LISArD: Learning Image Similarity to Defend Against Gray-box Adversarial Attacks

TL;DR

LISArD is a novel image similarity learning method that enhances robustness against gray-box and white-box adversarial attacks without increasing computational costs, outperforming existing defenses.

Contribution

Proposes LISArD, a new defense mechanism that uses embedding similarity to defend against gray-box attacks, without relying on adversarial training.

Findings

LISArD effectively defends against gray-box and white-box attacks.

It maintains robustness across multiple neural network architectures.

State-of-the-art adversarial distillation models perform poorly without adversarial training.

Abstract

State-of-the-art defense mechanisms are typically evaluated in the context of white-box attacks, which is not realistic, as it assumes the attacker can access the gradients of the target network. To protect against this scenario, Adversarial Training (AT) and Adversarial Distillation (AD) include adversarial examples during the training phase, and Adversarial Purification uses a generative model to reconstruct all the images given to the classifier. This paper considers an even more realistic evaluation scenario: gray-box attacks, which assume that the attacker knows the architecture and the dataset used to train the target network, but cannot access its gradients. We provide empirical evidence that models are vulnerable to gray-box attacks and propose LISArD, a defense mechanism that does not increase computational and temporal costs but provides robustness against gray-box and white-box attacks without including AT. Our method approximates a cross-correlation matrix, created with the embeddings of perturbed and clean images, to a diagonal matrix while simultaneously conducting classification learning. Our results show that LISArD can effectively protect against gray-box attacks, can be used in multiple architectures, and carries over its resilience to the white-box scenario. Also, state-of-the-art AD models underperform greatly when removing AT and/or moving to gray-box settings, highlighting the lack of robustness from existing approaches to perform in various conditions (aside from white-box settings). All the source code is available at https://github.com/Joana-Cabral/LISArD.