Loading…

Robust feature learning for adversarial defense via hierarchical feature alignment

•We propose a hierarchical feature alignment method to learn robust features.•We improve the feature similarity along network layers with Wasserstein distance.•The method shows a robust generalization ability on adversarial examples. Deep neural networks have demonstrated excellent performance in mo...

Full description

Saved in:
Bibliographic Details
Published in:Information sciences 2021-06, Vol.560, p.256-270
Main Authors: Zhang, Xiaoqin, Wang, Jinxin, Wang, Tao, Jiang, Runhua, Xu, Jiawei, Zhao, Li
Format: Article
Language:English
Subjects:
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:•We propose a hierarchical feature alignment method to learn robust features.•We improve the feature similarity along network layers with Wasserstein distance.•The method shows a robust generalization ability on adversarial examples. Deep neural networks have demonstrated excellent performance in most computer vision tasks in recent years. However, they are vulnerable to adversarial perturbations generated by adversarial attacks. These human-imperceptible perturbations often lead to severe distortion in the high-dimensional intermediate feature space, which is one of the major reasons for the vulnerabilities in deep neural networks. Therefore, input images with perturbations can completely change the predictions of the networks in the decision space. To overcome this drawback, we propose to progressively align the intermediate feature representations extracted from the adversarial domain with feature representations extracted from a clean domain through domain adaptation. The difference between two feature distributions can be accurately measured via an optimal transport-based Wasserstein distance. Thus, the deep networks are forced to learn robust and domain-invariant feature representations, so that the gap between the different domains is minimized and that the networks are no longer easily fooled by diverse adversaries. Extensive evaluations are conducted on four classification benchmark datasets in white-box attack scenarios. The evaluation results demonstrate a significant performance improvement over several state-of-the-art defense methods.
ISSN:0020-0255
1872-6291
DOI:10.1016/j.ins.2020.12.042