Cycle-Consistent Adversarial GAN: The Integration of Adversarial Attack and Defense

• Published in: Security and communication networks 2020, Vol.2020 (2020), p.1-9
• Main Authors: Yan, Bin, Chen, Jian, Yu, Wanting, Wang, Linyuan, Qin, RuoXi, Qiao, Kai, Jiang, Lingyun, Bu, Haibing
• Format: Article
• Language: English
• Subjects: Algorithms; Artificial neural networks; Datasets; Deep learning; Defense; Image classification; Machine learning; Methods; Neural networks; Success
• ISSN: 1939-0114; 1939-0122
• DOI: 10.1155/2020/3608173

In image classification of deep learning, adversarial examples where input is intended to add small magnitude perturbations may mislead deep neural networks (DNNs) to incorrect results, which means DNNs are vulnerable to them. Different attack and defense strategies have been proposed to better research the mechanism of deep learning. However, those researches in these networks are only for one aspect, either an attack or a defense. There is in the improvement of offensive and defensive performance, and it is difficult to promote each other in the same framework. In this paper, we propose Cycle-Consistent Adversarial GAN (CycleAdvGAN) to generate adversarial examples, which can learn and approximate the distribution of the original instances and adversarial examples, especially promoting attackers and defenders to confront each other and improve their ability. For CycleAdvGAN, once the GeneratorA and D are trained, GA can generate adversarial perturbations efficiently for any instance, improving the performance of the existing attack methods, and GD can generate recovery adversarial examples to clean instances, defending against existing attack methods. We apply CycleAdvGAN under semiwhite-box and black-box settings on two public datasets MNIST and CIFAR10. Using the extensive experiments, we show that our method has achieved the state-of-the-art adversarial attack method and also has efficiently improved the defense ability, which made the integration of adversarial attack and defense come true. In addition, it has improved the attack effect only trained on the adversarial dataset generated by any kind of adversarial attack.