[Paper Review] The Robust Manifold Defense: Adversarial Training using Generative Models

Ajil Jalal, Andrew Ilyas+2 more|arXiv (Cornell University)|Dec 26, 2017

Adversarial Robustness in Machine Learning47 references126 citations

TL;DR

The paper introduces an overpowered latent-space attack using spanners (GANs/VAEs) to craft adversarial pairs that are close in latent space but yield different classifier outputs, circumvents DefenseGAN, and enhances MNIST robustness via a new min-max adversarial training framework.

ABSTRACT

We propose a new type of attack for finding adversarial examples for image classifiers. Our method exploits spanners, i.e. deep neural networks whose input space is low-dimensional and whose output range approximates the set of images of interest. Spanners may be generators of GANs or decoders of VAEs. The key idea in our attack is to search over latent code pairs to find ones that generate nearby images with different classifier outputs. We argue that our attack is stronger than searching over perturbations of real images. Moreover, we show that our stronger attack can be used to reduce the accuracy of Defense-GAN to 3\%, resolving an open problem from the well-known paper by Athalye et al. We combine our attack with normal adversarial training to obtain the most robust known MNIST classifier, significantly improving the state of the art against PGD attacks. Our formulation involves solving a min-max problem, where the min player sets the parameters of the classifier and the max player is running our attack, and is thus searching for adversarial examples in the {\em low-dimensional} input space of the spanner. All code and models are available at \url{https://github.com/ajiljalal/manifold-defense.git}

Motivation & Objective

• Motivate stronger adversarial attacks by leveraging low-dimensional latent spaces (spanners) that approximate real data distributions.
• Propose the overpowered attack that searches latent pairs to maximize output divergence while keeping latent distance small.
• Demonstrate how combining this attack with adversarial training yields state-of-the-art robustness on MNIST.
• Show that the approach can fully circumvent DefenseGAN and is applicable to improving adversarial defenses.

Proposed method

• Define a spanner G: R^k -> R^n whose range approximates the data manifold.
• Formulate the overpowered attack as a max-min problem over latent codes z, z' with constraint ||G(z) - G(z')||_2^2 <= (2η+ε)^2.
• Integrate the overpowered attack into a robust min-max objective that balances classifier accuracy and attack strength (inf_θ μ(sup_{z,z'} L(Cθ(G(z)), Cθ(G(z')))) + (1-μ) training loss).
• Use the attack to circumvent DefenseGAN by proving the latent-space attack can produce near-real-image pairs that mislead the classifier.
• Apply adversarial training with the overpowered attack to MNIST and CelebA datasets, improving robustness against white-box ℓ2-bounded perturbations.
• Provide empirical results comparing against Madry et al. and TRADES.

Experimental results

Research questions

• RQ1 Can a latent-space, overpowered attack in the range of a generative spanner produce stronger adversarial examples than traditional perturbations?
• RQ2 Can integrating such latent-space attacks into adversarial training yield stronger robustness than existing methods (e.g., Madry, TRADES) on MNIST and CelebA?
• RQ3 To what extent can latent-space attacks circumvent defenses that rely on projecting inputs onto the spanner (e.g., DefenseGAN, INC)?
• RQ4 Does reducing the attack search space to a low-dimensional manifold improve the efficacy and tractability of robust optimization for adversarial training?

Key findings

• The overpowered latent-space attack significantly reduces DefenseGAN effectiveness (down to about 3% accuracy under stated settings).
• Combining the overpowered attack with adversarial training improves MNIST robustness against white-box PGD attacks, achieving up to 96.26% adversarial accuracy under certain settings.
• The approach achieves a robustness improvement over TRADES-based baselines on MNIST for ℓ2 perturbations with radius 1.5, reaching 96.26% vs. 91.88%.
• On MNIST with δ up to 2.5, the method maintains high robustness (about 95%+) where some baselines degrade.
• The latent-space attack can train robust classifiers that exhibit natural uncertainty near decision boundaries, demonstrated on MNIST and CelebA.
• The method can also disrupt DefenseGAN more effectively than prior approaches, indicating broader implications for spanner-based defenses.