Adversarial Robustness by Design through Analog Computing and Synthetic Gradients

Abstract

We propose a new defense mechanism against adversarial attacks inspired by an optical co-processor, providing robustness without compromising natural accuracy in both white-box and black-box settings. This hardware co-processor performs a nonlinear fixed random transformation, where the parameters are unknown and impossible to retrieve with sufficient precision for large enough dimensions. In the white-box setting, our defense works by obfuscating the parameters of the random projection. Unlike other defenses relying on obfuscated gradients, we find we are unable to build a reliable backward differentiable approximation for obfuscated parameters. Moreover, while our model reaches a good natural accuracy with a hybrid backpropagation - synthetic gradient method, the same approach is suboptimal if employed to generate adversarial examples. We find the combination of a random projection and binarization in the optical system also improves robustness against various types of black-box attacks. Finally, our hybrid training method builds robust features against transfer attacks. We demonstrate our approach on a VGG-like architecture, placing the defense on top of the convolutional features, on CIFAR-10 and CIFAR-100. Code is available at https://github.com/lightonai/adversarial-robustness-by-design.

References in corpus (17)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Explaining and Harnessing Adversarial Examples
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Black-box Adversarial Attacks with Limited Queries and Information
• Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priors
• Direct Feedback Alignment Provides Learning in Deep Neural Networks
• On Adaptive Attacks to Adversarial Example Defenses
• Scaling provable adversarial defenses
• Parsimonious Black-Box Adversarial Attacks via Efficient Combinatorial Optimization
• Theoretical evidence for adversarial robustness through randomization
• Principled Training of Neural Networks with Direct Feedback Alignment
• Yet another but more efficient black-box adversarial attack: tiling and evolution strategies
• Adversarial Attacks on Linear Contextual Bandits
• Don't take it lightly: Phasing optical random projections with unknown operators
• On the Adversarial Robustness of Neural Networks without Weight Transport

Cited by in corpus (4)

• Nonlinear optical encoding enabled by recurrent linear scattering
• On the Noise Stability and Robustness of Adversarially Trained Networks on NVM Crossbars
• Benchmarking the Accuracy and Robustness of Feedback Alignment Algorithms
• Streamlined optical training of large-scale modern deep learning architectures with direct feedback alignment