PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples

2017/10/30 by Yang Song, Taesup Kim, Song, Yang +7 · 294 citations
Biochemistry, Genetics and Molecular Biology · Computer Science · #Advanced Malware Detection Techniques #Adversarial Robustness in Machine Learning #Adversarial system #Anomaly Detection Techniques and Applications #Artificial intelligence #Artificial neural network #Bacillus and Francisella bacterial research #Classifier (UML) #Computer science #Contextual image classification #FOS: Computer and information sciences #Generative grammar #Generative model #Image (mathematics) #MNIST database #Machine Learning (cs.LG) #Machine learning #Pattern recognition (psychology) #Security and Verification in Computing #cs.LG

paper · pdf · doi:10.48550/arxiv.1710.10766

published in arXiv (Cornell University) (Cornell University) · ICLR 2018

openalex publication_date 2017/10/30 · arxiv created 2018/05/21 · arxiv updated 2018/05/22 · openalex created_date 2019/07/30 · openalex updated_date 2026/08/05

Abstract

Adversarial perturbations of normal images are usually imperceptible to humans, but they can seriously confuse state-of-the-art machine learning models. What makes them so special in the eyes of image classifiers? In this paper, we show empirically that adversarial examples mainly lie in the low probability regions of the training distribution, regardless of attack types and targeted models. Using statistical hypothesis testing, we find that modern neural density models are surprisingly good at detecting imperceptible image perturbations. Based on this discovery, we devised PixelDefend, a new approach that purifies a maliciously perturbed image by moving it back towards the distribution seen in the training data. The purified image is then run through an unmodified classifier, making our method agnostic to both the classifier and the attacking method. As a result, PixelDefend can be used to protect already deployed models and be combined with other model-specific defenses. Experiments show that our method greatly improves resilience across a wide variety of state-of-the-art attacking methods, increasing accuracy on the strongest attack from 63% to 84% for Fashion MNIST and from 32% to 70% for CIFAR-10.

Cited by

• Enhancing Adversarial Robustness of IoT Intrusion Detection via SHAP-Based Attribution Fingerprinting
• When Flatness Does (Not) Guarantee Adversarial Robustness
• Towards Adversarially Robust Object Detection
• Adversarial Training with Stochastic Weight Average
• ShapeAdv: Generating Shape-Aware Adversarial 3D Point Clouds
• Bag of Tricks for Adversarial Training
• Adversarial Example Detection by Classification for Deep Speech Recognition
• Adversarial purification with Score-based generative models
• Learning to Separate Clusters of Adversarial Representations for Robust Adversarial Detection
• Triple Wins: Boosting Accuracy, Robustness and Efficiency Together by Enabling Input-Adaptive Inference
• Understanding Classifier Mistakes with Generative Models
• Theoretically Principled Trade-off between Robustness and Accuracy
• Enhanced countering adversarial attacks via input denoising and feature restoring
• A Survey of Black-Box Adversarial Attacks on Computer Vision Models
• Invert and Defend: Model-based Approximate Inversion of Generative Adversarial Networks for Secure Inference
• Bridging Adversarial Robustness and Gradient Interpretability
• Non-Determinism in Neural Networks for Adversarial Robustness
• Online Adversarial Purification based on Self-Supervision
• GraCIAS: Grassmannian of Corrupted Images for Adversarial Security
• Improved Adversarial Robustness via Logit Regularization Methods
• Enhancing Adversarial Defense by k-Winners-Take-All
• One Man's Trash is Another Man's Treasure: Resisting Adversarial Examples by Adversarial Examples
• Adversarial Neural Pruning with Latent Vulnerability Suppression
• Moving Target Defense for Deep Visual Sensing against Adversarial Examples
• BackFed: An Efficient & Standardized Benchmark Suite for Backdoor Attacks in Federated Learning
• Rectifying Adversarial Sample with Low Entropy Prior for Test-Time Defense
• Improving Adversarial Robustness of Ensembles with Diversity Training
• Understanding the Logit Distributions of Adversarially-Trained Deep Neural Networks
• Extreme Value Preserving Networks
• Adaptive Mask-guided K-space Diffusion for Accelerated MRI Reconstruction
• ME-Net: Towards Effective Adversarial Robustness with Matrix Estimation
• Are Generative Classifiers More Robust to Adversarial Attacks?
• Fighting Gradients with Gradients: Dynamic Defenses against Adversarial Attacks
• When NAS Meets Robustness: In Search of Robust Architectures against Adversarial Attacks
• Detecting Adversarial Examples via Neural Fingerprinting
• Sample-Specific Noise Injection For Diffusion-Based Adversarial Purification
• Adversarial Examples in Modern Machine Learning: A Review
• A Survey of Safety and Trustworthiness of Deep Neural Networks: Verification, Testing, Adversarial Attack and Defence, and Interpretability
• Regularizers for Single-step Adversarial Training
• Silence is Golden: Leveraging Adversarial Examples to Nullify Audio Control in LDM-based Talking-Head Generation
• Fighting Fire with Fire (F3): A Training-free and Efficient Visual Adversarial Example Purification Method in LVLMs
• How Do Diffusion Models Improve Adversarial Robustness?
• What is Adversarial Training for Diffusion Models?
• MixDefense: A Defense-in-Depth Framework for Adversarial Example Detection Based on Statistical and Semantic Analysis
• Discovering Robust Convolutional Architecture at Targeted Capacity: A Multi-Shot Approach
• Diversity can be Transferred: Output Diversification for White- and Black-box Attacks
• ROSA: Robust Salient Object Detection against Adversarial Attacks
• Are L2 adversarial examples intrinsically different?
• Adversarial Detection and Correction by Matching Prediction Distributions
• FlowPure: Continuous Normalizing Flows for Adversarial Purification
• Robust Deep Learning Ensemble against Deception
• Adversarial Robustness Assessment: Why both L₀ and L_∞ Attacks Are Necessary
• Detecting Adversarial Examples from Sensitivity Inconsistency of Spatial-Transform Domain
• Adv-4-Adv: Thwarting Changing Adversarial Perturbations via Adversarial Domain Adaptation
• Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain
• Predify: Augmenting deep neural networks with brain-inspired predictive coding dynamics
• Generalized Score Matching: Bridging f-Divergence and Statistical Estimation Under Correlated Noise
• Structure-Aware Robust Fine-Tuning: Defending Vision-Language-Action Robots Against Physical Attention Hijacking
• Deflecting Adversarial Attacks
• Optimal Transport as a Defense Against Adversarial Attacks
• Minimax Defense against Gradient-based Adversarial Attacks
• Towards Model Resistant to Transferable Adversarial Examples via Trigger Activation
• Almost Tight L0-norm Certified Robustness of Top-k Predictions against Adversarial Perturbations
• Amata: An Annealing Mechanism for Adversarial Training Acceleration
• Do Deep Minds Think Alike? Selective Adversarial Attacks for Fine-Grained Manipulation of Multiple Deep Neural Networks
• Utilizing Adversarial Targeted Attacks to Boost Adversarial Robustness
• Defending Against Frequency-Based Attacks with Diffusion Models
• Adversarial Examples in Environment Perception for Automated Driving (Review)

Related

• Leveraging Generalizability of Image-to-Image Translation for Enhanced Adversarial Defense
• Deflecting Adversarial Attacks with Pixel Deflection
• Generative Adversarial Perturbations
• Quantifying Perceptual Distortion of Adversarial Examples
• Defending against Whitebox Adversarial Attacks via Randomized Discretization