On the Limitations of Denoising Strategies as Adversarial Defenses

Abstract

As adversarial attacks against machine learning models have raised increasing concerns, many denoising-based defense approaches have been proposed. In this paper, we summarize and analyze the defense strategies in the form of symmetric transformation via data denoising and reconstruction (denoted as $F+$ inverse $F$, $F-IF$ Framework). In particular, we categorize these denoising strategies from three aspects (i.e. denoising in the spatial domain, frequency domain, and latent space, respectively). Typically, defense is performed on the entire adversarial example, both image and perturbation are modified, making it difficult to tell how it defends against the perturbations. To evaluate the robustness of these denoising strategies intuitively, we directly apply them to defend against adversarial noise itself (assuming we have obtained all of it), which saving us from sacrificing benign accuracy. Surprisingly, our experimental results show that even if most of the perturbations in each dimension is eliminated, it is still difficult to obtain satisfactory robustness. Based on the above findings and analyses, we propose the adaptive compression strategy for different frequency bands in the feature domain to improve the robustness. Our experiment results show that the adaptive compression strategies enable the model to better suppress adversarial perturbations, and improve robustness compared with existing denoising strategies.

References in corpus (8)

• Adam: A Method for Stochastic Optimization
• Delving into Transferable Adversarial Examples and Black-box Attacks
• A study of the effect of JPG compression on adversarial images
• Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression
• Defending against Adversarial Images using Basis Functions Transformations
• Defending Against Universal Attacks Through Selective Feature Regeneration
• Divide, Denoise, and Defend against Adversarial Attacks
• Defense Against Adversarial Attacks with Saak Transform

Cited by in corpus (1)

• Dual Head Adversarial Training