[Paper Review] DeepCloak: Masking Deep Neural Network Models for Robustness Against Adversarial Samples

Ji Gao, Beilun Wang+3 more|arXiv (Cornell University)|Feb 22, 2017

Adversarial Robustness in Machine Learning12 references72 citations

TL;DR

DeepCloak adds a binary mask layer to DNNs to remove unnecessary features, reducing adversarial vulnerability with minimal impact on normal accuracy.

ABSTRACT

Recent studies have shown that deep neural networks (DNN) are vulnerable to adversarial samples: maliciously-perturbed samples crafted to yield incorrect model outputs. Such attacks can severely undermine DNN systems, particularly in security-sensitive settings. It was observed that an adversary could easily generate adversarial samples by making a small perturbation on irrelevant feature dimensions that are unnecessary for the current classification task. To overcome this problem, we introduce a defensive mechanism called DeepCloak. By identifying and removing unnecessary features in a DNN model, DeepCloak limits the capacity an attacker can use generating adversarial samples and therefore increase the robustness against such inputs. Comparing with other defensive approaches, DeepCloak is easy to implement and computationally efficient. Experimental results show that DeepCloak can increase the performance of state-of-the-art DNN models against adversarial samples.

Motivation & Objective

• Motivate robustness against adversarial samples in DNNs by reducing reliance on unnecessary features.
• Propose a lightweight defense that does not require retraining and can be applied to existing DNNs.
• Identify and remove features most sensitive to adversarial perturbations to limit attack vectors.

Proposed method

• Compute feature sensitivity by comparing activations on normal vs. adversarial inputs.
• Insert a mask layer with weights 0 or 1 before the classifier to remove the top m% most sensitive features.
• Mask is learned by accumulating per-feature change across adversarial pairs (v = sum_i |g(x_i) - g(x'_i)|).
• Set top m entries of the sensitivity vector to 0 and remaining to 1, then insert the mask into the DNN.
• No retraining is required; learning the mask can use a subset of the training data for efficiency.
• Applied to various architectures to demonstrate generality.

Experimental results

Research questions

• RQ1 Can masking unnecessary features improve robustness of DNNs against adversarial inputs without retraining?
• RQ2 What fraction of features needs to be masked to achieve meaningful adversarial robustness?
• RQ3 How does feature masking impact accuracy on clean (non-adversarial) data across architectures?

Key findings

• Masking a small fraction of features yields notable gains in adversarial accuracy. For ResNet with 256 feature nodes, 1% masking yields adversarial accuracy 0.3923 with a 32.49% relative increase.
• Removing more features gradually increases adversarial robustness but can reduce clean accuracy; the trade-off prefers masking small percentages for substantial adversarial gains.
• Across CNN, VGG, and Wide ResNet on CIFAR-10, masking up to 10% of features yields progressively higher adversarial accuracy with relatively modest drops in normal accuracy.
• The study shows that many features are unimportant for making adversarial samples, supporting selective feature removal as an effective defense.
• Masking 1% of features often provides a sizable boost in robustness, while maintaining high performance on clean data.