# Mitigating the Impact of Adversarial Attacks in Very Deep Networks

Mohammed Hassanin  School of Engineering and Information Technology,
University of New South Wales @ ADFA, Canberra, ACT 2600, Australia. E-mail:
<EMAIL_ADDRESS>Ibrahim Radwan  Faculty of Science and
Technology, University of Canberra. E-mail<EMAIL_ADDRESS>Nour Moustafa  School of Engineering and Information Technology, University of
New South Wales @ ADFA, Canberra, ACT 2600, Australia. E-mail:
<EMAIL_ADDRESS>Murat Tahtali  School of Engineering and
Information Technology, University of New South Wales @ ADFA, Canberra, ACT
2600, Australia. E-mail<EMAIL_ADDRESS>Neeraj Kumar  Thapar
Institute of Engineering and Technology, Patiala (Punjab), India. E-mail:
<EMAIL_ADDRESS>
###### Abstract

Deep Neural Network (DNN) models have vulnerabilities related to security
concerns, with attackers usually employing complex hacking techniques to
expose their structures. Data poisoning-enabled perturbation attacks are
complex adversarial ones that inject false data into models. They negatively
impact the learning process, with no benefit to deeper networks, as they
degrade a model’s accuracy and convergence rates. In this paper, we propose an
attack-agnostic-based defense method for mitigating their influence. In it, a
Defensive Feature Layer (DFL) is integrated with a well-known DNN architecture
which assists in neutralizing the effects of illegitimate perturbation samples
in the feature space. To boost the robustness and trustworthiness of this
method for correctly classifying attacked input samples, we regularize the
hidden space of a trained model with a discriminative loss function called
Polarized Contrastive Loss (PCL). It improves discrimination among samples in
different classes and maintains the resemblance of those in the same class.
Also, we integrate a DFL and PCL in a compact model for defending against data
poisoning attacks. This method is trained and tested using the CIFAR-10 and
MNIST datasets with data poisoning-enabled perturbation attacks, with the
experimental results revealing its excellent performance compared with those
of recent peer techniques.

###### keywords:

Deep Neural Network , Adversarial Attack, Data Poisoning, Defensive Feature
Layer, Polarised-Contrastive Loss, Regularising Hidden Space

##  1 Introduction

(a)

(b)

Figure 1: The values of training (a) and validation (b) losses of ResNet-18,
ResNet-34 and ResNet-50 architectures.

Deep learning algorithms have been widely used to develop real-world
applications, for example, autonomous driving [1], bio-metric identification
[48], surveillance systems [36], keypoint detection [44], and cyber-security
systems [31]. However, these applications are vulnerable to various
sophisticated attacking scenarios due to weaknesses in their learning
processes. Attackers attempt to compromise the structures of deep learning
models, for example, during their stages of training, testing, parameter
tuning and creating input datasets, using complex and persistent hacking
techniques of which a data poisoning attack is one of the most serious. It
makes a model vulnerable and less trustworthy as an attacker illegally alters
legitimate data in its training stage to considerably degrade its performance
[31, 50].

The trustworthiness of deep learning models for combating data poisoning
attacks has become one of the main issues for industry and research
communities [32]. In order to develop a robust one, adversarial hacking
scenarios, such as data poisoning-enabled perturbations, should be designed to
estimate to what extent a model correctly classifies data inputs. While such
attacks often illegally inject perturbations into input samples, they
significantly degrade a model’s performance due to small variations in the
feature space between normal and abnormal observations.

To alleviate the negative impacts of attacks, multiple types of defenses in
deep learning methods have been introduced in the literature [26, 23, 55, 45,
51, 2, 24, 34]. TThese approaches are classified as three types. Firstly,
input transformation-dependent ones eliminate added perturbations and their
impacts on data samples and improve a model’s accuracy against attack
activities. Secondly, network modification-based ones adapt a network’s
architecture, such as by adding parallel branches to its baseline, to protect
it against adversarial attacks [11, 4]. Thirdly, gradient mask-based ones
attempt to increase the linearity of the training process to reduce
adversarial effects in a less risky manner [40, 33, 25, 37, 52, 19].

Existing defense approaches are capable of enhancing a model’s efficiency for
handling some attack types rather than others. However, input transformation-
based ones require the perturbation scale to be minimal while regularization-
and network modification-based ones are more vulnerable to white-box attacks,
such as those of data poisoning. In this paper, we propose a generative
adversarial defensive method with a regularized feature layer which considers
the risk of its performance for a very deep network degrading.

Moreover, we observe that, by training using adversarial settings, the problem
of a gradient vanishing is more likely to occur in a deep architecture than
small network, even with a small adversarial perturbation budget, that is, a
shallow network’s convergence is slightly better than that of a deeper one.
The issue of decreasing accuracy when stacking more layers together in a
network is addressed in [16] but, given adversarial attacks, is highlighted
again for deeper networks. This means that, even with a slight perturbation
applied to a benign input instance, the accuracy of classification degrades
drastically, particularly with deeper networks. This observation is validated
by training three ResNet architectures(i.e. ResNet-18, ResNet-34 and
ResNet-50) using the same training settings(e.g. adversarial PGD attack for
$10$ iterations), with the loss curves depicted in Figure 1. The deeper the
architecture, the less convergence of the loss values as well as a greater
decrease in accuracy.

To address the degradation of accuracy in a deep architecture while training
using adversarial settings, e.g., data poisoning, we propose augmenting each
ResNet architecture with a Defensive Feature Layer (DFL), which neutralizes
the impact of the perturbations added in the feature space, and a
regularization term that improves the decision boundaries between the learned
classes. The proposed DFL plays a crucial role in denoising the perturbations
in the feature space and produces defensive feature maps which address the
accuracy issue. Although the DFL added to defend against adversarial attacks
is solid, it represents only one type of defense (i.e. network modification).
To increase the robustness of the proposed method against data poisoning
attacks, we regularize the extracted features in the hidden space using a
discriminative loss function called Polarized Contrastive Loss (PCL). This
increases the separation between samples in different classes in the feature
space and maintains the similarity of those in the same one. The proposed
method is tested on the two common datasets CIFAR-10 [18] and MNIST [22] and
shows significant improvements compared with baseline methods.

The key contributions of proposed method are summarised as follows:

  * 1.

A new generative defensive method mitigates the impacts of adversarial attacks
and addresses the issue of accuracy degradation and model convergence in Deep
Neural Networks (DNNs).

  * 2.

A new regularization function efficiently maps the feature space to the output
space to enable better classification accuracy.

  * 3.

The two components of the proposed method are combined to form a robust
defense against adversarial and data poisoning attacks, with the experimental
results obtained using two common datasets presented.

##  2 Related Work

###  2.1 Adversarial Deep Learning

Deep learning models have various vulnerabilities related to security concerns
[15, 47] which can involve the exposure of their data inputs, structures,
training and testing phases, parameter tuning processes, feature extraction
techniques or outputs. Attackers often use complex hacking techniques called
Advanced Persistence Threats (APTs) [15] to breach the security principles of
Confidentiality, Integrity and Availability (CIA) and the potential designs of
deep learning algorithms and their inputs [47]. Attacks on confidentiality
attempt to infiltrate a model’s structure, including its training and testing
phases and parameter tuning process, in order to expose its datasets.
Integrity attacks aim to alter, and inject malicious activity into, a model’s
training and testing sets. Attacks on availability try to prevent legitimate
users from accessing a model’s processes for extracting features and inferring
suspicious activities [31, 9].

To study the robustness and trustworthiness of developing algorithms while
exploiting them using hacking scenarios such as data poisoning, adversarial
deep learning algorithms have emerged [47, 9]. Adversaries try to discover
weak stochastic properties and dynamic data distributions in deep learning
models [31]. Examples of adversarial attacks with perturbation functions
confuse a model’s classifiers and degrade its performance. The idea of
adversarial examples was used to develop the L-BFGS model that could improve
its accuracy [51].

Using a Fast Gradient Sign Method (FGSM), Goodfellow et al. [12] generated
adversarial examples $\tilde{x}$ from a normal sample $x$ by linearizing the
model’s maximization. The potential process of FGSM is to move in the opposite
direction of the gradient of a loss function.

The Basic Iterative Method (BIM) was proposed and integrated with FGSM to
generate adversarial examples by repeating it for multiple iterations. At
every iteration, the generated values were clipped to represent a small change
change from those of the original samples [20].

Similar to BIM [20], Yinpeng et [8] proposed the Momentum Iterative Method
(MIM) as another variant of the FGSM attack that generates adversarial
examples through the iterative process but defined a new term, decay $\mu$
parameter, to stabilize the direction of the gradient.

Madry et al. [27] showed that the BIM [20] is a projected descent for negative
loss function. Based on that, they developed Projected Gradient Descent (PGD)
to address this issue through focusing to select some points around the clean
input sample within the $L_{\infty}$ to address this issue. It has proven to
be a strong attack and its adversarial training is relatively more robust
against all attacks.

###  2.2 Defense Approaches

Traditional machine learning models have been proven to be vulnerable to
complex attacks. However, they can be defensive and robust using various types
of techniques, such as adversarial training [13, 21, 52, 35], network
architecture modification [42, 56, 43] and input transformation [5, 10, 29,
49, 26, 23, 55].

Adversarial training, which mainly trains a whole model based on injected
adversarial examples, is the most popular defense against attacks. It can be
considered as a noise added to the training process to improve the robustness
of the model. However, it requires more time than the normal training process
to generate and inject perturbed clean ones and more space to accommodate its
additional steps.

Another way of improving the robustness of a machine learning method is to
transform its input samples to eliminate the effect of an attack before
feeding it into the model. Autoencoders have been used to remove the noise in
an input sample and reduce the effect of an attack [14]. Osadchy et. al., [38]
processed an image using a set of filters to remove the noise. In [6], Das et.
al., used JPEG compression as a pre-processing step to eliminate the noise
from an adversarial example. Liao et al. employed the reconstruction error of
high-level features to guide de-noisers [23]. Xie et. al., alleviated the
adversarial effects by pre-processing input samples using various techniques
such as random re-sizing and padding.

Another set of defenses is based on making the classifiers more defensive
against perturbations [39, 41, 30], with these methods dependent on sharpening
the decision boundaries of Cross-entropy (CE) for better classification. In
[46], Ross et. al., penalized a change in the output due to perturbations by
regularizing the gradient of the classifier’s loss (CE). Nayebi et. al., used
non-linear activations to increase the robustness of a network and proposed a
loss function that encouraged similar activations to be in their regime.
Although these methods have shown their robustness against white-box attacks,
they are vulnerable to black-box ones [52].

As each of the previous methods focuses on only one style of defense (i.e.,
network modification, gradient mask or input transformation), their algorithms
fail in some way one side of the attacks. Based on that, our proposed approach
combines two main defenses: 1) network modification, namely DFL, to increase
robustness against black-box attacks; and 2) the proposed PCL as a regularizer
added to the CE to discriminate among classes in the feature space and
increase the linearity of the training process. In this way, it defends
against all types of attack.

##  3 Proposed Method

Figure 2: Pipeline of the proposed adversarial training: The activation maps
of each convolutional layer is sent to a deconvolutional block, and then their
outputs are concatenated to form the defensive features. The Polarised
Contrastive Loss (PCL) is used to regularise the hidden space of the network,
while the final output is regularised with the Cross Entropy (CE) loss
function.

###  3.1 Method Overview

Training a Classifier $f_{\theta}:X\rightarrow Y$, where $\theta$ represents
the learned parameters, encodes a compact form of the relationship between
input and output spaces. The input space involves the training instances
(i.e., images), $X=\\{x_{1},x_{2},...,x_{n}\\}$, where $x_{i}$ is an input
instance and $n$ is the total number of instances in the input space while the
latter represents the set of possible classes, that is,
$Y=\\{y_{1},y_{2},...,y_{k}\\}$, where $y_{j}\in\mathcal{R}$ represents the
$j^{th}$ class in the output space and $k$ is the total number of classes.

To mitigate the impact of adversarial attacks, we augment the input space with
adversarial examples generated by adding perturbations to input instances ,
with $\tilde{x}=x_{i}+\epsilon$ an adversarial example created from a benign
instance, $x_{i}$, and $\epsilon$ the perturbation scale of an adversarial
attack. These examples are generally designed to increase the robustness and
improve the generalization capacities of the classifiers. In our method, the
input space is obfuscated by different types of attacks to produce various
adversarial examples.

Adding adversarial examples while training a classifier presents two
challenges. Firstly, the features extracted from the input instances and
passed to the classification step need to be highly defensive against
different types of adversarial attacks. This enables the features of benign
and adversarial instances, which belong to the same class, to be close to each
other in the feature space. Secondly, the classification boundaries between
different classes are required to be separable. The proposed method is
designed to address these two challenges. A DFL is added to a DNN to
neutralize the impacts of illegitimate perturbations in the feature space.
Then, the PCL is introduced to enhance inter-class variabilities and
discrepancies among different classes as well as improve intra-class
compactness. The pipeline of the proposed method is depicted in Figure 2

###  3.2 Defensive Feature Layer

The baseline DNN ResNet [16] comprises a sequence of convolutional layers,
each of which is a mix of convolution, pooling, normalization, skip
connections and non-linear activation functions, with the output of each
passed as an input to the next layer. Plugging adversarial examples into such
deep networks during training results in degraded accuracy, to avoid which we
add a DFL while extracting the features of the input instances. This layer
tries to remove the impact of the added noise (i.e., perturbations) in the
feature space and consists of a concatenation of the output from the
convolutional layers and sequence of deconvolutional blocks.

(a)

(b)

Figure 3: Error values of training (a) and validation (b) deep architectures
(ResNet-18, ResNet-34 and ResNet-50) under the PGD attack.

#### Deconvolution Blocks:

As the convolutional layers contain sequentially connected convolution and
pooling operations, the deconvolutional blocks may guide the network to focus
on extracting the salient features from its input instances but image details
may be lost. Although these blocks, especially on the shallow layers, have the
capacity to compensate for any loss, plugging them into only the output from
the last convolutional layer (i.e., as a decoder [28]) will not be a good
option for neutralizing the impact of adversarial attacks as image details
will already be lost. In our network, we solve this issue by adding a
deconvolutional block after each convolutional layer. The deconvolutional
blocks learn kernels that neutralize the added perturbations and retain image
details because they make top–down projections by mapping the activation maps
back to the input space. The pooling layer is used to unify the feature maps
of all the layers. Technically, the activation maps
$F_{i}\in\mathcal{R}^{c\times w\times h}$ are generated from the convolutional
layers, where $c$ is the number of learned kernels in the convolutional layer,
while $w$ and $h$ are the width and heights of the extracted activation maps,
respectively. Each of these maps is passed to a deconvolutional layer, as
shown on the upper branch of Figure 2), which helps to reduce perturbations in
the adversarial samples and obtain the extracted maps that are similar to the
corresponding ones of the clean samples in the feature space.

The output from each deconvolutional layer, $D(F_{i})$, is concatenated with
the output of last convolutional layer, $F_{m}$, where $D$ represents the
internal operations of a deconvolutional block; whereas $m$ is the number of
the convolutional layers in the baseline network. The features extracted from
the DFL are

$F=F_{m}\oplus\mathbin{\|}_{j=1}^{m-1}D(F_{j}),$ (1)

where $\mathbin{\|}$ refers to the concatenation of the maps, which are
extracted from the deconvolutional blocks and $\oplus$ that of the outputs
from the deconvolutional block and final convolutional layer in the network.
Also, these feature maps are passed to max-pooling operations to satisfy
dimensional requirements. The skip connections between the deconvolutional
blocks and concatenation layer require the model to be aware of the context of
the extracted features as well as enable back-propagation of the gradients to
the shallow layers which yields a better convergence while training the model
and prevents the gradient vanishing. Then, the concatenated features become
more defensive against adversarial attacks which leads to the training and
validation error rates decreasing more for ResNet-50 than for ResNet-18 and
ResNet-34, as shown in Figure 3, contrary to what can be observed in Figure 1.
This demonstrates the effectiveness of using the DFL to defend against
adversarial attacks in very deep architectures.

###  3.3 Polarised Contrastive Loss

(a) a

(b) b

(c) c

(d) d

Figure 4: A visual representation of the decision boundary btween two classes
using: a) Cross Entropy loss, b) Center loss [54], c) Additive Margin with
Cross Entropy loss [7], and the Polarised Contrastive Loss (PCL) functions.

A DNN for multi-class classification is trained by passing the input samples
through different layers and blocks of the network. The extracted features are
then mapped to the output space by an objective function learning this mapping
between the feature and output spaces, with CE the traditional one defined as

$\mathcal{L}_{CE}(f_{i},y)=\frac{1}{n}\sum_{i=1}^{n}-\log\frac{\exp(\phi_{i})}{\sum_{j}\exp(\phi_{j})},$
(2)

where, $f_{i}\in R^{d}$ represents the extracted features, with $d$ is the
size of the extracted features.

Also, $\phi_{i}=f^{T}_{i}\cdot w_{y_{i}}$ is the dot product between the
extracted features of a sample $x_{i}$ and the corresponding vector
representing the true class, $w_{y_{i}}$. In adversarial training, CE usually
fails to discriminate between the benign and adversarial samples in the
feature space because it does not explicitly enforce a robust margin between
learned classes. This leads to the features of samples obtained from different
classes overlapping which makes it easier for an attacker to deceive the
classifier even if the perturbation scale is minimal. To address this issue
and improve the robustness of the trained classifier in an adversarial
setting, two constraints need to be enforced when mapping the feature space to
the output one. Firstly, the intra-class variability should be minimized and,
secondly, the inter-class discrepancy maximized.

Inspired by [54], and to satisfy the first constraint, we force the features
of input samples from the same class to be assembled around the center of
their class’s weight, $w_{y_{i}}^{c}$. This is performed by computing the
distances between these features and the learned centroids of their
corresponding classes as

$\mathcal{L}_{intra}(f_{i},y)=\sum_{i}\parallel f_{i}-w_{y_{i}}^{c}\parallel$
(3)

To comply with the second constraint, the inter-class variability considers
two parts: 1) maximizing the difference between the features of one class
$y_{i}$ and centroids of the others; and 2) maximizing the discrepancy between
the centroids of different classes. These two quantities represent the inter-
regularization term in our objective function which is computed as

$\mathcal{L}_{inter}(f_{i},y)=\frac{1}{k-1}\sum_{j\neq y_{i}}^{K-1}\parallel
f_{i}-w^{c}_{j}\parallel+\arccos(w_{y_{i}}^{c}\ w^{c}_{j}),$ (4)

where, the first term, $\parallel f_{i}-w^{c}_{j}\parallel$, encourages the
features of class $y_{i}$ to be separated from the other classes’ centroids.
The second term, $\arccos(w_{y_{i}}^{c}\ w^{c}_{j})$ enables the decision
margins between the centroids of the classes to be separated sufficiently to
prevent the overlapping of features from different classes (more details are
provided in [7]). Visual representations of the CE and added regularization
terms are depicted in Figure 4.

The objective function (i.e., the PCL) for training the proposed network
consists of the CE and regularization terms as

$\mathcal{L}(f_{i},y)=\mathcal{L}_{CE}+\mathcal{L}_{inter}+\mathcal{L}_{intra}$
(5)

The proposed method combines the advantages of the DFL, which neutralizes the
impact of the added perturbations, and using the PCL as an objective function
to reduce the overlap of samples of different classes in the feature space.
This helps to nullify the impacts of adversarial attacks, enforces robust
decision boundaries between the classes and centralizes the features of
samples from the same category around the centroids of their classes.

##  4 Experiments

In this section, details of the implementation of the proposed method are
provided and quantitative comparisons of it and baseline approaches conducted
to validate its strength. The performances of the complete proposed method
(with both the DFL and PCL) are discussed and then the effectiveness of these
components considered separately in more detail to demonstrate their impacts
in the adversarial training settings. Generally, the proposed method
outperforms state-of-the-art techniques and introduces a new benchmark for
adversarial training on the [18] and MNIST [22] datasets.

Table 1: Comparison between the proposed method (PCL + DFL) and the baseline
approaches for MNIST dataset.  No Defense
---
Defenses | FGSM | PGD-10 | C&W
ResNet-50 | 4.9 | 0.0 | 0.2
Mustafa et al. [33] | 31.1 | 19.9 | 29.1
Dynamic [53] | 14.04 | 0.0 | 0.0
Proposed Method | 89.93 | 57.54 | 84.14
Adversarial Training
Defenses | FGSM | PGD-10 | C&W
ResNet-50 | 59.50 | 57.19 | 57.09
Mustafa et al. [33] | 53.10 | 34.50 | 40.90
Dynamic [53] | 95.34 | 91.63 | 91.47
Proposed Method | 98.68 | 98.31 | 98.18

###  4.1 Implementation Details

The ResNet-50 architecture is used as the core of the proposed method, with
both the DFL and PCL examined while embedded in it. In the experiments, we
conduct adversarial training using three attacks: the FGSM [12], PGD [27] and
C&W [3]. The parameters of the architecture are the default ones of ResNet-50
and the kernel size of each deconvolutional block $1\times 1$, with the max-
pooling layers adapted to make the size of each feature map the same as that
of the last convolutional layer of the network. The number of training epochs
is $100$ and $50$ for the CIFAR-10 and MNIST datasets, respectively, with the
learning rate $0.1$ and batch size $64$ in all the experiments. The number of
iterations of an adversarial attack for poisoning a sample is $10$, with the
perturbation scale $0.03$ for the CIFAR-10 and $0.3$ for the MNIST datasets
while, for the C&W parameters, c = $0.1$.

###  4.2 Baselines

The proposed method is compared with three baseline approaches: 1) the
ResNet-50 architecture with a CE loss; 2) a gradient mask-based technique
which is the closest to our proposed objective function [33]; and 3) a dynamic
training strategy [53]. The comparison is performed with no attack provided in
the training process (i.e., ’no defense’) but some in the testing one, and
then with attacks to poison the input samples in the training and testing
phases (i.e., adversarial training).

###  4.3 Results and Discussion

MNIST: The results obtained by the proposed and three baseline methods on the
MNIST dataset presented in Table 1 show that the former outperforms the others
by more than $60\%$ in the ’no defense’ settings and by $37\%$ in the
adversarial ones. This introduces a new benchmark for the MNIST dataset with
adversarial training and indicates that ’no defense’ training is more
difficult than black-box defensive methods since the trained model does not
have any security which proves that the proposed method is more robust against
both white- and black-box attacks.

Table 2: Comparison between the proposed method (PCL + DFL) and the baseline
approaches for CIFAR-10 dataset.  No Defense
---
Defenses | FGSM | PGD-10 | C&W
ResNet-50 | 21.4 | 0.01 | 0.6
Mustafa et al. [33] | 67.70 | 27.20 | 37.30
Dynamic [53] | 2.20 | 0.0 | 0.0
Proposed Method | 43.85 | 38.70 | 53.07
Adversarial Training
Defenses | FGSM | PGD-10 | C&W
ResNet-50 | 2.2 | 0.0 | 0.0
Mustafa et al. [33] | 75.80 | 46.70 | 51.80
Dynamic [53] | 52.81 | 48.06 | 37.26
Proposed Method | 91.80 | 74.50 | 61.30

CIFAR-10: The performances of the proposed method using the CIFAR-10 dataset
depicted in Table 2 show they are better than those of the three baseline
approaches by more than $10\%$ with ’no defense’ settings for both the PGD-10
and C&W attacks whereas [33] achieves better results for the FGSM attack.
Nevertheless, the proposed method is superior to all the baseline approaches
by $10$ $28\%$ with adversarial settings for the different types of attacks.
Therefore, as the proposed method achieves significant results for both the
’no defense’ and adversarial training settings, it represents the benchmarks
for both types of attack. Finally, the results reported in Tables 1 and 2
validate the robustness of the proposed method against different types of
adversarial attacks.

###  4.4 Ablation Analysis

Effectiveness of Defensive Feature Layer: The impact of the DFL on the whole
training process is investigated. Initially, 5 shows the validation and
training accuracy values using the DFL embedded in the different ResNet
architectures under one of the most difficult attacks (i.e., PGD). As
mentioned in Section 1, adversarial attacks eliminate the power of very deep
networks. Therefore, the entire theory of deep networks is not valid in the
presence of adversarial attacks. To justify how the DFL addresses this issue,
three network architectures, ResNet-18, ResNet-34 and ResNet-50, are trained
using a PGD attack. In Figures 1, 3 and 5, it is very clear that the deeper
the model, the better the results obtained when the DFL is embedded in the
architectures. Then, the training curve of ResNet-34 shows higher accuracy
than that of ResNet-18 whereas ResNet-50 outperforms both, with a significant
difference of $7.1\%$ (from $60.5\%$ to $64.8\%$), while the training error
reduces to $12\%$.

(a)

(b)

Figure 5: Three network architectures (ResNet-18, ResNet-34 and ResNet-50)
have been merged with the proposed DFL, to tackle the problem of deep learning
in adversarial training. The validation accuracy (a), and training accuracy
(b) illustrate the overall impact of using DFL on the deep networks.

#### MNIST:

The results obtained from embedding a DFL in each ResNet architecture compared
with those from the three baseline approaches using the MNIST dataset are
presented in Table 3. The proposed method outperforms the others with more
than $60\%$ with the ’no defense’ settings which validates its robustness, and
is better than them by $\sim 3-7\%$ with the adversarial ones.

Table 3: Comparison between the proposed method (using DFL only) and the
baseline approaches for MNIST dataset.  No Defense
---
Defenses | FGSM | PGD-10 | C&W
ResNet-50 | 4.9 | 0.0 | 0.2
Mustafa et al. [33] | 31.1 | 19.9 | 29.1
Dynamic [53] | 17.04 | 0.0 | 0.0
Proposed Method (DFL) | 93.08 | 59.60 | 87.0
Adversarial Training
Defenses | FGSM | PGD-10 | C&W
ResNet-50 | 59.50 | 57.19 | 57.09
Mustafa et al. [33] | 53.1 | 34.50 | 40.90
Dynamic [53] | 95.34 | 91.63 | 91.47
Proposed Method (DFL) | 97.30 | 96.63 | 97.13

#### CIFAR-10:

The performances of the proposed method using the CIFAR-10 dataset presented
in Table 4 show that it outperforms the three baseline methods with more than
$10\%$ with the ’no defense’ settings for both the PGD-10 and C&W attacks
while the method in [33] achieves better results for the FGSM one. However,
the proposed method is better than all the others by $\sim 10-28\%$ with the
adversarial settings for the different types of attacks. Overall, the proposed
method achieves significant results for both the ’no defense’ and adversarial
training settings.

Table 4: Comparison between the proposed method (using DFL only) and the
baseline approaches for CIFAR-10 dataset.  No Defense
---
Defenses | FGSM | PGD-10 | C&W
ResNet-50 | 21.4 | 0.01 | 0.6
Mustafa et al. [33] | 67.70 | 27.20 | 37.30
Dynamic [53] | 2.20 | 0.0 | 0.0
Proposed Method (DFL) | 44.60 | 35.40 | 48.50
Adversarial Training
Defenses | FGSM | PGD-10 | C&W
ResNet-50 | 2.2 | 0.0 | 0.0
Mustafa et al. [33] | 75.80 | 46.70 | 51.80
Dynamic [53] | 52.81 | 48.06 | 37.26
Proposed Method (DFL) | 90.31 | 64.67 | 57.30

In summary, securing against black-box attacks is considered less dangerous
than a ’no defense’ strategy, we claim that this type of modification
addresses the four issues of a DNN’s loss of convergence, accuracy
degradation, black-box attacks and securing ’no-defense’ training. Also, both
white- and black-box attacks are expensive in terms of time and space.

Effectiveness of Polarised-Contrastive Loss: The impact of using the proposed
objective function (PCL) as the classifier’s loss function instead of the CE
is examined. The performances of the proposed method with only the DFL, only
the PCL and both embedded in the ResNet architecture are compared and the
results shown in Table 5. It is clear that the results for only the DFL are
better in the case of ’no defense’ training and, therefore, black-box attacks.
On the other hand, using only the PCL improves the results in the case of
adversarial training and, therefore, white-box attacks. Finally, combining
both the components of the proposed method in one network achieves the
required stability, convergence and better performances for all the
adversarial attacks.

Table 5: Comparison between our proposed objective function (PCL) and the
baseline approaches for CIFAR-10 dataset.  No Defense
---
Defenses | FGSM | PGD-10 | C&W
DFL | 44.60 | 35.40 | 48.50
PCL | 42.50 | 31.40 | 43.10
DFL + PCL | 43.85 | 38.70 | 53.07
Adversarial Training
Defenses | FGSM | PGD-10 | C&W
DFL | 90.31 | 64.67 | 57.30
PCL | 90.61 | 70.45 | 58.20
DFL + PCL | 91.80 | 74.50 | 61.30

Effectiveness of using different backbones (WideResNet ) [17]: The
performances of the proposed method using WideResNet architecture as backbone
are shown in Table 6. Embedding the proposed method into WideResNet [17]
improves the performance with reasonable margin that ranges from $0.8\%$ to
$7.20\%$. This experiment shows the effectiveness of the proposed method with
wide networks.

Table 6: Comparison between ResNet and WideResNet on CIFAR-10 dataset.
Adversarial Training
---
Backbone | FGSM | PGD-10 | C&W
ResNet | 91.80 | 74.50 | 61.30
WideResNet | 92.60 | 77.20 | 68.51

(a)

(b)

Figure 6: Comparison between a) the impact of DFL, PCL and both of them in the
adversarial training, b) validation accuracy with ’no defense’ and with
adversarial training.

The model’s validation accuracy values using the DFL, PCL and both together
with the training conducted using a PGD as an attack are shown on the left-
hand side in Figure 6 (a). It can be seen that the PCL increases over time
because it learns in a contrastive way while the DFL training process is
almost steady which is a feature of the model regardless of any change in its
input. However, combining both guarantees stable training and better
performances. A comparison of the training/validation accuracy values with the
’no defense’ and adversarial settings using the MNIST dataset are shown in
Figure 6 (b).

##  5 Conclusions

In this paper, a generative adversarial defensive method for securing DNN
models against data poisoning attacks is proposed. It is based on two types of
defense that address the challenges of a network modification and gradient
mask. The issues of degradation of accuracy and loss of convergence for very
deep networks under the effects of adversarial attacks are identified. Then, a
novel defense called the DFL is developed and it is shown through experiments
that embedding it in a DNN is successful in solving these problems. An
ablation analysis demonstrates that the DFL reduces the training error by
$12\%$ and improves the accuracy by $7.1\%$ while quantitative comparisons
prove that it represents the benchmarks for both ’no defense’ and adversarial
settings. The very deep networks converge and learn better in the case of
adversarial training when embedding the DFL. Also, we propose the PCL as an
objective function to sharpen the decision boundaries amongst the classes in
order to defend against white- and black-box attacks. Combining both these
components demonstrates the robustness of the proposed method against
different kinds of attacks, even with ’no defense’ training. The results
illustrate that our approach is better than state-of-the-art ones by large
margins of approximately $75\%$ and $55\%$ in the cases of ’no defense’ and
adversarial training, respectively. This method highlights further necessary
investigative directions regarding network modification techniques in terms of
the adversarial paradigm.

## References

  * Ackerman [2017] Ackerman, E., 2017.  How drive. ai is mastering autonomous driving with deep learning.  IEEE Spectrum Magazine 1.
  * Bai et al. [2017] Bai, W., Quan, C., Luo, Z., 2017.  Alleviating adversarial attacks via convolutional autoencoder, in: 2017 18th IEEE/ACIS International Conference on Software Engineering, Artificial Intelligence, Networking and Parallel/Distributed Computing (SNPD), IEEE. pp. 53–58.
  * Carlini and Wagner [2017] Carlini, N., Wagner, D., 2017\.  Towards evaluating the robustness of neural networks, in: 2017 IEEE Symposium on Security and Privacy (SP), IEEE. pp. 39–57.
  * Cisse et al. [2017] Cisse, M., Adi, Y., Neverova, N., Keshet, J., 2017\.  Houdini: Fooling deep structured prediction models.  arXiv preprint arXiv:1707.05373 .
  * Das et al. [2017a] Das, N., Shanbhogue, M., Chen, S.T., Hohman, F., Chen, L., Kounavis, M.E., Chau, D.H., 2017a.  Keeping the bad guys out: Protecting and vaccinating deep learning with jpeg compression.  arXiv preprint arXiv:1705.02900 .
  * Das et al. [2017b] Das, N., Shanbhogue, M., Chen, S.T., Hohman, F., Chen, L., Kounavis, M.E., Chau, D.H., 2017b.  Keeping the bad guys out: Protecting and vaccinating deep learning with jpeg compression.  arXiv preprint arXiv:1705.02900 .
  * Deng et al. [2019] Deng, J., Guo, J., Xue, N., Zafeiriou, S., 2019.  Arcface: Additive angular margin loss for deep face recognition, in: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 4690–4699.
  * Dong et al. [2018] Dong, Y., Liao, F., Pang, T., Su, H., Zhu, J., Hu, X., Li, J., 2018.  Boosting adversarial attacks with momentum, in: Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 9185–9193.
  * Dreossi et al. [2018] Dreossi, T., Jha, S., Seshia, S.A., 2018.  Semantic adversarial deep learning, in: International Conference on Computer Aided Verification, Springer. pp. 3–26.
  * Dziugaite et al. [2016] Dziugaite, G.K., Ghahramani, Z., Roy, D.M., 2016.  A study of the effect of jpg compression on adversarial images.  arXiv preprint arXiv:1608.00853 .
  * [11] Gao, J., Wang, B., Lin, Z., Xu, W., Qi, Y.D., .  Masking deep neural network models for robustness against adversarial samples. arxiv 2017.  arXiv preprint arXiv:1702.06763 .
  * Goodfellow et al. [2014a] Goodfellow, I.J., Shlens, J., Szegedy, C., 2014a.  Explaining and harnessing adversarial examples.  arXiv preprint arXiv:1412.6572 .
  * Goodfellow et al. [2014b] Goodfellow, I.J., Shlens, J., Szegedy, C., 2014b.  Explaining and harnessing adversarial examples.  arXiv preprint arXiv:1412.6572 .
  * Gu and Rigazio [2014] Gu, S., Rigazio, L., 2014.  Towards deep neural network architectures robust to adversarial examples.  arXiv preprint arXiv:1412.5068 .
  * Haq et al. [2017] Haq, T., Zhai, J., Pidathala, V.K., 2017.  Advanced persistent threat (apt) detection center.  US Patent 9,628,507.
  * He et al. [2016] He, K., Zhang, X., Ren, S., Sun, J., 2016.  Deep residual learning for image recognition, in: Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770–778.
  * Komodakis [2016] Komodakis, S., 2016.  Wide residual networks, BMVC.
  * Krizhevsky et al. [2009] Krizhevsky, A., Nair, V., Hinton, G., 2009.  Cifar-10 (canadian institute for advanced research).(2009).  URL http://www. cs. toronto. edu/kriz/cifar. html .
  * Kurakin et al. [2016a] Kurakin, A., Goodfellow, I., Bengio, S., 2016a.  Adversarial examples in the physical world.  arXiv preprint arXiv:1607.02533 .
  * Kurakin et al. [2016b] Kurakin, A., Goodfellow, I., Bengio, S., 2016b.  Adversarial examples in the physical world.  arXiv preprint arXiv:1607.02533 .
  * Kurakin et al. [2016c] Kurakin, A., Goodfellow, I., Bengio, S., 2016c.  Adversarial machine learning at scale.  arXiv preprint arXiv:1611.01236 .
  * LeCun et al. [1989] LeCun, Y., Boser, B., Denker, J.S., Henderson, D., Howard, R.E., Hubbard, W., Jackel, L.D., 1989.  Backpropagation applied to handwritten zip code recognition.  Neural computation 1, 541–551.
  * Liao et al. [2018] Liao, F., Liang, M., Dong, Y., Pang, T., Hu, X., Zhu, J., 2018.  Defense against adversarial attacks using high-level representation guided denoiser, in: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 1778–1787.
  * Luo et al. [2015] Luo, Y., Boix, X., Roig, G., Poggio, T., Zhao, Q., 2015\.  Foveation-based mechanisms alleviate adversarial examples.  arXiv preprint arXiv:1511.06292 .
  * Lyu et al. [2015] Lyu, C., Huang, K., Liang, H.N., 2015.  A unified gradient regularization family for adversarial examples, in: 2015 IEEE International Conference on Data Mining, IEEE. pp. 301–309.
  * Ma et al. [2018] Ma, X., Li, B., Wang, Y., Erfani, S.M., Wijewickrema, S., Schoenebeck, G., Song, D., Houle, M.E., Bailey, J., 2018\.  Characterizing adversarial subspaces using local intrinsic dimensionality.  arXiv preprint arXiv:1801.02613 .
  * Madry et al. [2017] Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A., 2017.  Towards deep learning models resistant to adversarial attacks.  arXiv preprint arXiv:1706.06083 .
  * Mao et al. [2016] Mao, X., Shen, C., Yang, Y.B., 2016.  Image restoration using very deep convolutional encoder-decoder networks with symmetric skip connections, in: Advances in neural information processing systems, pp. 2802–2810.
  * Meng and Chen [2017] Meng, D., Chen, H., 2017.  Magnet: a two-pronged defense against adversarial examples, in: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, ACM. pp. 135–147.
  * Miyato et al. [2015] Miyato, T., Maeda, S.i., Koyama, M., Nakae, K., Ishii, S., 2015.  Distributional smoothing with virtual adversarial training.  arXiv preprint arXiv:1507.00677 .
  * Moustafa et al. [2019] Moustafa, N., Choo, K.K.R., Radwan, I., Camtepe, S., 2019\.  Outlier dirichlet mixture mechanism: Adversarial statistical learning for anomaly detection in the fog.  IEEE Transactions on Information Forensics and Security 14, 1975–1987.
  * Muñoz-González et al. [2017] Muñoz-González, L., Biggio, B., Demontis, A., Paudice, A., Wongrassamee, V., Lupu, E.C., Roli, F., 2017.  Towards poisoning of deep learning algorithms with back-gradient optimization, in: Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, ACM. pp. 27–38.
  * Mustafa et al. [2019a] Mustafa, A., Khan, S., Hayat, M., Goecke, R., Shen, J., Shao, L., 2019a.  Adversarial defense by restricting the hidden space of deep neural networks.  arXiv preprint arXiv:1904.00887 .
  * Mustafa et al. [2019b] Mustafa, A., Khan, S.H., Hayat, M., Shen, J., Shao, L., 2019b.  Image super-resolution as a defense against adversarial attacks.  arXiv preprint arXiv:1901.01677 .
  * Na et al. [2017] Na, T., Ko, J.H., Mukhopadhyay, S., 2017.  Cascade adversarial machine learning regularized with a unified embedding.  arXiv preprint arXiv:1708.02582 .
  * Najafabadi et al. [2015] Najafabadi, M.M., Villanustre, F., Khoshgoftaar, T.M., Seliya, N., Wald, R., Muharemagic, E., 2015\.  Deep learning applications and challenges in big data analytics.  Journal of Big Data 2, 1\.
  * Nguyen et al. [2018] Nguyen, L., Wang, S., Sinha, A., 2018.  A learning and masking approach to secure learning, in: International Conference on Decision and Game Theory for Security, Springer. pp. 453–464.
  * Osadchy et al. [2017] Osadchy, M., Hernandez-Castro, J., Gibson, S., Dunkelman, O., Pérez-Cabo, D., 2017.  No bot expects the deepcaptcha! introducing immutable adversarial examples, with applications to captcha generation.  IEEE Transactions on Information Forensics and Security 12, 2640–2653.
  * Papernot et al. [2017] Papernot, N., McDaniel, P., Goodfellow, I., Jha, S., Celik, Z.B., Swami, A., 2017\.  Practical black-box attacks against machine learning, in: Proceedings of the 2017 ACM on Asia conference on computer and communications security, ACM. pp. 506–519.
  * Papernot et al. [2016a] Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z.B., Swami, A., 2016a.  The limitations of deep learning in adversarial settings, in: 2016 IEEE European Symposium on Security and Privacy (EuroS&P), IEEE. pp. 372–387.
  * Papernot et al. [2016b] Papernot, N., McDaniel, P., Sinha, A., Wellman, M., 2016b.  Towards the science of security and privacy in machine learning.  arXiv preprint arXiv:1611.03814 .
  * Papernot et al. [2016c] Papernot, N., McDaniel, P., Wu, X., Jha, S., Swami, A., 2016c.  Distillation as a defense to adversarial perturbations against deep neural networks, in: 2016 IEEE Symposium on Security and Privacy (SP), IEEE. pp. 582–597.
  * Papernot et al. [2016d] Papernot, N., McDaniel, P., Wu, X., Jha, S., Swami, A., 2016d.  Distillation as a defense to adversarial perturbations against deep neural networks, in: 2016 IEEE Symposium on Security and Privacy (SP), IEEE. pp. 582–597.
  * Radwan et al. [2019] Radwan, I., Moustafa, N., Keating, B., Choo, K.K.R., Goecke, R., 2019.  Hierarchical adversarial network for human pose estimation.  IEEE Access 7, 103619–103628.
  * Rifai et al. [2011] Rifai, S., Vincent, P., Muller, X., Glorot, X., Bengio, Y., 2011.  Contractive auto-encoders: Explicit invariance during feature extraction, in: Proceedings of the 28th International Conference on International Conference on Machine Learning, Omnipress. pp. 833–840.
  * Ross and Doshi-Velez [2018] Ross, A.S., Doshi-Velez, F., 2018\.  Improving the adversarial robustness and interpretability of deep neural networks by regularizing their input gradients, in: Thirty-second AAAI conference on artificial intelligence.
  * Sagduyu et al. [2019] Sagduyu, Y., Shi, Y., Erpek, T., 2019.  Adversarial deep learning for over-the-air spectrum poisoning attacks.  IEEE Transactions on Mobile Computing .
  * Sanderson [2008] Sanderson, C., 2008.  Biometric person recognition: Face, speech and fusion. volume 4.  VDM Publishing.
  * Song et al. [2017] Song, Y., Kim, T., Nowozin, S., Ermon, S., Kushman, N., 2017.  Pixeldefend: Leveraging generative models to understand and defend against adversarial examples.  arXiv preprint arXiv:1710.10766 .
  * Steinhardt et al. [2017] Steinhardt, J., Koh, P.W.W., Liang, P.S., 2017.  Certified defenses for data poisoning attacks, in: Advances in neural information processing systems, pp. 3517–3529.
  * Szegedy et al. [2013] Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., Fergus, R., 2013.  Intriguing properties of neural networks.  arXiv preprint arXiv:1312.6199 .
  * Tramèr et al. [2017] Tramèr, F., Kurakin, A., Papernot, N., Goodfellow, I., Boneh, D., McDaniel, P., 2017\.  Ensemble adversarial training: Attacks and defenses.  arXiv preprint arXiv:1705.07204 .
  * Wang et al. [2019] Wang, Y., Ma, X., Bailey, J., Yi, J., Zhou, B., Gu, Q., 2019.  On the convergence and robustness of adversarial training, in: International Conference on Machine Learning, pp. 6586–6595.
  * Wen et al. [2016] Wen, Y., Zhang, K., Li, Z., Qiao, Y., 2016.  A discriminative feature learning approach for deep face recognition, in: European conference on computer vision, Springer. pp. 499–515.
  * Xie et al. [2019] Xie, C., Wu, Y., Maaten, L.v.d., Yuille, A.L., He, K., 2019\.  Feature denoising for improving adversarial robustness, in: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 501–509.
  * Xu et al. [2017] Xu, W., Evans, D., Qi, Y., 2017.  Feature squeezing: Detecting adversarial examples in deep neural networks.  arXiv preprint arXiv:1704.01155 .