ME-Net: Towards Effective Adversarial Robustness with Matrix Estimation

Abstract

Deep neural networks are vulnerable to adversarial attacks. The literature is rich with algorithms that can easily craft successful adversarial examples. In contrast, the performance of defense techniques still lags behind. This paper proposes ME-Net, a defense method that leverages matrix estimation (ME). In ME-Net, images are preprocessed using two steps: first pixels are randomly dropped from the image; then, the image is reconstructed using ME. We show that this process destroys the adversarial structure of the noise, while re-enforcing the global structure in the original image. Since humans typically rely on such global structures in classifying images, the process makes the network mode compatible with human perception. We conduct comprehensive experiments on prevailing benchmarks such as MNIST, CIFAR-10, SVHN, and Tiny-ImageNet. Comparing ME-Net with state-of-the-art defense mechanisms shows that ME-Net consistently outperforms prior techniques, improving robustness against both black-box and white-box attacks.

ICML 2019

References in corpus (10)

• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Adversarially Robust Generalization Requires More Data
• Matrix estimation by Universal Singular Value Thresholding
• An overview of low-rank matrix recovery from incomplete observations
• Countering Adversarial Images using Input Transformations
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Fast low-rank estimation by projected gradient descent: General statistical and algorithmic guarantees
• Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey
• Harnessing Structures in Big Data via Guaranteed Low-Rank Matrix Estimation
• Recovering communities in the general stochastic block model without knowing the parameters

Cited by in corpus (23)

• Fast is better than free: Revisiting adversarial training
• Adversarial Machine Learning in Image Classification: A Survey Towards the Defender's Perspective
• RobustBench: a standardized adversarial robustness benchmark
• Overfitting in adversarially robust deep learning
• On Robustness of Principal Component Regression
• A Panda? No, It's a Sloth: Slowdown Attacks on Adaptive Multi-Exit Neural Network Inference
• Achieving Adversarial Robustness via Sparsity
• Denoised Internal Models: a Brain-Inspired Autoencoder against Adversarial Attacks
• On Adversarial Robustness of 3D Point Cloud Classification under Adaptive Attacks
• Adversarial robustness via robust low rank representations
• MagDR: Mask-guided Detection and Reconstruction for Defending Deepfakes
• RAIN: A Simple Approach for Robust and Accurate Image Classification Networks
• Robust GANs against Dishonest Adversaries
• Defective Convolutional Networks
• On the human-recognizability phenomenon of adversarially trained deep image classifiers
• The art of defense: letting networks fool the attacker
• Deep Bayesian Image Set Classification: A Defence Approach against Adversarial Attacks
• Sparse Coding Frontend for Robust Neural Networks
• Trace-Norm Adversarial Examples
• Adversarial Machine Learning in Text Analysis and Generation
• Polarizing Front Ends for Robust CNNs
• The Effect of Prior Lipschitz Continuity on the Adversarial Robustness of Bayesian Neural Networks
• A Neuro-Inspired Autoencoding Defense Against Adversarial Perturbations