[Paper Review] A Data Augmentation-based Defense Method Against Adversarial Attacks in Neural Networks

Yi Zeng, Han Qiu+2 more|arXiv (Cornell University)|Jul 30, 2020

Adversarial Robustness in Machine Learning38 references4 citations

TL;DR

This paper proposes Stochastic Affine Transformation (SAT), a lightweight data augmentation-based defense that applies randomized affine transformations—translation, rotation, and scaling—to input images to enhance robustness against adversarial attacks. SAT maintains high clean accuracy (98%) and reduces attack success rates to near zero, achieving 80% accuracy against 50-round BPDA attacks, outperforming state-of-the-art defenses.

ABSTRACT

Deep Neural Networks (DNNs) in Computer Vision (CV) are well-known to be vulnerable to Adversarial Examples (AEs), namely imperceptible perturbations added maliciously to cause wrong classification results. Such variability has been a potential risk for systems in real-life equipped DNNs as core components. Numerous efforts have been put into research on how to protect DNN models from being tackled by AEs. However, no previous work can efficiently reduce the effects caused by novel adversarial attacks and be compatible with real-life constraints at the same time. In this paper, we focus on developing a lightweight defense method that can efficiently invalidate full whitebox adversarial attacks with the compatibility of real-life constraints. From basic affine transformations, we integrate three transformations with randomized coefficients that fine-tuned respecting the amount of change to the defended sample. Comparing to 4 state-of-art defense methods published in top-tier AI conferences in the past two years, our method demonstrates outstanding robustness and efficiency. It is worth highlighting that, our model can withstand advanced adaptive attack, namely BPDA with 50 rounds, and still helps the target model maintain an accuracy around 80 %, meanwhile constraining the attack success rate to almost zero.

Motivation & Objective

• To develop a lightweight, model-agnostic defense against adversarial attacks that remains effective under real-world constraints.
• To address the limitations of prior defenses that fail against advanced white-box attacks like BPDA.
• To improve robustness against both standard gradient-based attacks (e.g., FGSM, C&W) and adaptive attacks such as BPDA.
• To maintain high classification accuracy on benign inputs while effectively invalidating adversarial perturbations.

Proposed method

• SAT integrates three affine transformations—translation, rotation, and scaling—applied with randomized coefficients to input images during inference.
• The randomization of transformation coefficients introduces stochasticity, disrupting the gradient-based assumptions used in attacks like BPDA.
• The defense operates as a preprocessing step, making it compatible with any pre-trained DNN model without architectural changes.
• The method is designed to be lightweight and efficient, suitable for resource-constrained environments like IoT devices.
• It leverages data augmentation principles to increase input variance, making adversarial perturbations ineffective.
• The approach is agnostic to the target model, enabling deployment across diverse DNN architectures.

Experimental results

Research questions

• RQ1 Can a data augmentation-based defense maintain high clean accuracy while effectively countering standard adversarial attacks like FGSM and C&W?
• RQ2 How effective is the defense against advanced, adaptive attacks such as BPDA that exploit gradient obfuscation?
• RQ3 To what extent does randomization in affine transformations increase robustness without degrading benign classification performance?
• RQ4 Does the defense remain effective under full white-box attack scenarios with iterative optimization?
• RQ5 How does the variance introduced by the defense correlate with its ability to thwart gradient-based attacks?

Key findings

• SAT achieved 98% clean accuracy and reduced attack success rate to 0% on FGSM and IFGSM attacks, significantly outperforming baseline models.
• Against C&W and LBFGS attacks, SAT maintained 85% and 78% accuracy respectively, with attack success rates below 1%.
• Under 50-round BPDA attacks, SAT preserved 80% model accuracy and kept attack success rate at 0%, outperforming all prior defenses.
• The defense’s effectiveness correlates strongly with the variance it introduces between original and transformed inputs, as measured by $l_2$, SSIM, and PSNR.
• SAT’s performance was superior to four state-of-the-art defenses (FD, SHIELD, BdR, PD), especially in resisting adaptive attacks.
• The method is lightweight and compatible with real-world constraints, making it suitable for deployment in resource-limited systems like IoT devices.