[Paper Review] Stochastic Combinatorial Ensembles for Defending Against Adversarial Examples

George-Alexandru Adam, Petr Smirnov+3 more|arXiv (Cornell University)|Aug 20, 2018

Adversarial Robustness in Machine Learning16 references4 citations

TL;DR

This paper proposes a probabilistic defense framework that leverages neural network depth to generate an exponentially large ensemble of models using a linear number of variational autoencoders (VAEs). By stochastically inserting VAEs between layers, the method reduces adversarial transferability through orthogonal gradients and achieves high detection accuracy, with less than 7% of adversarial examples fooling the combined defense and detector system.

ABSTRACT

Many deep learning algorithms can be easily fooled with simple adversarial examples. To address the limitations of existing defenses, we devised a probabilistic framework that can generate an exponentially large ensemble of models from a single model with just a linear cost. This framework takes advantage of neural network depth and stochastically decides whether or not to insert noise removal operators such as VAEs between layers. We show empirically the important role that model gradients have when it comes to determining transferability of adversarial examples, and take advantage of this result to demonstrate that it is possible to train models with limited adversarial attack transferability. Additionally, we propose a detection method based on metric learning in order to detect adversarial examples that have no hope of being cleaned of maliciously engineered noise.

Motivation & Objective

• To address the vulnerability of deep neural networks to adversarial examples, especially under white-box attack settings.
• To reduce adversarial transferability between models by manipulating model gradients through stochastic VAE insertion.
• To develop a lightweight, scalable defense mechanism that generates a large ensemble of models with minimal computational overhead.
• To improve detection of adversarial examples using metric learning in a triplet network architecture.

Proposed method

• Stochastically insert VAEs between layers of a deep neural network to create a probabilistic ensemble of models with exponential size from linear training cost.
• Train VAEs to reconstruct inputs while introducing controlled gradient variations, even when reconstructions appear visually identical to original inputs.
• Use gradient orthogonality between models as a key defense mechanism to reduce transferability of adversarial examples.
• Combine a VAE-based classifier with a triplet network detector that uses metric learning to distinguish natural from adversarial inputs.
• Optimize a joint model where the detector and classifier are trained together, with the detector output appended as a logit to improve robustness.
• Apply iterative attacks (e.g., CW2) to evaluate the robustness of the combined defense and detector system under adversarial optimization.

Experimental results

Research questions

• RQ1 Can a probabilistic framework generate an exponentially large ensemble of models from a single model with only linear computational cost?
• RQ2 How does stochastic VAE insertion affect model gradients and adversarial transferability?
• RQ3 To what extent can gradient orthogonality between models reduce the success rate of transfer-based adversarial attacks?
• RQ4 Can a metric learning-based detector effectively identify adversarial examples that are resistant to VAE-based cleaning?
• RQ5 How does the joint training of a classifier and detector impact overall robustness against strong adversarial attacks?

Key findings

• The method successfully generated an exponentially large ensemble of models using only a linear number of VAEs, achieving high diversity in model behavior with minimal overhead.
• Despite nearly identical visual reconstructions, different VAE arrangements produced significantly different gradients, challenging the assumption that VAEs have near-identity gradients.
• Gradient orthogonality between models was highly predictive of reduced adversarial transferability, with orthogonal gradients making joint attacks significantly harder.
• The triplet network detector achieved over 96% accuracy in detecting adversarial examples, even when the classifier was fooled.
• The combined defense and detector system reduced adversarial attack success rates to below 7% on the CW2 attack, with only 0.702 success rate for the undefended model dropping to 0.635 when both components were active.