Robust Adversarial Learning via Sparsifying Front Ends

Abstract

It is by now well-known that small adversarial perturbations can induce classification errors in deep neural networks. In this paper, we take a bottom-up signal processing perspective to this problem and show that a systematic exploitation of sparsity in natural data is a promising tool for defense. For linear classifiers, we show that a sparsifying front end is provably effective against ${\ell }_{\infty }$-bounded attacks, reducing output distortion due to the attack by a factor of roughly $K/N$ where $N$ is the data dimension and $K$ is the sparsity level. We then extend this concept to deep networks, showing that a "locally linear" model can be used to develop a theoretical foundation for crafting attacks and defenses. We also devise attacks based on the locally linear model that outperform the well-known FGSM attack. We supplement our theoretical results with experiments on the MNIST and CIFAR-10 datasets, showing the efficacy of the proposed sparsity-based defense schemes.

arXiv comment16 pages, 12 figures, 6 tables

References in corpus (10)

• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Certified Defenses against Adversarial Examples
• Exponential expressivity in deep neural networks through transient chaos
• Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulation
• Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression
• Adversarial Robustness through Local Linearization
• Semidefinite relaxations for certifying robustness to adversarial examples
• Adversarial vulnerability for any classifier
• The Robust Manifold Defense: Adversarial Training using Generative Models
• Classification regions of deep neural networks

Cited by in corpus (2)

• A Model-Based Derivative-Free Approach to Black-Box Adversarial Examples: BOBYQA
• A Neuro-Inspired Autoencoding Defense Against Adversarial Perturbations