MsMemoryGAN: A Multi-scale Memory GAN for Palm-vein Adversarial Purification

TL;DR

MsMemoryGAN is a novel multi-scale autoencoder with memory modules designed to purify adversarial perturbations in palm-vein recognition, significantly improving robustness against attacks.

Contribution

The paper introduces MsMemoryGAN, a new defense model combining multi-scale autoencoding and memory modules for effective adversarial purification in vein recognition.

Findings

Effective removal of various adversarial perturbations

Improved recognition accuracy on vein datasets

Robustness against multiple attack methods

Abstract

Deep neural networks have recently achieved promising performance in the vein recognition task and have shown an increasing application trend, however, they are prone to adversarial perturbation attacks by adding imperceptible perturbations to the input, resulting in making incorrect recognition. To address this issue, we propose a novel defense model named MsMemoryGAN, which aims to filter the perturbations from adversarial samples before recognition. First, we design a multi-scale autoencoder to achieve high-quality reconstruction and two memory modules to learn the detailed patterns of normal samples at different scales. Second, we investigate a learnable metric in the memory module to retrieve the most relevant memory items to reconstruct the input image. Finally, the perceptional loss is combined with the pixel loss to further enhance the quality of the reconstructed image. During the training phase, the MsMemoryGAN learns to reconstruct the input by merely using fewer prototypical elements of the normal patterns recorded in the memory. At the testing stage, given an adversarial sample, the MsMemoryGAN retrieves its most relevant normal patterns in memory for the reconstruction. Perturbations in the adversarial sample are usually not reconstructed well, resulting in purifying the input from adversarial perturbations. We have conducted extensive experiments on two public vein datasets under different adversarial attack methods to evaluate the performance of the proposed approach. The experimental results show that our approach removes a wide variety of adversarial perturbations, allowing vein classifiers to achieve the highest recognition accuracy.