[Paper Review] Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models

Pouya Samangouei, Maya Kabkab+1 more|arXiv (Cornell University)|May 17, 2018

Adversarial Robustness in Machine LearningComputer Science593 citations

TL;DR

Defense-GAN uses a Wasserstein GAN to project inputs onto the generator’s range before classification, denoising adversarial perturbations and defending against both white-box and black-box attacks without changing the classifier.

ABSTRACT

In recent years, deep neural network approaches have been widely adopted for machine learning tasks, including classification. However, they were shown to be vulnerable to adversarial perturbations: carefully crafted small perturbations can cause misclassification of legitimate images. We propose Defense-GAN, a new framework leveraging the expressive capability of generative models to defend deep neural networks against such attacks. Defense-GAN is trained to model the distribution of unperturbed images. At inference time, it finds a close output to a given image which does not contain the adversarial changes. This output is then fed to the classifier. Our proposed method can be used with any classification model and does not modify the classifier structure or training procedure. It can also be used as a defense against any attack as it does not assume knowledge of the process for generating the adversarial examples. We empirically show that Defense-GAN is consistently effective against different attack methods and improves on existing defense strategies. Our code has been made publicly available at https://github.com/kabkabm/defensegan

Motivation & Objective

• Motivate the vulnerability of classifiers to adversarial perturbations across white-box and black-box threat models.
• Propose a defense that does not modify the classifier and is attack-model agnostic by projecting inputs onto a GAN’s generative range.
• Demonstrate robustness of the defense on standard datasets and compare with existing defenses.
• Explore how GAN-based reconstruction affects detection and robustness under different attack strategies.

Proposed method

• Train a Wasserstein GAN on legitimate data to model the data distribution.
• At inference, solve min_z ||G(z) − x||^2 via gradient descent with L steps and R random restarts to project x onto the generator’s range.
• Feed the reconstructed output G(z*) to the classifier instead of the raw input.
• Optionally train the classifier on reconstructed images (Defense-GAN-Rec) or original images (Defense-GAN-Orig).
• Compare Defense-GAN to MagNet and adversarial training across FGSM, RAND+FGSM, and CW attacks in black-box and white-box settings.

Experimental results

Research questions

• RQ1 Can Defense-GAN provide robust protection against both white-box and black-box adversarial attacks without altering the target classifier?
• RQ2 Does projecting inputs onto the GAN generator’s range effectively denoise adversarial perturbations while preserving legitimate image quality?
• RQ3 How do the defender’s hyperparameters (number of GD steps L and random restarts R) influence robustness and computational cost?
• RQ4 How does Defense-GAN perform relative to existing defenses (e.g., adversarial training, MagNet) across different datasets and attack methods?
• RQ5 Can the defense enable reliable attack detection via reconstruction error signals?

Key findings

• Defense-GAN consistently improves robustness against common adversarial attacks on MNIST and Fashion-MNIST compared to baseline defenses.
• The defense remains effective under both white-box and black-box attack settings and does not require modifying the classifier structure.
• Performance is influenced by the number of GD iterations and random restarts, with larger values generally improving robustness at the cost of inference time.
• Projection-based denoising via the GAN reconstruction can be used to detect adversarial examples through reconstruction error-based metrics.
• Defense-GAN outperforms adversarial training against certain powerful white-box attacks (e.g., CW) and provides broader defense against varied attack strategies.