C OMPRESSIVE R ECOVERY D EFENSE : A D EFENSE F RAMEWORK FOR (cid:96) 0 , (cid:96) 2 , AND (cid:96) ∞ NORM ATTACKS .
Anonymous authors
Paper under double-blind review A BSTRACT
We provide recovery guarantees for compressible signals that have been corrupted with noise and extend the framework introduced in Bafna et al.
(2018) to defend neural networks against (cid:96) 0 , (cid:96) 2 , and (cid:96) ∞ -norm attacks.
In the case of (cid:96) 0 -norm noise, we provide recovery guarantees for Iterative
Hard Thresholding (IHT) and Basis Pursuit (BP).
For (cid:96) 2 -norm bounded noise, we provide recovery guarantees for BP, and for the case of (cid:96) ∞ -norm bounded noise, we provide recovery guarantees for
Dantzig Selector (DS).
These guarantees theoretically bolster the defense framework introduced in
Bafna et al.
(2018) for defending neural networks against adversarial inputs.
Finally, we experimentally demonstrate the effectiveness of this defense framework against an array of (cid:96) 0 , (cid:96) 2 and (cid:96) ∞ -norm attacks.
I NTRODUCTION
Signal measurements are often corrupted by noise.
The theory of compressive sensing (Candes et al.
(2006)) allows us to retrieve the original signal from a corrupted measurement, under some structural assumptions on the measurement mechanism and the signal.
Let us consider the class of machine learning problems where the inputs are compressible (i.e., approximately sparse) in some domain.
For instance, images and audio signals are known to be compressible in their frequency domain and machine learning algorithms have been shown to perform exceedingly well on classiﬁcation tasks that take such signals as input (Krizhevsky et al.
; Sutskever et al.
However, it was found in Szegedy et al.
(2013) that neural networks can be easily forced into making incorrect predictions by adding adversarial perturbations to their inputs;
(2014); Goodfellow et al.
; Papernot et al.
; Carlini & Wagner (2017).
Further, the adversarial perturbations that led to incorrect predictions were shown to be very small (in either (cid:96) 0 , (cid:96) 2 , or (cid:96) ∞ -norm) and often imperceptible to human beings.
For this class of machine learning tasks, we show how to approximately recover original inputs from adversarial inputs and thus defend the neural network against attacks.
We consider (cid:96) 0 -norm, (cid:96) 2 -norm and (cid:96) ∞ -norm attacks.
In the case of (cid:96)
-norm attacks on neural networks, the adversary can perturb a bounded number of coordinates in the input vector but has no restriction on how much each coordinate is perturbed in absolute value.
In the case of (cid:96) 2 -norm attacks, the adversary can perturb as many coordinates of the input vector as they choose as long as the (cid:96) 2 -norm of the perturbation vector is bounded.
Finally, in (cid:96) ∞ -norm attacks, the adversary is only constrained by the amount of noise added to each coordinate of the input vector.
The contribution and structure of this paper is as follows.
In Section 3.1, we describe the Compressive Recovery Defense (CRD) framework, a compressive-sensing-based framework for defending neural networks against adversarial inputs.
This is essentially the same framework introduced in
Bafna et al.
(2018), though Bafna et al.
(2018) considered only (cid:96) 0 attacks.
In Section 3.2, we present the recovery algorithms which are used in the CRD framework to approximately recover original inputs from adversarial inputs.
These algorithms include standard Basis Pursuit (BP), but also versions of Iterative Hard Thresholding (IHT) and the Dantzig Selector (DS) specially adapted to the structure of the problem.
In Section 3.3, we state recovery guarantees for the recovery algorithms in the presence of noise bounded in either (cid:96) 0 , (cid:96) 2 , or (cid:96) ∞ -norm.
The guarantees apply to arbitrary (cid:96) 0 , (cid:96) 2 , and (cid:96) ∞ -norm attacks; they do not require prior knowledge of the adversary’s attack strategy.
The recovery guarantees are proved rigorously in Appendix A.
In Section 4, we experimentally demon-
Notation.
Let x be a vector in C N .
Let S ⊆ { 1 , . .
. , N } and S = { 1 , . .
, N } \ S .
The cardinality of S is | S | .
If A ∈ C m × N is a matrix, then A S ∈ C m ×| S | is the column submatrix of A consisting of the columns indexed by S .
We denote by x S either the sub-vector in C S consisting of the entries indexed by S or the vector in C N that is formed by starting with x and setting the entries indexed by S to zero.
For example, if x = [4 , 5 , − 9 , 1] T and S = { 1 , 3 } , then x S is either [4 , − 9] T or [4 , 0 , − 9 , 0] T .
It will always be clear from context which meaning is intended.
Note that, under the second meaning, x S = x − x S .
The support of x , denoted by supp ( x ) , is the set of indices of the non-zero entries of x , i.e., supp ( x )
=
{ i ∈ { 1 , . . .
, N } : x i (cid:54) = 0 } .
The (cid:96) 0 -quasinorm of x , denoted (cid:107) x (cid:107) 0 , is deﬁned to be the number of non-zero entries of x , i.e. (cid:107) x (cid:107)
= card ( supp ( x )) .
We say that x is k -sparse if (cid:107) x (cid:107) 0 ≤ k .
We use x h ( k ) to denote a k -sparse vector in C N consisting of the k largest (in absolute value) entries of x with all other entries zero.
For example, if x = [4 , 5 , − 9 , 1] T then x h (2) =
[0 , 5 , − 9 , 0] T .
Note that x h ( k ) may not be uniquely deﬁned.
In contexts where a unique meaning for x h ( k ) is needed, we can choose x h ( k ) out of all possible candidates according to a predeﬁned rule (such as the lexicographic order).
We also deﬁne x t ( k ) =
x
− x h ( k ) .
If x = [ x 1 , x 2 ] T ∈ C 2 n with x 1 , x 2 ∈ C n , and if x 1 is k -sparse and x 2 is t -sparse, then x is called ( k, t ) -sparse.
We deﬁne x h ( k,t ) =
[( x 1 ) h ( k ) , ( x 2 ) h ( t ) ] T , which is a ( k, t ) -sparse vector in C 2 n .
T HEORY 3. C OMPRESSIVE R ECOVERY D EFENSE (CRD)
Bafna et al.
(2018) introduced a framework for defending machine learning classiﬁers against (cid:96) 0attacks.
We extend the framework to (cid:96) 2 and (cid:96) ∞ attacks.
The defense framework is based on the theory of compressive sensing, so we call it Compressive Recovery Defense (CRD).
We explain the idea behind the CRD framework in the context of an image classiﬁer.
Suppose x ∈ C n is a (ﬂattened) image vector we wish to classify.
But suppose an adversary perturbs x with a noise vector e ∈ C n .
We observe y = x + e , while x and e are unknown to us.
Let F ∈ C n × n be the Discrete Fourier Transform (DFT) matrix.
The Fourier coefﬁcients of x are ˆ x = Fx .
It is well-known that natural images are approximately sparse in the frequency domain.
So we expect that ˆ x is approximately sparse, meaning that ˆ x t ( k ) is small for some small k .
We can write
[Equation]
If (cid:107) e (cid:107) 2 ≤ η or (cid:107) e (cid:107) ∞ ≤ η , with η small (as in a (cid:96) 2 or (cid:96) ∞ -attack), then we can use an appropriate sparse recovery algorithm with y and F − 1 as input to compute a good approximation x # to ˆ x .
Precise error bounds are given in Section 3.3.
Then, since F is unitary, F − 1 x # will be a good approximation (i.e., reconstruction) of x = F − 1 ˆ x .
So we can feed F − 1 x # into the classiﬁer and expect to get the same classiﬁcation as we would have for x .
For an (cid:96) 0 -attack where e is t -sparse, the approach is only slightly different.
We set A =
[ F − 1 , I ] and write
[Equation]
so that [ˆ x h ( k ) , e ] T is ( k, t ) -sparse.
This structure lets us use a sparse recovery algorithm to compute a good approximation to ˆ x , as before.
Note that the same idea can be applied with audio signals or other types of data instead of images.
Moreover, the DFT can be replaced by any unitary transformation F such that ˆ x =
Fx is approximately sparse.
For example, F may be the Cosine Transform,
Sine Transform, Hadamard Transform, or another wavelet transform.
The CRD framework for training and testing a classiﬁer is as follows.
For each training image x , we compute ˆ x h ( k ) =
( Fx ) h ( k ) , and then reconstruct the image x (cid:48) =
F − 1 ˆ x h ( k ) .
We then add both x and x (cid:48) to the training set and train the network.
Given a (potentially adversarial) test image y , we ﬁrst use a sparse recovery algorithm to compute an approximation x # to ˆ x , then we compute the reconstructed image y (cid:48)
=
F − 1 x # and feed it into the network for classiﬁcation.
3. R ECOVERY A LGORITHMS
We provide the recovery algorithms used in this section.
For (cid:96) 0 -attacks, we set A =
[ F − 1 , I ] as in (2).
Against (cid:96) 2 or (cid:96) ∞ -attacks, we take A = F − 1 as in (1).
Procedure: IHT ( y, A, k, t, T )
Input
, and positive integers x [
=for i := 0 to T do
[Equation]
return
[-Procedure: DS ( y, A, η ). return x # Against (cid:96) 
 -attacks, we set A =-][Equation]
[Equation] [Equation]
The IHT algorithm above is used to defend against (cid:96) 0 -norm attacks.
It is adapted to the structure of our problem as it uses the thresholding operation h ( k,t ) that produces ( k, t ) -sparse vectors.
This structured IHT was ﬁrst considered in Baraniuk et al.
It gives better theoretical guarantees and practical performance in our CRD application than the standard IHT, which would instead use the thresholding operation h ( k + t ) that produces ( k + t ) -sparse vectors.
Note that Algorithm 1 works due to the sparsity of the attack vector which is only guaranteed in the (cid:96) 0 attack case, therefore we only use Algorithm 1 for (cid:96) 0 -norm attacks. We note that the results of Theorem 1 allow for values of k and t greater than or equal to Theorem 2.2. of Bafna et al. Procedure: BP ( y, A, η ). We utilize BP for (cid:96) 0 and (cid:96) 2 norm attacks.
In the (cid:96) 0 norm case, BP allows us to provide recovery guarantees for larger values of k and t than those in (3) and (4). For instance, in the case of MNIST and Fashion-MNIST, IHT (equation (4) of Theorem 1) allows us to set k = 4 and t = 3 , whereas BP (equation (7) of Theorem 2) allows us to set k = 8 and t = 8 . In the case of (cid:96) 2 norm attacks, BP is well suited to the problem as unitary matrices are isometries in (cid:96) 2 norm and therefore BP provides good recovery guarantees.
Procedure: DS ( y, A, η ). Input: y ∈ C m , A ∈ C m × N , and η ≥ 0 . x # = arg min z ∈ C N (cid:107) [Table]
1 subject to
[Table] A ∗ ( Az − y ) (cid:107) ∞ ≤ √ nη, (cid:107) Az − y (cid:107) ∞ ≤ η return [Table] We utilize DS for (cid:96) ∞ norm attacks.
The standard Dantzig Selector algorithm does not have the additional constraint (cid:107) Az − y (cid:107) ∞ ≤ η .
Our modiﬁed Dantzig Selector includes this constraint for the following reason.
In our application, A = F − 1 and we want the reconstruction
Ax # = F − 1 x # to be close to x , so that they are classiﬁed identically.
Thus, we want (cid:107)
Ax # − x (cid:107) ∞ to be small.
Note, for any z ∈ C N , (cid:107)
Az − x (cid:107) ∞ ≤ (cid:107) Az − y (cid:107) ∞ + (cid:107) x
− y (cid:107) ∞ .
In an (cid:96) ∞ -attack, (cid:107) x − y (cid:107) ∞
=
(cid:107) e (cid:107) ∞ is already small.
Thus it sufﬁces to require (cid:107) Az − y (cid:107) ∞ is small.
We experimentally illustrate the improvement in reconstruction due to the additional constraint in Section 4.3 (Figure 4, Table 4).
Remarks on Reverse-Engineered Attacks.
As observed in Bafna et al.
(2018), x [0] in Algorithm 1, can be initialized randomly to defend against a reverse-engineered attack.
In the case of Algorithm 2 and Algorithm 3, the minimization problems can be posed as semi-deﬁnite programming problems. If solved with interior point methods, one can use random initialization of the central path parameter and add randomness to the stopping criterion. This makes recovery non-deterministic and consequently non-trivial to create a reverse-engineered attack.
3. R ECOVERY G UARANTEES
Let F ∈ C n × n be a unitary matrix and I ∈ C n × n be the identity matrix.
Deﬁne A =
[ F, I ] ∈ C n × 2 n and let y =
A [ˆ x, e ] T = F ˆ x + e , where ˆ x, e ∈ C n .
Let 1 ≤ k, t ≤ n be integers.
Theorem 1 ( (cid:96) 0 -norm IHT) .
Assume |
F ij | 2 ≤ cn and e is t -sparse.
Let x [ T +1] =
IHT ( y, A, k, t, T ) where x [ T +1] = (cid:2)
ˆ x [ T +1] , e [ T +1] (cid:3) T ∈ C 2 n with ˆ x [ T +1] , e [ T +1] ∈ C n .
[-Deﬁne ρ := √ 27 (cid:113) cktn , τ (1 − ρ ) : = √(cid:114) 1 + 2 (cid:113) cktn . If 0 < ρ < 1 , then: (cid:107) ˆ x [ T +1] − ˆ x h ( k ) (cid:107) 2 ≤ ρ ( T +1) (cid:113) (cid:107) ˆ x h ( k ) (cid:107) 
-][Table]
[-+ (cid:107) e (cid:107) 
-][Equation]
We observe that (3) and (4) allow larger values of k and t than Theorem 2.2 of Bafna et al.
[-+log( √ (cid:107) ˆ x h ( k ) (cid:107) 
 + (cid:107) e (cid:107) 22 ) log(1 /ρ ) (cid:19) , we get: (cid:107) ˆ x [ T +1] − ˆ x h ( k ) (cid:107) 2 ≤ τ (cid:107) ˆ x t ( k ) (cid:107) 2 + (cid:15) (4) Now deﬁne ρ := 2 √ 2 (cid:113) cktn , τ (1 − ρ ) :-]This is because the authors of Bafna et al.
(2018) prove their results using Theorem 4 of Baraniuk et al.
(2010), which is more restrictive on the values of k and t .
We do use Theorem 4 of Baraniuk et al.
(2010), instead we prove the RIP property in Theorem 7 and then use its result with Theorem 6.18 of Foucart & Rauhut (2017) to get (3) and (4).
We further extend this in (5) and (6), which provide recovery guarantees for larger values of k and t than (3) and (4), at the expense of the extra error term (cid:107) e (cid:107) 2 .
Next, we consider the recovery error for (cid:96) 0 -norm bounded noise with BP instead of IHT.
Providing bounds for BP is useful as there are cases when BP provides recovery guarantees against a larger (cid:96)noise budget than IHT.
We note that since Algorithm 2 is not adapted to the structure of the matrix
A , one can expect the guarantees to be weaker.
Theorem 2 ( (cid:96) 0 -norm BP) .
Assume |
F ij | 2 ≤ cn .
Deﬁne[-δ k,t = (cid:114) ckt n , β = (cid:114) max { k, t } c n , θ = √ k + t (1 − δ k,t ) β, τ = (cid:112) 
-]
[Equation]
If 0 < δ k,t < 1 and 0 < θ < 1 , then for x # = BP ( y, A, (cid:107) ˆ x t ( k ) (cid:107) 2 ) , we have the error bound (cid:107) ˆ x # − ˆ x h ( k ) (cid:107)
[Equation]
[Equation]
where we write x # = [ˆ x # , e # ] T ∈ C 2 n with ˆ x # , e # ∈ C n .
Our third result covers the case when the noise is bounded in (cid:96) 2 -norm.
Theorem 3 ( (cid:96) 2 -norm BP) .
If (cid:107) e (cid:107) 2 ≤ η , then for x # = BP ( y, F, η ) , we have the error bound
[Equation]
Finally, we provide recovery guarantees when the noise is bounded in (cid:96) ∞ -norm.
Theorem 4 ( (cid:96) ∞ -norm DS) .
If (cid:107) e (cid:107) ∞ ≤ η , then for x # = DS ( y, F, η ) , we have the error bound
[Equation]
[Equation] [Equation] 3. R ELATED W ORK
The authors of Bafna et al.
(2018) introduced the CRD framework which inspired this work.
In fact, Theorem 2.2 of Bafna et al.
(2018) also provides an approximation error bound for recovery via IHT.
Note that a hypothesis t = O ( n/k ) has accidentally been dropped from their Theorem 2.2, though it appears in their Lemma 3.6.
By making the implied constants explicit in the argument of
Bafna et al.
(2018), one sees that their Theorem 2.2 is essentially the same as (3) and (4) in Theorem 1 above.
For more details, see the proof of Theorem 1 in Appendix A. Note that our recovery error bounds for IHT in (5) and (6) of Theorem 1 do not have analogs in Bafna et al.
They hold for larger values of k and t at the expense of the additional error term (cid:107) e (cid:107) 2 .
Other works that provide guarantees include (Hein & Andriushchenko (2017)) and (Cisse et al.
(2017)) where the authors frame the problem as one of regularizing the Lipschitz constant of a network and give a lower bound on the norm of the perturbation required to change the classiﬁer decision.
The authors of Sinha et al.
(2017) use robust optimization to perturb the training data and provide a training procedure that updates parameters based on worst case perturbations.
A similar approach to (Sinha et al.
(2017)) is (Wong & Kolter (2017)) in which the authors use robust optimization to provide lower bounds on the norm of adversarial perturbations on the training data.
In Lecuyer et al.
(2018), the authors use techniques from Differential Privacy (Dwork et al.
(2014))in order to augment the training procedure of the classiﬁer to improve robustness to adversarial inputs.
Another approach using randomization is Li et al.
(2018) in which the authors add i.i.d.
Gaussian noise to the input and provide guarantees of maintaining classiﬁer predictions as long as the (cid:96) 2 -norm of the attack vector is bounded by a function that depends on the output of the classiﬁer.
Most defenses against adversarial inputs do not come with theoretical guarantees.
Instead, a large body of research has focused on ﬁnding practical ways to improve robustness to adversarial inputs by either augmenting the training data (Goodfellow et al.
, using adversarial inputs from various networks (Tram ` er et al.
(2017)), or by reducing the dimensionality of the input (Xu et al.
For instance, Madry et al.
(2017) use robust optimization to make the network robust to worst case adversarial perturbations on the training data.
However, the effectiveness of their approach is determined by the amount and quality of training data available and its similarity to the distribution of the test data.
An approach similar to ours but without any theoretical guarantees is (Samangouei et al.
In this work, the authors use Generative Adversarial Networks (GANs) to estimate the distribution of the training data and during inference, use a GAN to reconstruct a non-adversarial input that is most similar to a given test input.
We now provide a brief overview on the ﬁeld of compressive sensing.
The ﬁeld of compressive sensing was initiated with the work of Cand ` es et al.
(2006) and Donoho et al.
(2006) in which the authors studied the problem of reconstructing sparse signals using only a small number of measurements with the choice of a random matrix.
The reconstruction was performed using (cid:96) 1 -minimization which was shown to produce sparse solutions even in presence of noise; see also Donoho & Elad (2003; 2006); Donoho & Huo (2001). Some of the earlier work in extending compressive sensing to perform stable recovery with deterministic matrices was done by Candes & Tao (2005) and Candes et al. (2006), where the authors showed that recovery of sparse vectors could be performed as long as the measurement matrix satisﬁed a restricted isometry hypothesis.
Blumensath & Davies (2009) introduced IHT as an algorithm to recover sparse signals which was later modiﬁed in Baraniuk et al.
(2010) to reduce the search space as long as the sparsity was structured.
The standard DS algorithm was introduced in Candes et al.
(2007) in order to perform stable recovery in the presence of (cid:96) ∞ noise.
All of our experiments are conducted on CIFAR-10 (Krizhevsky (2009)), MNIST (LeCun), and
Fashion-MNIST (Xiao et al.
datasets with pixel values of each image normalized to lie in [0 , 1] .
Each experiment is conducted on a set of 1000 points sampled uniformly at random from the test set of the respective dataset.
For every experiment, we use the Discrete Cosine Transform (DCT) and the Inverse Discrete Cosine Transform (IDCT) denoted by the matrices F ∈ R n × n and
F T ∈ R n × n respectively.
That is, for an adversarial image y ∈ R √ n ×√ n , such that, y = x + e , we let ˆ x =
Fx , and x = F T ˆ x , where x, ˆ x ∈ R n and e ∈ R n is the noise vector.
For an adversarial image [Table] y ∈ R √ n ×√ n × c , that contains c channels, we perform recovery on each channel independently by considering y m =
x m + e m , where ˆ x m =
Fx m , x m =
F T ˆ x m for m = 1 , . . .
, c .
The value k denotes the number of largest (in absolute value)
DCT coefﬁcients used for reconstruction of each channel, and the value t denotes the (cid:96) 0 noise budget for each channel.
We implement Algorithmand Algorithm 3 using the open source library CVXPY (Diamond & Boyd (2016)).
We now outline the neural network architectures used for experiments in Section 4.1 and 4.2.
For
CIFAR-10, we use the network architecture of He et al.
(2016) while the network architecture for
MNIST and Fashion-MNIST datasets is provided in Table 5 of the Appendix.
We train our networks using the Adam optimizer for CIFAR-10 and the AdaDelta optimizer for MNIST and FashionMNIST.
In both cases, we use a cross-entropy loss function.
We train the each neural network according to the CRD framework stated in Section 3.1.
The code to reproduce our experiments is available here: https://github.com/anonymousiclrcompressive/iclr2020 .
4. D EFENSE AGAINST (cid:96) 0 - NORM ATTACKS
This section is organized as follows:
ﬁrst we examine CRD against the One Pixel Attack (OPA)
(Su et al.
for CIFAR-10.
We only test the attack on CIFAR-10 as it is most effective against natural images and does not work well on MNIST or FASHION-MNIST.
We note that this attack satisﬁes the theoretical constraints for t provided in Theorem 1, hence allowing us to test how well
CRD works within existing guarantees.
Once we establish the effectiveness of CRD against OPA, we then test it against two other (cid:96)
-norm bounded attacks: Carlini and Wagner (CW) (cid:96) 0 -norm attack (Carlini & Wagner (2017)) and the Jacobian based Saliency Map Attack (JSMA) (Papernot et al.
4.1. O NE P IXEL A TTACK
We ﬁrst resize all CIFAR-10 images to 125 × 125 × 3 while maintaining aspect ratios to ensure that the data falls under the hypotheses of Theorem 1 even for large values of k .
The OPA attack perturbs exactly one pixel of the image, leading to an (cid:96) 0 noise budget of t = 3 per image.
The (cid:96)noise budget of t = 3 per image allows us to use k = 275 per channel.
Table 1 shows that OPA is very effective against natural images and forces the network to misclassify all previously correctly classiﬁed inputs.
Original
OPA
IHT-Rec We test the performance of CRD in two ways: a) reconstruction quality b) network performance on reconstructed images.
In order to analyse the reconstruction quality of Algorithm 1, we do the following: for each test image, we use OPA to perturb the image and then use Algorithm 1 to approximate its largest (in absolute value) k
= 275 DCT co
efﬁcients.
We then perform the IDCT on these recovered co-efﬁcients to generate reconstructed images.
We illustrate reconstruction on a randomly selected image from the test set in Figure 1. [Table]
Noting that Algorithm 1 leads to high quality reconstruction [Table] we now test whether network accuracy improves on these reconstructed images.
To do so, we feed these reconstructed images as input to the network and report its accuracy in Table 1.
We note that network performance does indeed improve as network accuracy goes from 0 .
0% to 71 .
8% using Algorithm 1.
Therefore, we conclude that CRD provides a substantial improvement in accuracy in against OPA. [Table]
[Equation] [Table] [Equation] AND
[Equation]
Having established the effectiveness of CRD against OPA [Table] we move onto the CW (cid:96) 0 -norm attack and JSMA.
We note that even when t is much larger than the hypotheses of Theorem 1 and Theorem [Table] we ﬁnd that Algorithms 1 and 2 are still able to defend the network.
We hypothesize that this maybe related to the behavior of the RIP of a matrix for “most” vectors as opposed to the RIP for all vectors, and leave a more rigorous analysis for a follow up work.
[Figure]
We follow the procedure described in Section 4.1.1 to analyze the quality of reconstructions for
Algorithm 1 and Algorithm 2 in Fig 2.
In each case it can be seen that both algorithms provide high quality reconstructions for values of t that are well outside the hypotheses required by Theorem 1 and
Theorem 2.
We report these t values and the improvement in network performance on reconstructed adversarial images using CRD in Table 2.
4. D EFENSE AGAINST (cid:96) 2 - NORM ATTACKS
In the case of (cid:96) 2 -norm bounded attacks, we use the CW (cid:96) 2 -norm attack (Carlini & Wagner (2017)) and the Deepfool attack (Moosavi-Dezfooli et al.
as they have been shown to be the most powerful.
We note that Theorem 3 does not impose any restrictions on k or t and therefore the guarantees of equations (8) and (9) are applicable for recovery in all experiments of this section.
The reconstruction quality is shown in Figure 3.
It can be noted that reconstruction using Algorithm 2 is of high quality for all three datasets.
In order to check whether this high quality reconstruction [Table] [Table] also leads to improved performance in network accuracy, we test each network on reconstructed images using Algorithm 2.
We report the results in Table 3 and note that Algorithm 2 provides a substantial improvement in network accuracy for each dataset and each attack method used.
4. D EFENSE AGAINST (cid:96) ∞ - NORM ATTACKS
For (cid:96) ∞ -norm bounded attacks [Table] we use the BIM attack (Kurakin et al.
as it is has been shown to be very effective and also allows us to control the (cid:96) ∞ -norm of the attack vector explicitly.
We note that while the CW (cid:96) ∞ -norm attack (Carlini & Wagner (2017)) has the ability to create attack vectors with (cid:96) ∞ -norm less than or equal to BIM, it is computationally expensive and also does not allow one to pre-specify a value for the (cid:96) ∞ -norm of an attack vector.
Therefore, we limit our experimental analysis to the BIM attack.
Note that for any attack vector e , (cid:107) e (cid:107) 2 ≤ √ n (cid:107) e (cid:107) ∞ hence allowing (cid:96) ∞ - norm attacks to create attack vectors with large (cid:96) 2 -norm.
Therefore, we could expect reconstruction quality and network accuracy to be lower when compared to (cid:96) 2 -norm attacks. [Figure]
[Table] In ﬁgure 4, we compare the reconstruction quality of images reconstructed with Algorithm 3 to those reconstructed using DS without the additional constraint.
As can be noted from the ﬁgure, images reconstructed using DS without the additional constraint may not produce meaningful images. This is also reﬂected in Table 4, which shows that the accuracy of the network is roughly random on images reconstructed without the additional constraint. We show examples of original images, adversarial images, and their reconstructions using Algorithm 3 in Figure 5. Finally, we report the network performance on reconstructed inputs using Algorithm 3 in Table 4 and also compare this to the performance on inputs reconstructed using DS without the additional constraint.
We note that Algorithm 3 provides an increase in network performance against reconstructed adversarial inputs.
However, the improvement in performance is not as substantial as it was against (cid:96) 0 or (cid:96) 2 -norm attacks.
[Table]
C ONCLUSION
We provided recovery guarantees for corrupted signals in the case of (cid:96) 0 -norm, (cid:96) 2 -norm, and (cid:96) ∞ - norm bounded noise.
We were able to utilize these results in CRD and improve the performance of neural networks substantially in the case of (cid:96) 0 -norm, (cid:96) 2 -norm and (cid:96) ∞ -norm bounded noise.
While (cid:96)
-norm attacks don’t always satisfy the constraints required by Theorem 1 and Theorem 2, we showed that CRD is still able to provide a good defense for values of t much larger than allowed in the guarantees.
The guarantees of Theorem 3 and Theorem 4 were applicable in all experiments and
CRD was shown to improve network performance for all attacks.
A A PPENDIX A. R ESTRICTED I SOMETRY P ROPERTY
We ﬁrst establish the restricted isometry property for certain structured matrices.
First, we give some deﬁnitions.
Deﬁnition 5.
Let A be a matrix in C m × N , let M ⊆ C N , and let δ ≥ 0 .
We say that A satisﬁes the
M -restricted isometry property (or M-RIP) with constant δ if
[Equation]
for all x ∈ M .
Deﬁnition 6.
We deﬁne M k to be the set of all k -sparse vectors in C N and similarly deﬁne M k,t to be the set of ( k, t ) -sparse vectors in C 2 n .
In other words, M k,t is the following subset of C 2 n :
[Equation]
We deﬁne S k,t to be the following collection of subsets of { 1 , . . .
, 2 n } :
[Equation]
Note that S k,t is the collection of supports of vectors in M k,t .
Theorem 7.
Let A =
[ F I ] ∈ C n × 2 n , where F ∈ C n × n is a unitary matrix with | F ij | 2 ≤ cn and
I ∈ C n × n is the identity matrix.
Then
[Equation]
for all x ∈ M k,t .
In other words, A satisﬁes the M k,t -RIP property with constant
[Equation]
Proof.
In this proof, if B denotes an matrix in C n × n , then λ 1 ( B ) , . . .
, λ n ( B ) denote the eigenvalues of B ordered
so that | λ 1 ( B ) | ≤ · · · ≤ | λ n ( B ) | .
It sufﬁces to ﬁx an S = S 1 ∪ S 2 ∈ S k,t and prove (12) for all non-zero x ∈ C S .
Since A ∗ S A S is normal, there is an orthonormal basis of eigenvectors u 1 , . . .
, u k + t for A ∗ S A S , where u i corresponds to the eigenvalue
λ
i ( A ∗ S A S ) .
For any non-zero x ∈ C S , we have x = (cid:80) k
+ t i =
c i u i for some c i ∈ C , so
[Equation]
Thus it will sufﬁce to prove that | λ i ( A ∗ S A S ) − 1 | ≤ (cid:113) cktn for all i .
Moreover,
[Equation]
(14) where the last equality holds because A ∗ S A S − I is normal.
By combining (13) and (14), we see that (12) will hold upon showing that the eigenvalues of ( A ∗ S A S − I ) ∗ ( A ∗ S A S − I ) are bounded by ckt/n .
So far we have not used the structure of A , but now we must.
Observe that ( A ∗ S A S − I ) ∗ ( A ∗ S
A S − I ) is a block diagonal matrix with two diagonal blocks of the form X ∗ X and XX ∗ .
Therefore the three matrices ( A ∗ S
A S − I ) ∗ ( A ∗ S A S − I ) , X ∗ X , and XX ∗ have the same non-zero eigenvalues.
Moreover,
X is simply the matrix F S 1 with those rows not indexed by S 2 deleted.
The hypotheses on F imply that the entries of X ∗ X satisfy | ( X ∗ X ) ij | ≤ ctn .
So the Gershgorin disc theorem implies that each eigenvalue λ of X ∗ X and (hence) of ( A ∗ S A S − I ) ∗ ( A ∗ S A S − I ) satisﬁes | λ | ≤ cktn .
A. I TERATIVE H ARD T HRESHOLDING
First we present Theorem 8 and then use it to prove Theorem 1.
Theorem 8.
Let A ∈ C n × 2 n be a matrix.
Let 1 ≤ k, t ≤ n be positive integers and suppose δ 3 is a M 3 k, 3 t -RIP constant for A and that δ 2 is a M 2 k, 2 t -RIP constant for A .
Let x ∈ C 2 n , r ∈ C n , y =
Ax + r , and S ∈ S k,t .
Letting x [ T +1] =
IHT ( y, A, k, t, T ) , if δ 3 < 1 / √ 3 , then we have the approximation error bound
[Equation]
where ρ := √ 3 δ 3 < 1 and (1 − ρ ) τ = √ 3 √ 1 + δ 2 ≤ 2 .
Thus, the ﬁrst term on the right goes to 0 as T goes to ∞ .
Theorem 8 is a modiﬁcation of Theorem 6.18 of Foucart & Rauhut (2017).
More speciﬁcally,
Theorem 6.18 of Foucart & Rauhut (2017) considers M 3 k , M 2 k , and S k in place of M 3 k, 3 t
and
M 2 k, 2 t and S k,t and any dimension N in place of 2 n .
The proofs are very similar, so we omit the proof of Theorem 8.
We will now prove a lemma that will be required for the proof of Theorem 1.
For the proof of Lemma 9 and Theorem 1, we use the following convention: let A ∈ C m × N be a matrix, then, we denote by ( A ) S , the m × N matrix that is obtained by starting with A and zeroing out the columns indexed by S .
Note that ( A ) S =
A − ( A ) S .
Lemma 9.
Let F ∈ C n × n be a unitary matrix with | F ij | 2 ≤ cn and let S ⊆
[ n ] be a index set with | S | = t .
Then for any k -sparse vector z ∈ C n , we have:
[Equation]
Proof of Lemma 9.
First note that ( F ∗ ) S ∈ C n × n contains only t non-zero columns since | S | =
t
Therefore, we have | (( F ∗ ) S F ) ij | ≤ tcn since | F ij | 2 ≤ cn .
Further, since the non-zero columns of ( F ∗ ) S are orthogonal to each other, we get (( F ∗ ) S ) ∗ ( F ∗ )
S
=
( I ) S , where I ∈ C n × n is the identity matrix.
Using this, we have for any w ∈ C n ,
[Equation]
F
[Equation]
S
[Equation]
|
Now let V ⊆
[ n ] be any index set with cardinality k , that is | V | =
k and let z ∈ C n be any vector supported on V .
We then get,
[Equation]

 (cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12) ≤ (cid:88)
[Equation]
where we use the fact that z is k -sparse for the last inequality.
Now we provide the proof for Theorem 1.
Proof of Theorem 1 .
Theorem 7 implies that the statement of Theorem 8 holds with δ
[Equation]
= (cid:113)
[Equation]
[Equation]
t n and δ 2 = (cid:113) c · 2 k · 2 t n .
Noting that y
=
A [ˆ x h ( k ) e ] T + F ˆ x t ( k ) , where [ˆ x h ( k ) e ] T ∈
M k,t , set x [ T +1] =
IHT ( y, A, k, t, T ) and apply Theorem 8 with x =
[ˆ x h ( k ) e ] T , r = F ˆ x t ( k ) , and
S = supp ( x ) .
Letting x
[ T +1] =
[ˆ x [ T +1] e [ T +1] ] T , use the facts that (cid:107) ˆ x [ T +1] − ˆ x h ( k ) (cid:107) 2 ≤ (cid:107) x [ T +1] − x S (cid:107) 2 and (cid:107) F ˆ x t ( k ) (cid:107)
= (cid:107) ˆ x t ( k ) (cid:107) 2 .
That will give (3).
Letting T =
[Equation]
gives
[Equation]
, which can be substituted in (3) to get (4).
Noting that || e [ T ] − e || 2 ≤ τ || ˆ x t ( k ) ||
2 + (cid:15) , we can use the same reasoning as used in Bafna et al.
(2018) to get:
[Equation]
which are the essentially the same as the results of Theorem 2.2 in Bafna et al.
Now we prove (5).
Write x [ T ] =
( z [ T ] ) h ( k,t ) , where z [ T ] = x [ T − 1]
+ A ∗ ( y − Ax
[ T − 1] ) .
Further, write z [ T ] =
[ z [ T ]z [ T ] 2 ] T ∈ C 2 n , where z [ T ] 1 , z [ T ]∈ C n .
Note that ˆ x [ T ] =
( z [ T ] 1 ) h ( k ) .
Therefore, we have z [ T ]= F ∗ ( y − e
[ T − 1] ) , where e [ T − 1] =
( y − F ˆ x [ T − 2] ) h ( t ) .
Now let S be the set of indices selected by the hard thresholding operation h ( t ) to get e [ T − 1] .
Then observe that z [ T ]=
F ∗ ( y − ( y − F ˆ x [ T − 2] ) S ) .
Next, note that (cid:107)
z
[ T ] 1 − ˆ x [ T ] (cid:107) 22 ≤ (cid:107)
z
[ T ] 1 − ˆ x h ( k ) (cid:107) 22 as ˆ x [ T ] is a best k -sparse approximation to z [ T ] 1 .
We can thus write,
[Equation]
Therefore, we have,
[Equation] [Equation]
If (cid:107) ˆ x [ T ] − ˆ x h ( k ) (cid:107) 2 > 0 , then (cid:107) ˆ x [ T ] − ˆ x h ( k ) (cid:107) 2 ≤ 2 (cid:107) z
[ T ] 1 − ˆ x h ( k ) (cid:107) 2 .
Now note that,
[Equation]
Using the fact that ( F ∗ ) S = F ∗ − ( F ∗ ) S
[Equation]
we can simplify the above to get:
[Equation]
Therefore,
[Equation]
where we use (cid:107) ( F ∗ ) S (cid:107)
→ 2 ≤ (cid:107) F ∗ (cid:107) 2 → 2 = 1 .
Now since ˆ x h ( k ) − ˆ x [ T − 2] is 2 k -sparse
[Equation]
we can use the result of Lemma 9 to get:
[Equation]
e (cid:107) 2 (cid:1) +(cid:32)(cid:114) 2 ktc n (cid:33) (cid:107) ˆ x
[ T − 2] − ˆ x h ( k ) (cid:107)
Now let ρ = 2 √ 2 (cid:113) ktcn , τ (1 − ρ ) = 2 and note that if ρ < 1 , we can use induction on T to get (5).
Then for any 0 < (cid:15) < 1 and any T ≥ (cid:16) log(1 /(cid:15) )
+log( (cid:107)
ˆ x h ( k ) (cid:107) 2 ) log(1 /ρ ) (cid:17) , we have ρ T ( (cid:107) ˆ x h ( k ) (cid:107) 2 ) ≤ (cid:15) which gives us (6).
A. B ASIS P URSUIT
Deﬁnition 10.
The matrix A ∈ C m × N satisﬁes the robust null space property with constants 0 < ρ < 1 , τ > 0 and norm (cid:107) · (cid:107) if for every set S ⊆
[ N ] with card ( S ) ≤ s and for every v ∈ C N we have
[Equation]
Deﬁnition 11.
The matrix A ∈ C m × N satisﬁes the (cid:96) q robust null space property of order s with constants
< ρ < 1 , τ > 0 and norm (cid:107) · (cid:107) if for every set S ⊆
[ N ] with card ( S ) ≤ s and for every v ∈ C N we have
[Equation]
Note that if q = 1 then this is simply the robust null space property.
The proof of Theorem 2 requires the following theorem (whose full proof is given in the Foucart &
Rauhut (2017)).
Theorem 12 (Theorem 4.33 in Foucart & Rauhut (2017)) .
Let a 1 , . .
. , a N be the columns of A ∈ C m × N , let x ∈ C N with s largest absolute entries supported on S , and let y =
Ax + e with (cid:107) e (cid:107) 2 ≤ η .
For δ, β, γ, θ, τ ≥ 0 with δ < 1 , assume that:
[Equation]
and that there exists a vector u
= A ∗ h ∈ C N with h ∈ C m such that
[Equation]
(cid:107) 2 ≤ γ, (cid:107) u S (cid:107) ∞ ≤ θ, and (cid:107) h (cid:107) 2 ≤ τ √ s.
If ρ := θ + βγ (1 − δ ) < 1 , then a minimizer x # of (cid:107) z (cid:107) 1 subject to (cid:107) Az − y (cid:107) 2 ≤ η satisﬁes: (cid:107) x # − x (cid:107) 2 ≤
[Equation]
(cid:19)
+
[Equation]
µ (cid:19) η where µ := √ 1+ δ 1 − δ and sgn ( x ) i =   0 , x i =1 , x i >− 1 .
x i <.
Lemma 13.
Let A ∈ C n × 2 n , if (cid:107) Ax (cid:107) 22 ≤ (1+ δ ) (cid:107) x (cid:107) 22 for all x ∈ M k,t , then, (cid:107) A ∗ S
A S − I (cid:107) 2 → 2 ≤ δ , for any S ∈ S k,t .
Proof.
Let S ∈ S k,t be given.
Then for any x ∈ C S , we have
[Equation]
We can re-write this as :
[Equation] [Equation]
22 =
[Equation]
−
[Equation]
Noting that A ∗ S A S − I is Hermitian, we have:
[Equation]
Proof of Theorem 2 .
We will derive (7) by showing that the matrix A satisﬁes all the hypotheses in
Theorem 12 for every vector in M k,t .
First note that by Theorem 7, A satisﬁes the M k,t - RIP property with constant δ k,t := (cid:113) ckt n .
Therefore, by Lemma 13, for any S ∈ S k,t , we have (cid:107) A ∗ S
A S − I (cid:107) 2 → 2 ≤ δ k,t .
Since A ∗ S A S is a positive semi-deﬁnite matrix, it has only non-negative eigenvalues that lie in the range [1 − δ k,t , 1 + δ k,t ] .
Since δ k,t < 1 by assumption, A ∗ S A S is injective.
Thus, we can set: h = A S ( A ∗ S A S ) − 1 sgn ( x S ) and get:
[Equation]
where τ = √ 1+ δ k,t 1 − δ k,t
and we have used the following facts: since (cid:107) A ∗ S
A S − I (cid:107) 2 → 2 ≤ δ k,t < 1 , we get that (cid:107) ( A ∗ S A S ) − 1 (cid:107) 2 → 2 ≤ 1 1 − δ k,t and that the largest singular value of A S is less than (cid:112) 1 + δ k,t .
Now let u
=
A ∗ h , then (cid:107) u S − sgn ( x S ) (cid:107) 2 = 0 .
Now we need to bound the value (cid:107) u S (cid:107) ∞ .
Denoting row j of A ∗ S
A S by the vector v j , we see that it has at most max { k, t } non-zero entries and that | ( v j ) l | 2 ≤ cn for l = 1 , . . .
, ( k + t ) .
Therefore, for any element ( u S ) j , we have:
[Equation]
Deﬁning β := (cid:113) max { k,t } c n and θ := √ k + t 1 − δ k,t β , we get (cid:107) u S (cid:107) ∞ ≤ θ < 1 and also observe that max l ∈ S (cid:107) A ∗ S a l (cid:107) 2 ≤ β .
Therefore, all the hypotheses of Theorem 12 have been satisﬁed.
Note that
[Equation] [Equation]
, Therefore, setting x # = BP ( y, A, (cid:107) ˆ x t ( k ) (cid:107) 2 ) , we use the fact (cid:107) F ˆ x t ( k ) (cid:107) 2 =
[Equation]
ˆ x t ( k ) (cid:107) 2 combined with the bound in Theorem 12 to get (7):
[Equation]
where we write x # = [ˆ x # , e # ] T with ˆ x # , e # ∈ C n .
We now focus on proving Theorem 3.
In order to do so, we will need some lemmas that will be used in the main proof.
Lemma 14.
If a matrix A ∈ C m × N satisﬁes the (cid:96) 2 robust null space property for S ⊂
[ N | , with card ( S ) =
s , then it satisﬁes the (cid:96) 1 robust null space property for S with constants 0 < ρ < 1 , τ (cid:48) :
=
τ √ s > 0 .
Proof.
For any v ∈ C N , (cid:107) v S (cid:107) 2 ≤ ρ √ s (cid:107) v ¯ S (cid:107)
+ τ (cid:107) Av (cid:107) .
Then, using the fact that (cid:107) v S (cid:107) 1 ≤ √ s (cid:107) v S (cid:107) 2 , we get: (cid:107) v S (cid:107) 1 ≤ ρ (cid:107) v ¯ S (cid:107) 1 + τ √ s (cid:107) Av (cid:107) .
Lemma 15 (Theorem 4.20 in Foucart & Rauhut (2017)) .
If a matrix A ∈ C m × N satisﬁes the (cid:96)robust null space property (with respect to (cid:107) .
(cid:107) ) and for 0 < ρ < 1 and τ > 0 for S ⊂
[ N | , then:
[Equation]
for all z, x ∈ C N .
Lemma 16 (Proposition 2.3 in Foucart & Rauhut (2017)) .
For any p > q > 0 and x ∈ C n ,
[Equation]
Proof of Theorem 3 .
Let 0 < ρ < 1 be arbitrary.
Since F is a unitary matrix, for any S ⊆ [ n ] and v ∈ C n , we have
[Equation]
where τ
= 1 .
Now let S ⊆
[ n ] such that card ( S ) ≤ k .
Then, F satisﬁes the (cid:96) 2 robust null space property for S .
Next, using Lemma 14 we get (cid:107) v S (cid:107) 1 ≤ ρ (cid:107) v ¯ S (cid:107) 1 + τ √ k (cid:107) Fv (cid:107) 2 for all v ∈ C n .
Now let x # = BP ( y, F, η ) , then we know (cid:107) x
# (cid:107) 1 ≤ (cid:107) ˆ x (cid:107) 1 .
Fixing S ⊆
[ n ] to be the support of ˆ x h ( k ) and using Lemma 15 , we get:
[Table] [Table]
Letting ρ → 0 and recalling that τ
= 1 gives (8).
Now let S be the support of ( x # − ˆ x ) h
( k ) .
Note (cid:107)
[Table]
x # − ˆ x ) S (cid:107) 2 = inf z ∈ M k (cid:107) ( x # − ˆ x ) − z (cid:107) 2 .
Then, using Lemma 16 and (17), we see that
[Equation]
η
Recalling τ
= 1 and letting ρ → 0 gives the desired result.
A. D ANTZIG S ELECTOR
Next we introduce the Dantzig Selector algorithm with an additional constraint.
We ﬁrst prove its recovery guarantees for (cid:96) ∞ -norm and then explain the reasoning behind the additional constraint.
Proof of Theorem 4 .
The proof follows the same structure as the proof of Theorem 3.
Therefore we provide a sketch and leave out the complete derivation.
Let 0 < ρ < 1 be arbitrary.
Since F is a unitary matrix
[Equation]
for any S ⊆ [ n ] and v ∈ C n , we have
[Equation]
The rest of the argument is the same as in the proof of Theorem 3.