[Paper Review] An integrated Auto Encoder-Block Switching defense approach to prevent adversarial attacks

Anirudh Yadav, Ashutosh Upadhyay‬+1 more|arXiv (Cornell University)|Mar 11, 2022

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper proposes a novel defense mechanism combining an auto-encoder for perturbation removal and a block-switching architecture to enhance robustness against white-box adversarial attacks. Evaluated on FGSM attacks, the integrated approach demonstrates improved resilience by reconstructing inputs and dynamically altering network blocks, significantly reducing misclassification rates.

ABSTRACT

According to recent studies, the vulnerability of state-of-the-art Neural Networks to adversarial input samples has increased drastically. A neural network is an intermediate path or technique by which a computer learns to perform tasks using Machine learning algorithms. Machine Learning and Artificial Intelligence model has become a fundamental aspect of life, such as self-driving cars [1], smart home devices, so any vulnerability is a significant concern. The smallest input deviations can fool these extremely literal systems and deceive their users as well as administrator into precarious situations. This article proposes a defense algorithm that utilizes the combination of an auto-encoder [3] and block-switching architecture. Auto-coder is intended to remove any perturbations found in input images whereas the block switching method is used to make it more robust against White-box attacks. The attack is planned using FGSM [9] model, and the subsequent counter-attack by the proposed architecture will take place thereby demonstrating the feasibility and security delivered by the algorithm.

Motivation & Objective

• To address the growing vulnerability of deep neural networks to adversarial inputs that exploit minimal perturbations.
• To improve defense robustness against white-box attacks, where adversaries have full access to model architecture and parameters.
• To integrate auto-encoding for input reconstruction with dynamic block-switching to increase model uncertainty for attackers.
• To validate the effectiveness of the hybrid defense under FGSM-based adversarial attacks in a controlled evaluation.

Proposed method

• An auto-encoder is trained to reconstruct input images by learning to remove small, imperceptible perturbations introduced by adversarial attacks.
• The block-switching mechanism dynamically reconfigures residual blocks within the network during inference to disrupt adversarial patterns.
• The defense combines the auto-encoder's denoising capability with the block-switching's structural randomness to increase model robustness.
• The architecture is evaluated using the FGSM attack model as the primary threat scenario to test resilience.
• The defense is applied at inference time, with the auto-encoder processing inputs before they enter the main network.
• The block-switching component introduces stochasticity in the network’s forward pass, making it harder for attackers to predict gradients.

Experimental results

Research questions

• RQ1 Can an auto-encoder effectively reduce adversarial perturbations in input images before classification?
• RQ2 Does dynamic block-switching in residual networks increase resistance to white-box adversarial attacks?
• RQ3 How does the combination of auto-encoding and block-switching compare to standalone defenses in terms of robustness?
• RQ4 To what extent does the proposed method reduce misclassification rates under FGSM attacks?

Key findings

• The proposed defense significantly reduces the success rate of FGSM attacks by reconstructing inputs and introducing structural variability.
• The integration of auto-encoding and block-switching leads to a more resilient model than either technique used in isolation.
• The auto-encoder effectively removes small, targeted perturbations, restoring input fidelity before classification.
• Block-switching increases model uncertainty, making gradient-based attacks less effective due to unpredictable gradient flow.