Adversarial Defense by Latent Style Transformations

Abstract

Machine learning models have demonstrated vulnerability to adversarial attacks, more specifically misclassification of adversarial examples. In this paper, we investigate an attack-agnostic defense against adversarial attacks on high-resolution images by detecting suspicious inputs. The intuition behind our approach is that the essential characteristics of a normal image are generally consistent with non-essential style transformations, e.g., slightly changing the facial expression of human portraits. In contrast, adversarial examples are generally sensitive to such transformations. In our approach to detect adversarial instances, we propose an in\underline{V}ertible \underline{A}utoencoder based on the \underline{S}tyleGAN2 generator via \underline{A}dversarial training (VASA) to inverse images to disentangled latent codes that reveal hierarchical styles. We then build a set of edited copies with non-essential style transformations by performing latent shifting and reconstruction, based on the correspondences between latent codes and style transformations. The classification-based consistency of these edited copies is used to distinguish adversarial instances.

References in corpus (16)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• LSUN: Construction of a Large-scale Image Dataset using Deep Learning with Humans in the Loop
• Evasion Attacks against Machine Learning at Test Time
• Synthesizing Robust Adversarial Examples
• GANSpace: Discovering Interpretable GAN Controls
• Spatially Transformed Adversarial Examples
• MagNet: a Two-Pronged Defense against Adversarial Examples
• Foolbox: A Python toolbox to benchmark the robustness of machine learning models
• Constructing Unrestricted Adversarial Examples with Generative Models
• The Limitations of Adversarial Training and the Blind-Spot Attack
• Adversarial Example Games
• Featurized Bidirectional GAN: Adversarial Defense via Adversarially Learned Semantic Inference
• Detecting Adversarial Examples via Neural Fingerprinting
• Beneficial Perturbations Network for Defending Adversarial Examples