Fortified Networks: Improving the Robustness of Deep Networks by Modeling the Manifold of Hidden Representations

Abstract

Deep networks have achieved impressive results across a variety of important tasks. However a known weakness is a failure to perform well when evaluated on data which differ from the training distribution, even if these differences are very small, as is the case with adversarial examples. We propose Fortified Networks, a simple transformation of existing networks, which fortifies the hidden layers in a deep network by identifying when the hidden states are off of the data manifold, and maps these hidden states back to parts of the data manifold where the network performs well. Our principal contribution is to show that fortifying these hidden states improves the robustness of deep networks and our experiments (i) demonstrate improved robustness to standard adversarial attacks in both black-box and white-box threat models; (ii) suggest that our improvements are not primarily due to the gradient masking problem and (iii) show the advantage of doing this fortification in the hidden layers instead of the input space.

arXiv commentUnder Review ICML 2018

References in corpus (8)

• End to End Learning for Self-Driving Cars
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• Technical Report on the CleverHans v2.1.0 Adversarial Examples Library
• Adversarial Machine Learning at Scale
• Better Mixing via Deep Representations
• Representation Learning: A Review and New Perspectives
• A3T: Adversarially Augmented Adversarial Training

Cited by in corpus (11)

• Motivating the Rules of the Game for Adversarial Example Research
• Adversarial Examples in Modern Machine Learning: A Review
• Adversarial Examples - A Complete Characterisation of the Phenomenon
• Defending Against Universal Attacks Through Selective Feature Regeneration
• Robust Conditional Generative Adversarial Networks
• Robustifying Models Against Adversarial Attacks by Langevin Dynamics
• Adversarial Examples on Object Recognition: A Comprehensive Survey
• GanDef: A GAN based Adversarial Training Defense for Neural Network Classifier
• ZK-GanDef: A GAN based Zero Knowledge Adversarial Training Defense for Neural Networks
• TEAM: We Need More Powerful Adversarial Examples for DNNs
• State-Reification Networks: Improving Generalization by Modeling the Distribution of Hidden Representations