Adversarial Robustness by Design through Analog Computing and Synthetic Gradients

TL;DR

This paper introduces a novel hardware-inspired defense mechanism against adversarial attacks using optical co-processors with nonlinear random transformations, enhancing robustness without sacrificing natural accuracy in various attack settings.

Contribution

The paper presents a new defense approach leveraging optical analog computing and synthetic gradients, which is resistant to obfuscated gradient attacks and improves robustness against black-box and transfer attacks.

Findings

Effective against white-box and black-box attacks

Maintains high natural accuracy on CIFAR datasets

Enhances robustness with optical random projections and binarization

Abstract

We propose a new defense mechanism against adversarial attacks inspired by an optical co-processor, providing robustness without compromising natural accuracy in both white-box and black-box settings. This hardware co-processor performs a nonlinear fixed random transformation, where the parameters are unknown and impossible to retrieve with sufficient precision for large enough dimensions. In the white-box setting, our defense works by obfuscating the parameters of the random projection. Unlike other defenses relying on obfuscated gradients, we find we are unable to build a reliable backward differentiable approximation for obfuscated parameters. Moreover, while our model reaches a good natural accuracy with a hybrid backpropagation - synthetic gradient method, the same approach is suboptimal if employed to generate adversarial examples. We find the combination of a random projection and binarization in the optical system also improves robustness against various types of black-box attacks. Finally, our hybrid training method builds robust features against transfer attacks. We demonstrate our approach on a VGG-like architecture, placing the defense on top of the convolutional features, on CIFAR-10 and CIFAR-100. Code is available at https://github.com/lightonai/adversarial-robustness-by-design.