[Paper Review] Internal Wasserstein Distance for Adversarial Attack and Defense

Wang, Qicheng, Shuhai Zhang+4 more|arXiv (Cornell University)|Mar 13, 2021

Adversarial Robustness in Machine Learning34 references4 citations

TL;DR

This paper proposes an Internal Wasserstein Distance (IWD) to measure semantic similarity between images, enabling more effective adversarial attacks and defenses. By leveraging IWD to generate diverse, semantically similar adversarial examples, the method achieves larger perturbations than ℓp-based approaches and improves robustness through IWD-based adversarial training, outperforming existing methods in both attack success rate and defense accuracy on ImageNet.

ABSTRACT

Deep neural networks (DNNs) are known to be vulnerable to adversarial attacks that would trigger misclassification of DNNs but may be imperceptible to human perception. Adversarial defense has been an important way to improve the robustness of DNNs. Existing attack methods often construct adversarial examples relying on some metrics like the $\ell_p$ distance to perturb samples. However, these metrics can be insufficient to conduct adversarial attacks due to their limited perturbations. In this paper, we propose a new internal Wasserstein distance (IWD) to capture the semantic similarity of two samples, and thus it helps to obtain larger perturbations than currently used metrics such as the $\ell_p$ distance. We then apply the internal Wasserstein distance to perform adversarial attack and defense. In particular, we develop a novel attack method relying on IWD to calculate the similarities between an image and its adversarial examples. In this way, we can generate diverse and semantically similar adversarial examples that are more difficult to defend by existing defense methods. Moreover, we devise a new defense method relying on IWD to learn robust models against unseen adversarial examples. We provide both thorough theoretical and empirical evidence to support our methods.

Motivation & Objective

• To address the limitations of ℓp norms in measuring semantic similarity for adversarial examples, which restrict perturbation diversity and effectiveness.
• To develop a new attack method that generates more diverse and robust adversarial examples by exploiting data manifold structure.
• To design a defense mechanism using IWD that improves generalization and robustness against unseen adversarial attacks.
• To theoretically derive an upper bound on attack error, guiding the design of a robust defense via IWD-based training.
• To demonstrate that diverse adversarial examples covering data manifold blind spots enhance model robustness.

Proposed method

• Proposes Internal Wasserstein Distance (IWD) as a metric to capture intrinsic data distribution and semantic similarity between images, replacing traditional ℓp norms.
• Develops an attack method (IWDA) that uses IWD to generate adversarial examples with large, semantically consistent perturbations on the data manifold.
• Derives an upper bound on the attack classification error using IWD, which informs the design of a novel defense method (IWDD).
• Designs a defense strategy (IWDD) that trains models using IWD-optimized adversarial examples to improve robustness against unseen attacks.
• Employs a dual optimization framework where IWD is computed via a learned feature space, enabling effective gradient-based attacks and robust training.
• Uses pre-trained models (e.g., ResNet-101, Inception-v3) and evaluates on tiny ImageNet to validate attack and defense performance.

Experimental results

Research questions

• RQ1 Can a metric other than ℓp norms better capture semantic similarity for generating effective adversarial examples?
• RQ2 How can adversarial examples be made more diverse and semantically consistent while achieving larger perturbations?
• RQ3 Can IWD-based adversarial training improve robustness against unseen adversarial attacks?
• RQ4 What is the theoretical relationship between IWD and attack success rate, and how can it guide defense design?
• RQ5 Does generating adversarial examples on the data manifold lead to better generalization and robustness in DNNs?

Key findings

• IWDA achieves the highest mean ℓ2 and ℓ∞ perturbation distances among all methods, indicating larger adversarial perturbations in Euclidean space.
• Despite large Euclidean perturbations, IWDA maintains the smallest IWD values (close to zero), confirming high semantic similarity between original and adversarial images.
• IWDD achieves superior or comparable robustness to state-of-the-art defenses on PGD-10 and FWAdv attacks, with only minor trade-offs in clean accuracy.
• The ablation study shows that τ=0.1 and β=0.1 yield the best trade-off between clean accuracy and robust accuracy for both IWDA and IWDD.
• Qualitative results show that IWDA generates diverse, realistic, and semantically invariant adversarial examples, unlike baselines that often distort resolution or smoothness.
• Theoretical analysis confirms that robustness improves with diverse adversarial examples covering data manifold blind spots, validated empirically on ImageNet.