[Paper Review] Towards Adversarial Purification using Denoising AutoEncoders

Dvij Kalaria, Aritra Hazra+1 more|arXiv (Cornell University)|Aug 29, 2022

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper proposes APuDAE, a non-differential adversarial purification framework that adaptively minimizes reconstruction error in Denoising AutoEncoders (DAEs) to restore adversarial inputs to their clean forms. By iteratively refining inputs to reduce DAE reconstruction error while preserving image quality, APuDAE achieves state-of-the-art robustness against strong adaptive attacks on MNIST, CIFAR-10, and ImageNet, outperforming direct DAE application and adversarial training.

ABSTRACT

With the rapid advancement and increased use of deep learning models in image identification, security becomes a major concern to their deployment in safety-critical systems. Since the accuracy and robustness of deep learning models are primarily attributed from the purity of the training samples, therefore the deep learning architectures are often susceptible to adversarial attacks. Adversarial attacks are often obtained by making subtle perturbations to normal images, which are mostly imperceptible to humans, but can seriously confuse the state-of-the-art machine learning models. We propose a framework, named APuDAE, leveraging Denoising AutoEncoders (DAEs) to purify these samples by using them in an adaptive way and thus improve the classification accuracy of the target classifier networks that have been attacked. We also show how using DAEs adaptively instead of using them directly, improves classification accuracy further and is more robust to the possibility of designing adaptive attacks to fool them. We demonstrate our results over MNIST, CIFAR-10, ImageNet dataset and show how our framework (APuDAE) provides comparable and in most cases better performance to the baseline methods in purifying adversaries. We also design adaptive attack specifically designed to attack our purifying model and demonstrate how our defense is robust to that.

Motivation & Objective

• To address the vulnerability of deep learning models to imperceptible adversarial perturbations in safety-critical applications.
• To develop a defense mechanism that purifies adversarial inputs rather than merely detecting them.
• To improve upon direct DAE-based purification, which often blurs images and is vulnerable to gradient-based attacks.
• To design a non-differentiable, adaptive purification process that resists white-box and grey-box adaptive attacks.
• To evaluate robustness against novel adaptive attacks specifically targeting the purification mechanism.

Proposed method

• APuDAE uses a Denoising AutoEncoder (DAE) trained to reconstruct clean images from noisy inputs, learning the underlying data distribution.
• Instead of directly applying the DAE to adversarial inputs, the method adaptively refines the input by minimizing reconstruction error through iterative updates.
• The iterative refinement process uses a projected gradient method to perturb the input image in the direction that reduces reconstruction error, constrained within an epsilon ball.
• The method incorporates random noise and transformations at each step to improve robustness and avoid mode collapse during optimization.
• The purification process is non-differentiable, making it resistant to gradient-based adaptive attacks that target the defense mechanism.
• The framework is evaluated using two adaptive attacks: one targeting the classifier via gradient ascent, and another combining classifier and DAE reconstruction loss to fool both simultaneously.

Experimental results

Research questions

• RQ1 Can adaptive minimization of DAE reconstruction error improve adversarial purification without blurring clean features?
• RQ2 How does non-differentiable, iterative refinement of inputs compare to direct DAE application in terms of robustness and accuracy?
• RQ3 Can the proposed method resist strong adaptive attacks that target both the classifier and the defense mechanism?
• RQ4 Does the use of adaptive noise and transformations during refinement enhance robustness against evasion attacks?
• RQ5 How does APuDAE perform relative to adversarial training and other state-of-the-art purification methods on diverse benchmarks?

Key findings

• On MNIST, APuDAE achieved 89.1% accuracy against adaptive attack A and 85.7% against attack B, significantly outperforming direct DAE purification (79.9% and 81.5% respectively).
• On CIFAR-10, APuDAE achieved 68.0% accuracy against attack A and 50.7% against attack B, surpassing the direct DAE method (19.9% and 27.5%) and adversarial training (48.3%).
• On ImageNet, APuDAE achieved 53.6% accuracy against attack A and 40.7% against attack B, outperforming both direct DAE (13.4% and 31.2%) and adversarial training (25.4%).
• The adaptive purification method reduced image blurring compared to direct DAE application, preserving classifier accuracy on clean inputs.
• The non-differentiable nature of the method made it resilient to gradient-based adaptive attacks, as shown by the consistent performance drop in direct DAE but not in APuDAE.
• The integration of random noise and transformations at each optimization step further improved robustness, especially against edge-based attacks that exploit low reconstruction sensitivity.