[Paper Review] Countering Adversarial Images using Input Transformations

Chuan Guo, Mayank Rana+2 more|arXiv (Cornell University)|Oct 31, 2017

Adversarial Robustness in Machine LearningComputer Science24 references436 citations

TL;DR

The paper investigates input transformations (cropping/resizing, bit-depth reduction, JPEG, total variation minimization, and image quilting) to defend image classifiers against adversarial attacks, showing TV minimization and quilting are especially effective, particularly when the model is trained on transformed images. The strongest defenses can block a majority of gray-box and black-box attacks.

ABSTRACT

This paper investigates strategies that defend against adversarial-example attacks on image-classification systems by transforming the inputs before feeding them to the system. Specifically, we study applying image transformations such as bit-depth reduction, JPEG compression, total variance minimization, and image quilting before feeding the image to a convolutional network classifier. Our experiments on ImageNet show that total variance minimization and image quilting are very effective defenses in practice, in particular, when the network is trained on transformed images. The strength of those defenses lies in their non-differentiable nature and their inherent randomness, which makes it difficult for an adversary to circumvent the defenses. Our best defense eliminates 60% of strong gray-box and 90% of strong black-box attacks by a variety of major attack methods

Motivation & Objective

• Motivate robust image classification by removing adversarial perturbations through input transformations.
• Evaluate simple and non-differentiable/randomized transformations as model-agnostic defenses.
• Assess resilience under gray-box and black-box attack settings on ImageNet.
• Examine how training classifiers on transformed images affects defense efficacy.

Proposed method

• Evaluate five image transformations: image cropping-rescaling, bit-depth reduction, JPEG compression, total variance minimization (TVM), and image quilting.
• Use non-differentiable or randomized defenses to hinder adversaries aware of the defense strategy.
• Combine transformations with training-time transformations to improve robustness; test under gray-box and black-box settings.
• Model attacks include FGSM, iterative FGSM, DeepFool, and CW-L2; assess success by normalized L2 dissimilarity.
• For TVM, solve a convex optimization via split Bregman to minimize total variation and reconstruction error.
• Image quilting constructs images from patches drawn from a database of clean patches to disrupt adversarial perturbations.

Experimental results

Research questions

• RQ1 How effective are input-transform defenses (cropping, bit-depth, JPEG, TVM, quilting) at mitigating adversarial perturbations on ImageNet?
• RQ2 Does training classifiers on transformed images enhance robustness to both gray-box and black-box attacks?
• RQ3 How do these defenses compare to ensemble adversarial training across different attack methods?
• RQ4 What role does randomness and non-differentiability play in the strength of these defenses?
• RQ5 Can combinations of transformations (and model transfer) yield uniform protection across attacked architectures?

Key findings

• Total variation minimization and image quilting are the strongest defenses, being non-differentiable and randomized, and removing a substantial portion of adversarial perturbations.
• In gray-box tests, the strongest defenses eliminated about 60% of strong gray-box attacks and about 90% of strong black-box attacks across major attack methods.
• Cropping with test-time random crops yields 40–60% correct classifications on transformed adversarial images, indicating robustness to perturbations.
• Training networks on transformed images dramatically improves defense effectiveness, with image quilting defending against 80–90% of strong attacks in some setups.
• Ensembling defenses and model transfer can add 1–3 percentage points of robustness; however, the strongest gains come from TVM and quilting, especially when the model is trained on transformed data.
• Compared to ensemble adversarial training, the input-transform defenses generalize better across attack types and are particularly stronger against iterative attacks (e.g., DeepFool) in gray-box settings.