[Paper Review] Adversarial Self-Defense for Cycle-Consistent GANs

Dina Bashkirova, Ben Usman+1 more|arXiv (Cornell University)|Aug 5, 2019

Adversarial Robustness in Machine LearningComputer Science30 references22 citations

TL;DR

This paper identifies a self-adversarial attack in cycle-consistent GANs, where generators hide input information in imperceptible noise to satisfy cycle-consistency loss. The authors propose two defense techniques—noise regularization and guess loss—that reduce such hidden embeddings, improving translation quality, reconstruction honesty, and robustness to high-frequency perturbations.

ABSTRACT

The goal of unsupervised image-to-image translation is to map images from one domain to another without the ground truth correspondence between the two domains. State-of-art methods learn the correspondence using large numbers of unpaired examples from both domains and are based on generative adversarial networks. In order to preserve the semantics of the input image, the adversarial objective is usually combined with a cycle-consistency loss that penalizes incorrect reconstruction of the input image from the translated one. However, if the target mapping is many-to-one, e.g. aerial photos to maps, such a restriction forces the generator to hide information in low-amplitude structured noise that is undetectable by human eye or by the discriminator. In this paper, we show how such self-attacking behavior of unsupervised translation methods affects their performance and provide two defense techniques. We perform a quantitative evaluation of the proposed techniques and show that making the translation model more robust to the self-adversarial attack increases its generation quality and reconstruction reliability and makes the model less sensitive to low-amplitude perturbations.

Motivation & Objective

• To identify and analyze the self-adversarial attack phenomenon in unsupervised image-to-image translation models, particularly in many-to-one mappings.
• To quantify the presence of hidden structured noise used by generators to cheat cycle-consistency loss.
• To develop defense mechanisms that reduce reliance on adversarial noise and improve model honesty and robustness.
• To introduce new evaluation metrics—reconstruction honesty (RH) and sensitivity to noise (SN)—to detect self-adversarial behavior.
• To demonstrate that robustifying models against self-adversarial attacks improves generalization and reliability in translation tasks.

Proposed method

• Propose a noise regularization defense that adds high-frequency noise during training to discourage the generator from relying on structured noise for reconstruction.
• Introduce a guess loss component that encourages the generator to produce more interpretable outputs by penalizing deviations from plausible class predictions.
• Define reconstruction honesty (RH) as a metric measuring how reconstruction error scales with added noise amplitude, indicating hidden embedding presence.
• Define sensitivity to noise (SN) as a metric quantifying the model's vulnerability to high-frequency perturbations in the translated output.
• Apply both defenses to CycleGAN, UNIT, and MUNIT, evaluating their impact on semantic segmentation and reconstruction fidelity.
• Use quantitative metrics including mean class-wise segmentation accuracy, IoU, and reconstruction error distributions to assess performance improvements.

Experimental results

Research questions

• RQ1 To what extent does cycle-consistency loss induce self-adversarial behavior in unsupervised image-to-image translation models?
• RQ2 How does the presence of hidden structured noise affect model robustness to high-frequency perturbations?
• RQ3 Can adversarial defense techniques like noise regularization and guess loss reduce hidden embeddings and improve model honesty?
• RQ4 How do the proposed metrics (RH and SN) correlate with translation quality and reconstruction reliability?
• RQ5 Does improving robustness to self-adversarial attacks lead to better generalization and more interpretable outputs?

Key findings

• The self-adversarial attack is prevalent in cycle-consistent GANs, particularly in many-to-one mappings like aerial images to semantic maps, where generators hide input details in imperceptible noise.
• Original CycleGAN and UNIT show high sensitivity to noise, with reconstruction error increasing rapidly at noise amplitude 0.08, indicating strong hidden embedding.
• The noise regularization defense reduced reconstruction error (RH) from 27.434 to 9.166 on GTA V and from 21.775 to 12.266 on Google Maps, significantly improving robustness.
• The guess loss defense reduced RH to 11.380 on GTA V and 7.467 on Google Maps, producing more interpretable reconstructions despite some semantic inaccuracies.
• Both defenses improved segmentation accuracy (up to 0.242 on Google Maps) and IoU (up to 0.224), indicating higher translation quality.
• The models with defenses showed reduced sensitivity to noise (SN), with values dropping from 446.924 to 94.150 (noise) and 212.589 (guess), confirming reduced reliance on adversarial noise.