Eliminating Adversarial Noise via Information Discard and Robust Representation Restoration

Dawei Zhou, Yukun Chen, Nannan Wang, Decheng Liu, Xinbo Gao, Tongliang Liu
Proceedings of the 40th International Conference on Machine Learning, PMLR 202:42517-42530, 2023.

Abstract

Deep neural networks (DNNs) are vulnerable to adversarial noise. Denoising model-based defense is a major protection strategy. However, denoising models may fail and induce negative effects in fully white-box scenarios. In this work, we start from the latent inherent properties of adversarial samples to break the limitations. Unlike solely learning a mapping from adversarial samples to natural samples, we aim to achieve denoising by destroying the spatial characteristics of adversarial noise and preserving the robust features of natural information. Motivated by this, we propose a defense based on information discard and robust representation restoration. Our method utilize complementary masks to disrupt adversarial noise and guided denoising models to restore robust-predictive representations from masked samples. Experimental results show that our method has competitive performance against white-box attacks and effectively reverses the negative effect of denoising models.

Cite this Paper

BibTeX
@InProceedings{pmlr-v202-zhou23b, title = {Eliminating Adversarial Noise via Information Discard and Robust Representation Restoration}, author = {Zhou, Dawei and Chen, Yukun and Wang, Nannan and Liu, Decheng and Gao, Xinbo and Liu, Tongliang}, booktitle = {Proceedings of the 40th International Conference on Machine Learning}, pages = {42517--42530}, year = {2023}, editor = {Krause, Andreas and Brunskill, Emma and Cho, Kyunghyun and Engelhardt, Barbara and Sabato, Sivan and Scarlett, Jonathan}, volume = {202}, series = {Proceedings of Machine Learning Research}, month = {23--29 Jul}, publisher = {PMLR}, pdf = {https://proceedings.mlr.press/v202/zhou23b/zhou23b.pdf}, url = {https://proceedings.mlr.press/v202/zhou23b.html}, abstract = {Deep neural networks (DNNs) are vulnerable to adversarial noise. Denoising model-based defense is a major protection strategy. However, denoising models may fail and induce negative effects in fully white-box scenarios. In this work, we start from the latent inherent properties of adversarial samples to break the limitations. Unlike solely learning a mapping from adversarial samples to natural samples, we aim to achieve denoising by destroying the spatial characteristics of adversarial noise and preserving the robust features of natural information. Motivated by this, we propose a defense based on information discard and robust representation restoration. Our method utilize complementary masks to disrupt adversarial noise and guided denoising models to restore robust-predictive representations from masked samples. Experimental results show that our method has competitive performance against white-box attacks and effectively reverses the negative effect of denoising models.} }
Endnote
%0 Conference Paper %T Eliminating Adversarial Noise via Information Discard and Robust Representation Restoration %A Dawei Zhou %A Yukun Chen %A Nannan Wang %A Decheng Liu %A Xinbo Gao %A Tongliang Liu %B Proceedings of the 40th International Conference on Machine Learning %C Proceedings of Machine Learning Research %D 2023 %E Andreas Krause %E Emma Brunskill %E Kyunghyun Cho %E Barbara Engelhardt %E Sivan Sabato %E Jonathan Scarlett %F pmlr-v202-zhou23b %I PMLR %P 42517--42530 %U https://proceedings.mlr.press/v202/zhou23b.html %V 202 %X Deep neural networks (DNNs) are vulnerable to adversarial noise. Denoising model-based defense is a major protection strategy. However, denoising models may fail and induce negative effects in fully white-box scenarios. In this work, we start from the latent inherent properties of adversarial samples to break the limitations. Unlike solely learning a mapping from adversarial samples to natural samples, we aim to achieve denoising by destroying the spatial characteristics of adversarial noise and preserving the robust features of natural information. Motivated by this, we propose a defense based on information discard and robust representation restoration. Our method utilize complementary masks to disrupt adversarial noise and guided denoising models to restore robust-predictive representations from masked samples. Experimental results show that our method has competitive performance against white-box attacks and effectively reverses the negative effect of denoising models.
APA
Zhou, D., Chen, Y., Wang, N., Liu, D., Gao, X. & Liu, T.. (2023). Eliminating Adversarial Noise via Information Discard and Robust Representation Restoration. Proceedings of the 40th International Conference on Machine Learning, in Proceedings of Machine Learning Research 202:42517-42530 Available from https://proceedings.mlr.press/v202/zhou23b.html.

Related Material