PuVAE: A Variational Autoencoder to Purify Adversarial Examples

Abstract

Deep neural networks are widely used and exhibit excellent performance in many areas. However, they are vulnerable to adversarial attacks that compromise the network at the inference time by applying elaborately designed perturbation to input data. Although several defense methods have been proposed to address specific attacks, other attack methods can circumvent these defense mechanisms. Therefore, we propose Purifying Variational Autoencoder (PuVAE), a method to purify adversarial examples. The proposed method eliminates an adversarial perturbation by projecting an adversarial example on the manifold of each class, and determines the closest projection as a purified sample. We experimentally illustrate the robustness of PuVAE against various attack methods without any prior knowledge. In our experiments, the proposed method exhibits performances competitive with state-of-the-art defense methods, and the inference time is approximately 130 times faster than that of Defense-GAN that is the state-of-the art purifier model.

References in corpus (6)

• Auto-Encoding Variational Bayes
• Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
• Tutorial on Variational Autoencoders
• Countering Adversarial Images using Input Transformations
• Technical Report on the CleverHans v2.1.0 Adversarial Examples Library
• Structured Adversarial Attack: Towards General Implementation and Better Interpretability

Cited by in corpus (4)

• Vulnerability of deep neural networks for detecting COVID-19 cases from chest X-ray images to universal adversarial attacks
• Frequency Centric Defense Mechanisms against Adversarial Examples
• Purifying Adversarial Perturbation with Adversarially Trained Auto-encoders
• Detecting Adversaries, yet Faltering to Noise? Leveraging Conditional Variational AutoEncoders for Adversary Detection in the Presence of Noisy Images