Robustifying Models Against Adversarial Attacks by Langevin Dynamics

Abstract

Adversarial attacks on deep learning models have compromised their performance considerably. As remedies, a lot of defense methods were proposed, which however, have been circumvented by newer attacking strategies. In the midst of this ensuing arms race, the problem of robustness against adversarial attacks still remains unsolved. This paper proposes a novel, simple yet effective defense strategy where adversarial samples are relaxed onto the underlying manifold of the (unknown) target class distribution. Specifically, our algorithm drives off-manifold adversarial samples towards high density regions of the data generating distribution of the target class by the Metroplis-adjusted Langevin algorithm (MALA) with perceptual boundary taken into account. Although the motivation is similar to projection methods, e.g., Defense-GAN, our algorithm, called MALA for DEfense (MALADE), is equipped with significant dispersion - projection is distributed broadly, and therefore any whitebox attack cannot accurately align the input so that the MALADE moves it to a targeted untrained spot where the model predicts a wrong label. In our experiments, MALADE exhibited state-of-the-art performance against various elaborate attacking strategies.

References in corpus (29)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Explaining and Harnessing Adversarial Examples
• Communication-Efficient Learning of Deep Networks from Decentralized Data
• Methods for Interpreting and Understanding Deep Neural Networks
• Ensemble Adversarial Training: Attacks and Defenses
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Synthesizing Robust Adversarial Examples
• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• On Evaluating Adversarial Robustness
• Certified Defenses against Adversarial Examples
• Robust Physical-World Attacks on Deep Learning Models
• The Space of Transferable Adversarial Examples
• Countering Adversarial Images using Input Transformations
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Certifying Some Distributional Robustness with Principled Adversarial Training
• PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples
• Plug & Play Generative Networks: Conditional Iterative Generation of Images in Latent Space
• MagNet and "Efficient Defenses Against Adversarial Attacks" are Not Robust to Adversarial Examples
• The Robust Manifold Defense: Adversarial Training using Generative Models
• Benchmarking Neural Network Robustness to Common Corruptions and Surface Variations
• Adv-BNN: Improved Adversarial Defense through Robust Bayesian Neural Network
• Attacking the Madry Defense Model with $L_1$-based Adversarial Examples
• Evaluating and Understanding the Robustness of Adversarial Logit Pairing
• Ensemble Methods as a Defense to Adversarial Perturbations Against Deep Neural Networks
• DARCCC: Detecting Adversaries by Reconstruction from Class Conditional Capsules
• Fortified Networks: Improving the Robustness of Deep Networks by Modeling the Manifold of Hidden Representations
• An ADMM-Based Universal Framework for Adversarial Attacks on Deep Neural Networks

Cited by in corpus (5)

• Accurate and Robust Neural Networks for Security Related Applications Exampled by Face Morphing Attacks
• $n$-ML: Mitigating Adversarial Examples via Ensembles of Topologically Manipulated Classifiers
• Diminishing the Effect of Adversarial Perturbations via Refining Feature Representation
• Langevin Cooling for Domain Translation
• FUNN: Flexible Unsupervised Neural Network