[Paper Review] Enhancing Intrinsic Adversarial Robustness via Feature Pyramid Decoder

Guanlin Li, Shuya Ding+2 more|arXiv (Cornell University)|May 6, 2020

Adversarial Robustness in Machine Learning27 references4 citations

TL;DR

This paper proposes a novel, attack-agnostic defense framework called Feature Pyramid Decoder (FPD) that enhances the intrinsic robustness of block-based convolutional neural networks (CNNs) by integrating multi-scale denoising and image restoration modules alongside a Lipschitz constant constraint on the classification layer. Trained via a two-phase strategy using $ackslashepsilon$-neighbourhood noisy images with multi-task and self-supervised learning, FPD-enhanced models achieve significantly higher robustness against diverse white-box and black-box adversarial attacks on MNIST, SVHN, and CALTECH datasets, outperforming standard and adversarially trained models.

ABSTRACT

Whereas adversarial training is employed as the main defence strategy against specific adversarial samples, it has limited generalization capability and incurs excessive time complexity. In this paper, we propose an attack-agnostic defence framework to enhance the intrinsic robustness of neural networks, without jeopardizing the ability of generalizing clean samples. Our Feature Pyramid Decoder (FPD) framework applies to all block-based convolutional neural networks (CNNs). It implants denoising and image restoration modules into a targeted CNN, and it also constraints the Lipschitz constant of the classification layer. Moreover, we propose a two-phase strategy to train the FPD-enhanced CNN, utilizing $ε$-neighbourhood noisy images with multi-task and self-supervised learning. Evaluated against a variety of white-box and black-box attacks, we demonstrate that FPD-enhanced CNNs gain sufficient robustness against general adversarial samples on MNIST, SVHN and CALTECH. In addition, if we further conduct adversarial training, the FPD-enhanced CNNs perform better than their non-enhanced versions.

Motivation & Objective

• To address the limited generalization and high computational cost of adversarial training, which is tailored to specific attacks and fails to enhance intrinsic robustness.
• To develop an attack-agnostic defense framework that improves the inherent robustness of block-based CNNs without relying on adversarial data during training.
• To design a multi-scale feature pyramid decoder that integrates denoising and image restoration capabilities at multiple network levels.
• To constrain the Lipschitz constant of the classification layer to limit output sensitivity to input perturbations.
• To validate the framework’s effectiveness across diverse datasets and attack types, including white-box and black-box settings.

Proposed method

• Integrates a front denoising module, image restoration module, middle denoising layer, and back denoising module into a block-based CNN to enable multi-scale feature-level denoising.
• Employs a two-phase training strategy using $ackslashepsilon$-neighbourhood noisy images to enable both multi-task learning (reconstruction and classification) and self-supervised learning.
• Implements a Lipschitz constant constraint on the final classification layer to limit output variation under input perturbations.
• Uses a bottleneck architecture in inner denoising layers to improve efficiency and feature representation.
• Applies multi-task supervision with clean images as ground truth to train the restoration and classification heads simultaneously.
• Deploys a pyramid structure across feature maps to enable hierarchical denoising and feature abstraction from restored inputs.

Experimental results

Research questions

• RQ1 Can a defense framework enhance the intrinsic robustness of CNNs without relying on adversarial training or attack-specific data?
• RQ2 How effective is the proposed FPD framework in defending against both white-box and black-box adversarial attacks across diverse datasets?
• RQ3 To what extent does the integration of multi-scale denoising and image restoration improve robustness compared to standard models?
• RQ4 Does the Lipschitz constant constraint on the classification layer contribute meaningfully to robustness under perturbations?
• RQ5 Can the FPD framework be effectively combined with adversarial training to further improve robustness?

Key findings

• On MNIST, the FPD-enhanced ResNet-101 achieved 95.2% robust accuracy against $L_{\infty}$-PGD attacks with $\epsilon = 8/256$, significantly outperforming the non-enhanced model.
• On SVHN, the FPD-enhanced model maintained 78.4% robust accuracy under $L_{\infty}$-PGD attacks, compared to 61.2% for the baseline.
• On CALTECH-101, the FPD-enhanced ResNet-101 achieved 61.78% robust accuracy under $L_{\infty}$-PGD attacks, outperforming the original model by 34.64 percentage points.
• On CALTECH-256, the FPD-enhanced ResNet-101 achieved 49.79% robust accuracy, while the original model achieved 0.00% under the same attack.
• When combined with adversarial training, the FPD-enhanced model achieved higher robustness than non-enhanced models, demonstrating synergistic improvement.
• Visual analysis confirmed that the image restoration module produces highly similar outputs from both clean and adversarial inputs, indicating effective perturbation filtering.