[Paper Review] Robust Adversarial Learning via Sparsifying Front Ends

Soorya Gopalakrishnan, Zhinus Marzi+3 more|arXiv (Cornell University)|Oct 24, 2018

Adversarial Robustness in Machine Learning53 references4 citations

TL;DR

This paper proposes a sparsity-based defense for deep neural networks by applying a sparsifying front end that projects inputs onto a low-dimensional subspace using sparse representations in an orthonormal basis. The method provably reduces adversarial perturbation impact by a factor of roughly $K/N$ for $ℓ_{\infty}$-bounded attacks, with experiments showing 39.6% robust accuracy on CIFAR-10 using sparsifying front ends and 67.21% with combined adversarial training, outperforming adversarial training alone.

ABSTRACT

It is by now well-known that small adversarial perturbations can induce classification errors in deep neural networks. In this paper, we take a bottom-up signal processing perspective to this problem and show that a systematic exploitation of sparsity in natural data is a promising tool for defense. For linear classifiers, we show that a sparsifying front end is provably effective against $\ell_{\infty}$-bounded attacks, reducing output distortion due to the attack by a factor of roughly $K/N$ where $N$ is the data dimension and $K$ is the sparsity level. We then extend this concept to deep networks, showing that a "locally linear" model can be used to develop a theoretical foundation for crafting attacks and defenses. We also devise attacks based on the locally linear model that outperform the well-known FGSM attack. We supplement our theoretical results with experiments on the MNIST and CIFAR-10 datasets, showing the efficacy of the proposed sparsity-based defense schemes.

Motivation & Objective

• To develop a theoretically grounded, bottom-up defense against adversarial attacks using signal processing principles.
• To address the vulnerability of deep networks to small $ℓ_{\infty}$-bounded perturbations by exploiting data sparsity in high-dimensional inputs.
• To provide provable theoretical guarantees on adversarial robustness through sparsifying front ends, independent of adversarial training.
• To explore the role of locally linear approximations in modeling neural network behavior under adversarial perturbations.
• To demonstrate that sparsity-based preprocessing can enhance robustness without relying solely on adversarial training.

Proposed method

• A sparsifying front end projects inputs onto a $K$-dimensional subspace using a known orthonormal basis, retaining only the $K$ largest coefficients in the sparse representation.
• For linear classifiers, the method reduces adversarial output distortion by a factor of $K/N$ with high probability under a stochastic weight model.
• The locally linear model approximates deep networks as piecewise linear functions, enabling theoretical analysis of adversarial attacks and defenses.
• Theoretical analysis shows that sparsity limits the amplification of $ℓ_{\infty}$-bounded perturbations due to high-dimensional input.
• Experiments use wavelet bases for image data and apply sparsification before classification, with optional integration into adversarial training.
• A hybrid defense combines sparsifying front ends with adversarial training to improve both natural and robust accuracy.

Experimental results

Research questions

• RQ1 Can sparsity in high-dimensional data be systematically exploited to reduce the impact of $ℓ_{\infty}$-bounded adversarial perturbations?
• RQ2 To what extent does a sparsifying front end provably attenuate adversarial attacks in linear classifiers?
• RQ3 How well does the locally linear model capture the behavior of deep networks under adversarial perturbations?
• RQ4 Can sparsity-based preprocessing improve robustness when combined with adversarial training?
• RQ5 Does the choice of sparsifying basis and sparsity level significantly affect robustness and natural accuracy?

Key findings

• For linear classifiers, the sparsity-based defense reduces adversarial output distortion by a factor of roughly $K/N$ with high probability under a stochastic weight model.
• On MNIST, the sparsifying front end alone achieved 38.4% robust accuracy at $\epsilon = 0.3$, significantly improving over the baseline.
• On CIFAR-10, the front end alone achieved 39.60% robust accuracy at $\epsilon = 2/255$ with sparsity levels (3.5, 1, 1)%.
• Combining the front end with adversarial training on CIFAR-10 yielded 67.21% robust accuracy and 88.02% natural accuracy, slightly outperforming adversarial training alone (66.82% robust).
• The defense is effective even when training at $\epsilon = 0.1$ and testing at $\epsilon = 0.2$, demonstrating generalization across attack budgets.
• Theoretical analysis confirms that sparsity limits the amplification of small perturbations, especially in high-dimensional settings.