Combating Adversaries with Anti-Adversaries
Motasem Alfarra, Juan C. P\'erez, Ali Thabet, Adel Bibi, Philip H. S., Torr, Bernard Ghanem

TL;DR
This paper introduces an anti-adversary layer that counteracts adversarial attacks by generating input perturbations in the opposite direction, improving neural network robustness without affecting clean accuracy.
Contribution
The paper proposes a training-free, theoretically supported anti-adversary layer that enhances neural network robustness against various adversarial attacks.
Findings
Significantly improves robustness on CIFAR10, CIFAR100, and ImageNet.
Effective against black-box and adaptive attacks.
No loss in clean accuracy.
Abstract
Deep neural networks are vulnerable to small input perturbations known as adversarial attacks. Inspired by the fact that these adversaries are constructed by iteratively minimizing the confidence of a network for the true class label, we propose the anti-adversary layer, aimed at countering this effect. In particular, our layer generates an input perturbation in the opposite direction of the adversarial one and feeds the classifier a perturbed version of the input. Our approach is training-free and theoretically supported. We verify the effectiveness of our approach by combining our layer with both nominally and robustly trained models and conduct large-scale experiments from black-box to adaptive attacks on CIFAR10, CIFAR100, and ImageNet. Our layer significantly enhances model robustness while coming at no cost on clean accuracy.
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Code & Models
Videos
Taxonomy
TopicsAdversarial Robustness in Machine Learning · Anomaly Detection Techniques and Applications · Advanced Neural Network Applications
