The Robust Manifold Defense: Adversarial Training using Generative Models

Abstract

We propose a new type of attack for finding adversarial examples for image classifiers. Our method exploits spanners, i.e. deep neural networks whose input space is low-dimensional and whose output range approximates the set of images of interest. Spanners may be generators of GANs or decoders of VAEs. The key idea in our attack is to search over latent code pairs to find ones that generate nearby images with different classifier outputs. We argue that our attack is stronger than searching over perturbations of real images. Moreover, we show that our stronger attack can be used to reduce the accuracy of Defense-GAN to 3\%, resolving an open problem from the well-known paper by Athalye et al. We combine our attack with normal adversarial training to obtain the most robust known MNIST classifier, significantly improving the state of the art against PGD attacks. Our formulation involves solving a min-max problem, where the min player sets the parameters of the classifier and the max player is running our attack, and is thus searching for adversarial examples in the {\em low-dimensional} input space of the spanner. All code and models are available at \url{https://github.com/ajiljalal/manifold-defense.git}

Added pseudo code for defense-gan break

References in corpus (24)

• Adam: A Method for Stochastic Optimization
• TensorFlow: Large-Scale Machine Learning on Heterogeneous Distributed Systems
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Deep Image Prior
• BEGAN: Boundary Equilibrium Generative Adversarial Networks
• Adversarial Feature Learning
• Synthesizing Robust Adversarial Examples
• Adversarially Learned Inference
• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• Robust Physical-World Attacks on Deep Learning Models
• The Space of Transferable Adversarial Examples
• Understanding Adversarial Training: Increasing Local Stability of Neural Nets through Robust Optimization
• On the (Statistical) Detection of Adversarial Examples
• Certifying Some Distributional Robustness with Principled Adversarial Training
• PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples
• Spatially Transformed Adversarial Examples
• MagNet: a Two-Pronged Defense against Adversarial Examples
• MagNet and "Efficient Defenses Against Adversarial Attacks" are Not Robust to Adversarial Examples
• Practical Black-Box Attacks against Machine Learning
• Generative Adversarial Trainer: Defense to Adversarial Perturbations with GAN
• Adversarial Example Defenses: Ensembles of Weak Defenses are not Strong
• YellowFin and the Art of Momentum Tuning
• Adversarial examples for generative models

Cited by in corpus (54)

• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Deep Image Prior
• Defense Against Adversarial Attacks Using Feature Scattering-based Adversarial Training
• A Review of Adversarial Attack and Defense for Classification Methods
• You Only Propagate Once: Accelerating Adversarial Training via Maximal Principle
• Security and Privacy Issues in Deep Learning
• Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbations
• Detecting and Diagnosing Adversarial Images with Class-Conditional Capsule Reconstructions
• Robust in Practice: Adversarial Attacks on Quantum Machine Learning
• Label-Consistent Backdoor Attacks
• Adversarially Robust Few-Shot Learning: A Meta-Learning Approach
• Defense Methods Against Adversarial Examples for Recurrent Neural Networks
• DARCCC: Detecting Adversaries by Reconstruction from Class Conditional Capsules
• Predify: Augmenting deep neural networks with brain-inspired predictive coding dynamics
• Dual Manifold Adversarial Robustness: Defense against Lp and non-Lp Adversarial Attacks
• Fast and Provable ADMM for Learning with Generative Priors
• An Inexact Augmented Lagrangian Framework for Nonconvex Optimization with Nonlinear Constraints
• Exploiting Excessive Invariance caused by Norm-Bounded Adversarial Robustness
• Combating Adversarial Attacks Using Sparse Representations
• Robustifying Models Against Adversarial Attacks by Langevin Dynamics
• Featurized Bidirectional GAN: Adversarial Defense via Adversarially Learned Semantic Inference
• Interpolated Joint Space Adversarial Training for Robust and Generalizable Defenses
• Convergence and Margin of Adversarial Training on Separable Data
• Sitatapatra: Blocking the Transfer of Adversarial Samples
• On the Generalization Properties of Adversarial Training
• GAN- vs. JPEG2000 Image Compression for Distributed Automotive Perception: Higher Peak SNR Does Not Mean Better Semantic Segmentation
• Attribution-driven Causal Analysis for Detection of Adversarial Examples
• ShapeAdv: Generating Shape-Aware Adversarial 3D Point Clouds
• Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?
• On the Need for Topology-Aware Generative Models for Manifold-Based Defenses
• Failure Modes of Variational Autoencoders and Their Effects on Downstream Tasks
• Towards Robust Neural Networks via Close-loop Control
• Robust Adversarial Learning via Sparsifying Front Ends
• Trust but Verify: An Information-Theoretic Explanation for the Adversarial Fragility of Machine Learning Systems, and a General Defense against Adversarial Attacks
• Model-Based Robust Deep Learning: Generalizing to Natural, Out-of-Distribution Data
• Purifying Adversarial Perturbation with Adversarially Trained Auto-encoders
• ATRO: Adversarial Training with a Rejection Option
• MAD-VAE: Manifold Awareness Defense Variational Autoencoder
• Vax-a-Net: Training-time Defence Against Adversarial Patch Attacks
• Distributional Robustness with IPMs and links to Regularization and GANs
• Ensembling with Deep Generative Views
• Provably robust deep generative models
• Generative Models for Security: Attacks, Defenses, and Opportunities
• Local Competition and Stochasticity for Adversarial Robustness in Deep Learning
• Challenging the adversarial robustness of DNNs based on error-correcting output codes
• Local Competition and Uncertainty for Adversarial Robustness in Deep Learning
• Robust Training Using Natural Transformation
• Do Deep Minds Think Alike? Selective Adversarial Attacks for Fine-Grained Manipulation of Multiple Deep Neural Networks
• Adversarial Machine Learning in Text Analysis and Generation
• State-Reification Networks: Improving Generalization by Modeling the Distribution of Hidden Representations
• FROB: Few-shot ROBust Model for Classification and Out-of-Distribution Detection
• Hard-label Manifolds: Unexpected Advantages of Query Efficiency for Finding On-manifold Adversarial Examples
• Generative Model Adversarial Training for Deep Compressed Sensing
• Towards Model-Agnostic Adversarial Defenses using Adversarially Trained Autoencoders