Robustifying models against adversarial attacks by Langevin dynamics.

Journal: Neural networks : the official journal of the International Neural Network Society
Published Date:

Abstract

Adversarial attacks on deep learning models have compromised their performance considerably. As remedies, a number of defense methods were proposed, which however, have been circumvented by newer and more sophisticated attacking strategies. In the midst of this ensuing arms race, the problem of robustness against adversarial attacks still remains a challenging task. This paper proposes a novel, simple yet effective defense strategy where off-manifold adversarial samples are driven towards high density regions of the data generating distribution of the (unknown) target class by the Metropolis-adjusted Langevin algorithm (MALA) with perceptual boundary taken into account. To achieve this task, we introduce a generative model of the conditional distribution of the inputs given labels that can be learned through a supervised Denoising Autoencoder (sDAE) in alignment with a discriminative classifier. Our algorithm, called MALA for DEfense (MALADE), is equipped with significant dispersion-projection is distributed broadly. This prevents white box attacks from accurately aligning the input to create an adversarial sample effectively. MALADE is applicable to any existing classifier, providing robust defense as well as off-manifold sample detection. In our experiments, MALADE exhibited state-of-the-art performance against various elaborate attacking strategies.

Authors

  • Vignesh Srinivasan
    Department of Artificial Intelligence, Fraunhofer Heinrich Hertz Institute, 10587 Berlin, Germany.
  • Csaba Rohrer
    Department of Artificial Intelligence, Fraunhofer Heinrich Hertz Institute, 10587 Berlin, Germany.
  • Arturo Marban
    Department of Artificial Intelligence, Fraunhofer Heinrich Hertz Institute, 10587 Berlin, Germany; Machine Learning Group, Technische Universität Berlin, 10587 Berlin, Germany; BIFOLD - Berlin Institute for the Foundations of Learning and Data, Germany.
  • Klaus-Robert Müller
    Berlin Institute for the Foundations of Learning and Data (BIFOLD), Berlin, Deutschland.
  • Wojciech Samek
    Machine Learning Group, Fraunhofer Heinrich Hertz Institute, Berlin, Germany.
  • Shinichi Nakajima
    Machine Learning Group, Technische Universität Berlin, 10587 Berlin, Germany; BIFOLD - Berlin Institute for the Foundations of Learning and Data, Germany; RIKEN AIP, 1-4-1 Nihonbashi, Chuo-ku, Tokyo 103-0027, Japan. Electronic address: nakajima@tu-berlin.de.