Featurized Bidirectional GAN: Adversarial Defense via Adversarially Learned Semantic Inference

Abstract

Deep neural networks have been demonstrated to be vulnerable to adversarial attacks, where small perturbations intentionally added to the original inputs can fool the classifier. In this paper, we propose a defense method, Featurized Bidirectional Generative Adversarial Networks (FBGAN), to extract the semantic features of the input and filter the non-semantic perturbation. FBGAN is pre-trained on the clean dataset in an unsupervised manner, adversarially learning a bidirectional mapping between the high-dimensional data space and the low-dimensional semantic space; also mutual information is applied to disentangle the semantically meaningful features. After the bidirectional mapping, the adversarial data can be reconstructed to denoised data, which could be fed into any pre-trained classifier. We empirically show the quality of reconstruction images and the effectiveness of defense.

References in corpus (14)

• Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
• Ensemble Adversarial Training: Attacks and Defenses
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Improved Techniques for Training GANs
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Adversarial Feature Learning
• Adversarially Learned Inference
• Technical Report on the CleverHans v2.1.0 Adversarial Examples Library
• Robustness May Be at Odds with Accuracy
• Certifying Some Distributional Robustness with Principled Adversarial Training
• MagNet: a Two-Pronged Defense against Adversarial Examples
• Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey
• The Robust Manifold Defense: Adversarial Training using Generative Models
• Semi-supervised Learning with GANs: Manifold Invariance with Improved Inference

Cited by in corpus (5)

• Motivating the Rules of the Game for Adversarial Example Research
• Adversarial Examples - A Complete Characterisation of the Phenomenon
• Adversarial Defense by Latent Style Transformations
• Generative Models for Security: Attacks, Defenses, and Opportunities
• Defending Adversarial Attacks via Semantic Feature Manipulation