[Paper Review] Towards Understanding Limitations of Pixel Discretization Against Adversarial Attacks

Jiefeng Chen, Xi Wu+3 more|arXiv (Cornell University)|May 20, 2018

Adversarial Robustness in Machine Learning33 references4 citations

TL;DR

This paper investigates pixel discretization as a preprocessing defense against adversarial attacks, proposing data-aware discretization techniques to improve robustness. Despite theoretical and empirical analysis, the study finds that such methods fail against strong white-box attacks on complex datasets like CIFAR-10 due to inherent limitations in cluster separability, concluding that pixel discretization is unlikely to be effective beyond simple datasets such as MNIST.

ABSTRACT

Wide adoption of artificial neural networks in various domains has led to an increasing interest in defending adversarial attacks against them. Preprocessing defense methods such as pixel discretization are particularly attractive in practice due to their simplicity, low computational overhead, and applicability to various systems. It is observed that such methods work well on simple datasets like MNIST, but break on more complicated ones like ImageNet under recently proposed strong white-box attacks. To understand the conditions for success and potentials for improvement, we study the pixel discretization defense method, including more sophisticated variants that take into account the properties of the dataset being discretized. Our results again show poor resistance against the strong attacks. We analyze our results in a theoretical framework and offer strong evidence that pixel discretization is unlikely to work on all but the simplest of the datasets. Furthermore, our arguments present insights why some other preprocessing defenses may be insecure.

Motivation & Objective

• To understand why preprocessing defenses like pixel discretization fail against strong white-box attacks on complex datasets.
• To investigate whether data-specific pixel discretization techniques can improve robustness compared to generic, distribution-agnostic methods.
• To develop a theoretical framework for analyzing the robustness of pixel discretization defenses based on data clustering and separability.
• To provide formal certificates for adversarial robustness under specific conditions, particularly on simple datasets.
• To generalize insights to other preprocessing defenses by analyzing their structural vulnerabilities under strong attacks.

Proposed method

• Proposes data-aware pixel discretization that constructs codewords based on the underlying data distribution, rather than using fixed or uniform quantization.
• Models pixel discretization as a clustering process where pixels are assigned to codewords based on proximity in the input space.
• Introduces a theoretical framework analyzing the trade-off between accuracy and robustness, emphasizing the need for well-separated clusters.
• Develops a formal certificate for adversarial robustness that bounds the minimum perturbation size required to change the discretized output.
• Employs the Backward Pass Differentiable Approximation (BPDA) attack as a strong benchmark to evaluate defense robustness.
• Uses empirical evaluation on MNIST and CIFAR-10 to compare performance of standard and data-specific discretization techniques under adversarial settings.

Experimental results

Research questions

• RQ1 Can data-specific pixel discretization techniques significantly improve adversarial robustness compared to standard, distribution-agnostic methods?
• RQ2 Under what conditions can pixel discretization provably guarantee adversarial robustness?
• RQ3 Why do preprocessing defenses like pixel discretization fail on complex datasets such as CIFAR-10 despite success on MNIST?
• RQ4 How does the separability of pixel clusters in the data distribution affect the robustness of discretization-based defenses?
• RQ5 To what extent can the theoretical insights from pixel discretization be generalized to other preprocessing defense mechanisms?

Key findings

• Pixel discretization performs well on simple datasets like MNIST, where pixel clusters are well-separated, and can be formally certified for robustness.
• On complex datasets like CIFAR-10, pixel discretization fails against strong white-box attacks such as BPDA due to poor cluster separability.
• The method's robustness is fundamentally limited by the trade-off between accuracy and robustness: small clusters needed for accuracy lead to vulnerable boundaries.
• Even sophisticated, data-aware discretization techniques do not significantly improve robustness on complex data, as the underlying base model’s poor adversarial robustness cannot be compensated.
• Theoretical analysis shows that pixel discretization is unlikely to be effective on all but the simplest datasets, due to the inability to form well-separated clusters.
• The findings suggest a general vulnerability in preprocessing defenses: if the base model lacks robustness, preprocessing alone cannot ensure security against strong attacks.