Optimal Transport as a Defense Against Adversarial Attacks

2021/01/10 by Quentin Bouniot, Romaric Audigier, Angélique Loesch
Computer Science · Mathematics · #Adversarial Robustness in Machine Learning #Adversarial system #Algorithm #Anomaly Detection Techniques and Applications #Artificial intelligence #Classifier (UML) #Computer science #Domain Adaptation and Few-Shot Learning #Domain adaptation #Machine learning #Mathematical optimization #Mathematics #Perturbation (astronomy) #Robustness (evolution) #Theoretical computer science #cs.CV #cs.LG #stat.ML

paper · pdf · doi:10.1109/icpr48806.2021.9413327

Accepted at ICPR2020. Code is available at https://github.com/CEA-LIST/adv-sat

openalex publication_date 2021/01/10 · arxiv created 2021/03/30 · arxiv updated 2021/05/19 · openalex created_date 2025/10/10 · openalex updated_date 2026/08/05

Abstract

Deep learning classifiers are now known to have flaws in the representations of their class. Adversarial attacks can find a human-imperceptible perturbation for a given image that will mislead a trained model. The most effective methods to defend against such attacks trains on generated adversarial examples to learn their distribution. Previous work aimed to align original and adversarial image representations in the same way as domain adaptation to improve robustness. Yet, they partially align the representations using approaches that do not reflect the geometry of space and distribution. In addition, it is difficult to accurately compare robustness between defended models. Until now, they have been evaluated using a fixed perturbation size. However, defended models may react differently to variations of this perturbation size. In this paper, the analogy of domain adaptation is taken a step further by exploiting optimal transport theory. We propose to use a loss between distributions that faithfully reflect the ground distance. This leads to SAT (Sinkhorn Adversarial Training), a more robust defense against adversarial attacks. Then, we propose to quantify more precisely the robustness of a model to adversarial attacks over a wide range of perturbation sizes using a different metric, the Area Under the Accuracy Curve (AUAC). We perform extensive experiments on both CIFAR-10 and CIFAR-100 datasets and show that our defense is globally more robust than the state-of-the-art.

Citations

• Intriguing properties of neural networks
• Explaining and Harnessing Adversarial Examples
• Ensemble Adversarial Training: Attacks and Defenses
• Improving the Generalization of Adversarial Training with Domain Adaptation
• Sample Complexity of Sinkhorn divergences
• Improving Adversarial Robustness via Promoting Ensemble Diversity
• Interpolating between Optimal Transport and MMD using Sinkhorn Divergences
• PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples
• Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• On Adaptive Attacks to Adversarial Example Defenses
• Computational Optimal Transport with Applications to Data Sciences
• Learning Multiple Layers of Features from Tiny Images
• On Assessing ML Model Robustness: A Methodological Framework (Academic Track)