Subspace Defense: Discarding Adversarial Perturbations by Learning a Subspace for Clean Signals
Fuente:
arXiv
Enregistré dans:
| Auteurs principaux: | , , , , , |
|---|---|
| Format: | Preprint |
| Publié: |
2024
|
| Sujets: | |
| Accès en ligne: | |
| Tags: |
Ajouter un tag
Pas de tags, Soyez le premier à ajouter un tag!
|
| _version_ | 1866917621491826688 |
|---|---|
| author | Zheng, Rui Zhou, Yuhao Xi, Zhiheng Gui, Tao Zhang, Qi Huang, Xuanjing |
| author_facet | Zheng, Rui Zhou, Yuhao Xi, Zhiheng Gui, Tao Zhang, Qi Huang, Xuanjing |
| contents | Deep neural networks (DNNs) are notoriously vulnerable to adversarial attacks that place carefully crafted perturbations on normal examples to fool DNNs. To better understand such attacks, a characterization of the features carried by adversarial examples is needed. In this paper, we tackle this challenge by inspecting the subspaces of sample features through spectral analysis. We first empirically show that the features of either clean signals or adversarial perturbations are redundant and span in low-dimensional linear subspaces respectively with minimal overlap, and the classical low-dimensional subspace projection can suppress perturbation features out of the subspace of clean signals. This makes it possible for DNNs to learn a subspace where only features of clean signals exist while those of perturbations are discarded, which can facilitate the distinction of adversarial examples. To prevent the residual perturbations that is inevitable in subspace learning, we propose an independence criterion to disentangle clean signals from perturbations. Experimental results show that the proposed strategy enables the model to inherently suppress adversaries, which not only boosts model robustness but also motivates new directions of effective adversarial defense. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2403_16176 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | Subspace Defense: Discarding Adversarial Perturbations by Learning a Subspace for Clean Signals Zheng, Rui Zhou, Yuhao Xi, Zhiheng Gui, Tao Zhang, Qi Huang, Xuanjing Machine Learning Computation and Language Cryptography and Security Deep neural networks (DNNs) are notoriously vulnerable to adversarial attacks that place carefully crafted perturbations on normal examples to fool DNNs. To better understand such attacks, a characterization of the features carried by adversarial examples is needed. In this paper, we tackle this challenge by inspecting the subspaces of sample features through spectral analysis. We first empirically show that the features of either clean signals or adversarial perturbations are redundant and span in low-dimensional linear subspaces respectively with minimal overlap, and the classical low-dimensional subspace projection can suppress perturbation features out of the subspace of clean signals. This makes it possible for DNNs to learn a subspace where only features of clean signals exist while those of perturbations are discarded, which can facilitate the distinction of adversarial examples. To prevent the residual perturbations that is inevitable in subspace learning, we propose an independence criterion to disentangle clean signals from perturbations. Experimental results show that the proposed strategy enables the model to inherently suppress adversaries, which not only boosts model robustness but also motivates new directions of effective adversarial defense. |
| title | Subspace Defense: Discarding Adversarial Perturbations by Learning a Subspace for Clean Signals |
| topic | Machine Learning Computation and Language Cryptography and Security |
| url | https://arxiv.org/abs/2403.16176 |