s loss becomes:
[Equation]
For simplicity, we make two assumptions: (1) the encoder encodes the input x to latent variables z , and clustering the input depends only on z ; (2) the decoder only uses the latent variable z without the index y .
This can be mathematically expressed as follows:
[Equation]
Applying the Eq.
4 to Eq.
3, with the Bayes rule, we get:
[Equation]
Separating the function inside log , our Clustering VAE loss function will be:
[Equation]
The ﬁrst term corresponds to MSE error.
The term Q ( y | z ) can be regarded as a classiﬁer to classify the latent to the corresponding cluster.
The P ( z | y ) in the second term can be seen as a distribution of the latent variable for a cluster index y .
As in vanilla VAE, Q ( z | x ) takes the form of normal distribution with mean µ ( x ) and standard deviation σ ( x ) that can be learned from data.
Here we set the P ( z | y ) as a normal distribution with mean of µ ( y ) .
Based on our assumption, we have:
[Equation]
Because of the reparameterization trick during training process, we know:
[Equation]
Substituting the Eq.
8 to Eq.
7 and Eq.
6, the second term of
Eq.6 becomes:
[Equation]
where the C is a random value that has nothing to do with the parameters.
The second term in Eq.
6 plays the role of making the encoder’s clustering of inputs with similar features in the latent space.
The third term can be seen as a regularization to make the distribution of each cluster is approximated to prior P ( y ) .
We can just set the prior
P ( y ) the uniform distribution.
The network structure of our proposed Cluster VAE is shown in Fig.
4. Experiment 4.1. Clustering Experiment
Firstly, we select the digits from MNIST validation set as the input of encoder, and separate the outputs generated by decoder depending on the cluster results of the latent cluster index.
Results are shown in Fig.
We can see the clustering results are quite good, except some ‘3’ and ‘8’, ‘4’ and ‘9’ which share similar features.
So our Cluster VAE indeed learns to extract the useful features of digits, thus providing the potential for our following work, i.e. removing adversarial perturbations.
Note that our clustering training process is different from a basic MNIST classiﬁer.
This because that our Cluster VAE is an unsupervised training process, and it forces to extract typical features from training set without the information of labels.
Secondly, after the training of our Cluster VAE, we get a normal distribution with mean of µ ( y ) for each cluster.
We sample the latent variables from each distribution as the input to the decoder and generate outputs using only the decoder.
Results are shown in Fig.
3, as we can see, the distribution of each cluster do work to some extent.
However, the vertical and slanted ‘1’ are not in same cluster, and ‘4’ and ‘9’ are sharing the similar mean.
That is understandable because our Cluster VAE is designed to extract similar features not to classify the digits acting as a classiﬁer.
Besides, our purpose is to reconstruct the digits and remove adversarial features, so this will not be an issue.
[Figure]
4.2. Defending Adversaries 4.2.1. R EMOVING A DVERSARIAL P ERTURBATIONS
We introduce the idea of the DAE training process, i.e. adding Gaussian noise in input to mimic the adversarial perturbations, to force autoencoder to extract clean features.
That is, we separate the training process into two phrases: ﬁrst, we train the VAE and Cluster VAE with clean images in training set, and we can get the VAE and C-VAE models.
Here we expect the encoder learn to extract robust features from clean image and decoder learn to decodes the robust features to input.
Then, we freeze the parameters of the decoder, and train them again with the images added by Gaussian noise, but evaluate the loss between the outputs and clean images.
Here, in the second phrase, we expect the encoder learns to extract robust features from noised images.
Afterwards, we obtain two trained models, i.e., VAE+G (VAE with Gaussian noised input), CVAE+G (Cluster VAE with Gaussian noised input).
Combined with DAE, VAE, and CVAE, we have a total of ﬁve models.
In the following, we compare the digit results generated for ablation study.
The visual reconstructed results are shown in and Fig.
When reconstruct from adversarial examples, the visual results of Cluster VAE are better than DAE, and VAE shows the worst results.
However, after applying training with Gaussian noised images mentioned above, the VAE and Cluster VAE both show very good visual results.
4.2.2. G RAY - BOX A TTACK
In our gray-box setting, the adversary has access to the model architecture and the model parameters, but is unaware of the defense strategy that is being used.
We generate adversarial examples using classic and effective attacks mentioned in Section.
Results are shown in Table.
In our experiments, we build a simple CNN classiﬁer for MNIST and adopt ResNet-34 (He et al., 2016) for CIFAR-10 as the model to be attacked.
The attack parameters (cid:15) of FGSM are 0 .
2 for MNIST and 0 .
03 for CIFAR-10.
Parameters for other four iterative attacks are (cid:15) = 0 .
2 , stepsize = 0 .
05 withiterations for MNIST and (cid:15) = 0 .
03 , stepsize = 0 .
with 10 iterations for CIFAR-10.
As can be seen in the results,
[Table]
[Table]
[Table]
our C-VAE training with Gaussian noise can achieve the best accuracy for reconstructing the clean image and best accuracy when defending all the adversarial examples in
MNIST dataset.
In experiments on CIFAR dataset, our
C-VAE can also achieve relatively higher performance in reconstructing the clean image.
However, C-VAE shows similar performance when defending adversarial examples with VAE.
4.2.3. W HITE - BOX A TTACK
In our white-box setting, the adversary has access to the model architecture and the model parameters, is also aware of the defense strategy that is being used.
Since reconstruction using VAE has the random sampling operation which is non-differentiable, and all those ﬁve attacks in gray-box setting need to compute the gradients to generate adversarial examples.
So we adopt the adaptive attack BPDA (Athalye et al., 2018) in our white-box setting.
We implement the evaluation experiment on the released code at GitHub (Athalye et al., 2018), using ResNet-34 (He et al., 2016) as test model, and 1000 iterations and 0.1 learning rate as attack parameters with 1000 images in validation set.
The accuracy of various methods on adversarial examples ( Acc ae ) and benign images ( Acc raw ) are reported in Table.
Compared to gray-box setting, DAE can defend gray-box attack to large extent while can not defend the adaptive whitebox attack.
Further, as we can see, all the autoencoders can hardly defend the BPDA attack, however, our CVAE performs relatively better.
4.3. Training Time
Except concerning the defense efﬁciency of our defense methods, the training time is another indicator we concern.
Traditional adversarial training could be extremely time consuming (Madry et al., 2018).
Recent works (Shafahi et al., 2019; Wong et al., 2020) proposed several methods to decrease the computational complexity of adversarial training.
We compared our training time with those adversarial training, the results of which are shown in Table.
Our proposed C-VAE has lower complexity compared to PGDand signiﬁcantly higher defense efﬁciency.
Compared to
Fast and Free adversarial training, our method still exhibits higher efﬁciency, but brings moderate time increase.
5. Conclusion
The experimental results in this paper shows that VAE has the potential to remove the adversarial perturbations and preserve the robust features at the same time.
Our proposed
Cluster VAE has two merits:
Like VAE, Cluster VAE has the random sampling operation which is non-differentiable, which makes the gradientbased adversaries much more difﬁcult to ﬁnd an adversarial perturbation.
Besides, VAE-based defenses have better generalization than adversarial training methods since they are model-agnostic. 2.
Our proposed Cluster VAE has the unsupervised clustering operation inside, which can ensure that the encoder extracts robust and label-wised features.
Those robust features are important for classiﬁcation neural networks to make the correct prediction.