[Paper Review] ME-Net: Towards Effective Adversarial Robustness with Matrix Estimation

Yuzhe Yang, Guo Zhang+2 more|arXiv (Cornell University)|May 28, 2019

Adversarial Robustness in Machine LearningComputer Science35 references60 citations

TL;DR

ME-Net uses random masking followed by matrix estimation to reconstruct images, preserving global structure and improving robustness to adversarial attacks, including strong white-box and black-box attacks.

ABSTRACT

Deep neural networks are vulnerable to adversarial attacks. The literature is rich with algorithms that can easily craft successful adversarial examples. In contrast, the performance of defense techniques still lags behind. This paper proposes ME-Net, a defense method that leverages matrix estimation (ME). In ME-Net, images are preprocessed using two steps: first pixels are randomly dropped from the image; then, the image is reconstructed using ME. We show that this process destroys the adversarial structure of the noise, while re-enforcing the global structure in the original image. Since humans typically rely on such global structures in classifying images, the process makes the network mode compatible with human perception. We conduct comprehensive experiments on prevailing benchmarks such as MNIST, CIFAR-10, SVHN, and Tiny-ImageNet. Comparing ME-Net with state-of-the-art defense mechanisms shows that ME-Net consistently outperforms prior techniques, improving robustness against both black-box and white-box attacks.

Motivation & Objective

• Motivate robust image classification by destroying adversarial structure while preserving global image structure.
• Propose a preprocessing pipeline that uses random masking and matrix estimation (ME) for reconstruction.
• Demonstrate that ME-Net enhances robustness under both black-box and white-box attacks.
• Show that ME-Net can be combined with standard SGD or adversarial training to improve robustness.

Proposed method

• Apply random pixel masking to each image during training and test.
• Reconstruct masked images using matrix estimation (ME), typically Nuclear Norm minimization.
• Train the classifier on reconstructed images (with optional adversarial training).
• At inference, mask a test image with the training-average masking probability and reconstruct before classification.
• Optionally compare ME methods (Nuclear Norm, Soft-Impute, USVT) and analyze computational trade-offs.

Experimental results

Research questions

• RQ1 Does the masking-plus-ME reconstruction remove adversarial structure while preserving global image structure?
• RQ2 Can ME-Net improve robustness against both black-box and white-box attacks across multiple datasets?
• RQ3 Does ME-Net synergize with adversarial training to outperform state-of-the-art defenses under strong attacks?
• RQ4 How do different ME reconstruction methods compare in terms of accuracy, robustness, and complexity?

Key findings

• ME-Net significantly improves robustness under black-box attacks, outperforming prior methods on CIFAR-10.
• ME-Net with adversarial training achieves state-of-the-art white-box robustness, e.g., 52.8% accuracy on CIFAR-10 with ResNet-18 under strong BPDA attacks.
• ME-Net maintains or improves generalization on clean data across MNIST, CIFAR-10, SVHN, and Tiny-ImageNet.
• ME-Net is effective against adaptive white-box attacks that target preprocessing pipelines.
• Different ME methods yield similar robustness with varying computational costs; USVT is fastest, Nuclear Norm is robust but slowest.