Improving Adversarial Robustness via Feature Denoising

1. 01What problem does this paper attempt to solve?

   The authors hold that adversarial perturbations produce noise in feature maps and propose using feature denoising blocks to improve the adversarial robustness of convolutional networks.

   Core question: how to improve the robustness of ImageNet convolutional networks under white-box and black-box adversarial attacks.

   • Problem setting: adversarial attacks can make a convolutional network misclassify an image by adding small perturbations; the authors consider this both a security threat in practical applications and a reflection that the network's computation differs from the human brain.
   • Core observation: the authors visualize res3 feature maps of ResNet-50 on clean images and adversarial images (PGD, ε=16) (Figure 1, 2), and state that the feature maps of adversarial images show activations in regions unrelated to semantics, i.e., feature-level "noise", and that the perturbation is amplified layer by layer as it propagates through the network.
   • Shortcomings of existing methods: the authors state that pixel-level denoising (e.g., high-level representation guided denoising of Liao et al., non-differentiable input transformations of Guo et al.) can be bypassed by an attacker approximating gradients in the white-box setting; ALP can be viewed as "denoising" at the logit level.
   • Proposed approach: add differentiable feature denoising blocks (non-local means and other filters) in the middle layers of the network, and train end-to-end in combination with adversarial training, denoising features directly.
   • Threat model:
     • Attacker goal: cause the ImageNet classifier to misclassify; white-box evaluation uses targeted attacks, with the target class chosen uniformly at random.
     • Knowledge: white-box attackers can iteratively backpropagate through the denoising blocks; black-box attackers (CAAD submitters) do not know the defense details.
     • Capability: L∞ perturbation, white-box ε=16, black-box ε=32 (relative to the 256-pixel scale).
     • Victim system: adversarially trained ImageNet classifiers such as ResNet-101/152.

   Collapse this answer

2. 02What related research exists?

   Related work is divided into three parts: adversarial training, pixel-denoising defenses, and denoising operations; this paper uses ALP as the white-box baseline and CAAD attackers as the black-box benchmark.

   Adversarial training

   • Goodfellow et al. (2015), Madry et al. (2018), Kannan et al. (2018)—generate adversarial examples on the fly during training to train the network; the authors state that adversarial training is the current best for white-box robustness, and this paper uses it to train all models.
   • ALP (Kannan et al., 2018)—encourages the logit predictions for clean and adversarial images to be close; the authors state it can be interpreted as using the clean image's logits as a "noise-free reference" to "denoise" the logits.

   Pixel-level denoising defenses

   • Liao et al. (2018)—uses high-level features to guide a pixel denoiser; the authors note the difference is that this paper denoises features directly.
   • Guo et al. (2018)—uses non-differentiable image preprocessing such as image quilting, total variance minimization, and quantization; the authors state such defenses may be effective in the black-box setting, but in the white-box setting an attacker can approximate their gradients to bypass them (citing Athalye et al., 2018), whereas this paper's denoising model is differentiable and can still improve white-box robustness.

   Denoising operations and related structures

   • Non-local means (Buades et al., 2005), bilateral filter (Tomasi and Manduchi, 1998)—classic image denoising filters, which this paper adapts into feature denoising operations.
   • Self-attention (Vaswani et al., 2017) and non-local networks (Wang et al., 2018)—this paper's denoising block design is inspired by them, but the authors note that only the non-local means part actually denoises, and the weighted average acts directly on the input feature x rather than its embedding.

   Baselines and benchmarks: The white-box baselines are ALP (Inception-v3, 27.9% under 10-iteration PGD) and the authors' own adversarially trained ResNet-101/152; the black-box benchmarks are the top five attackers of CAAD 2017 and the 48 unknown attackers of CAAD 2018, with ImageNet as the dataset (about 1.28 million training images, 50,000 validation images, 1000 classes). The authors position this paper as: moving denoising from the pixel/logit level to the feature level and combining it with adversarial training.

   Collapse this answer

3. 03How does the paper address this problem?

   Differentiable feature denoising blocks are inserted at the end of each ResNet stage, with 1×1 convolutions and residual connections, and the whole network is trained end-to-end with PGD adversarial training.

   Overall idea: since adversarial perturbations appear as noise in feature maps, add feature denoising blocks in the middle layers of the network to suppress the noise, then use adversarial training so the network learns end to end to remove data-dependent noise.

   Denoising block structure

   • General form (Figure 4): the input feature passes through a denoising operation (e.g., non-local means), then a 1×1 convolution, and finally is added back to the input via a residual connection.
   • The authors state the residual connection helps preserve the signal, and the 1×1 convolution learns end to end the trade-off between denoising and preserving the signal; neither of the two denoises by itself, they only combine features.
   • Default configuration: add one after the last residual block of each of the res2, res3, res4, and res5 stages of ResNet, for 4 denoising blocks in total.

   Denoising operations (four variants)

   • Non-local means: y_i = 1/(C(x)) ∑_{∀ j ∈ L} f(x_i, x_j) · x_j, i.e., a weighted average over the features at all spatial positions; the authors emphasize that what is weighted is x_j itself rather than its embedding, keeping the channel correspondence between y and x. The weight f has two forms: Gaussian (softmax, equivalent to self-attention, requires a 1×1 convolution embedding) and dot product (no embedding, no extra parameters).
   • Bilateral filter: in the above formula, replace the neighborhood with a local region Ω(i) (e.g., 3×3), likewise with Gaussian and dot product weights.
   • Mean filter: average pooling with stride 1; the authors state it smooths structure and is expected to be worse than the weighted average.
   • Median filter: y_i = median{∀ j ∈ Ω(i) : x_j}, taking the local median per channel; the authors state that training a network containing a median filter is an open problem, but experiments found it can also improve robustness.

   Adversarial training implementation

   • Attacker: PGD, ε=16, step size α=1, iterations n=30, targeted; randomized initialization—20% of each batch is initialized with clean images, 80% with random points within ε.
   • The SGD update is based only on adversarial images; the mini-batch contains no clean images; training computation is about n times that of ordinary training.
   • Distributed training: synchronous SGD on 128 V100 GPUs, 32 images per GPU (total batch 4096), trained for 110 epochs, with the learning rate reduced by 10× at epochs 35/70/95, label smoothing 0.1; the R-101 baseline takes about 38 hours, R-152 about 52 hours.

   Evaluation method

   • White-box: targeted PGD, ε=16, random initialization, α=1 (α=ε/10=1.6 at 10 iterations), iterations from 10 to 2000; the metric is top-1 accuracy on adversarial examples from the 50,000-image validation set.
   • Black-box: the top five attackers of CAAD 2017, ε=32, using the CAAD 2018 all-or-nothing criterion—an image counts as correct only if it is classified correctly under the adversarial versions generated by all attackers.

   Collapse this answer

4. 04What experiments did the paper conduct?

   White-box PGD and black-box CAAD evaluation on ImageNet: the denoising blocks improve accuracy at every attack strength and win first place in the CAAD 2018 defense track.

   Experimental setup

   • Models evaluated: adversarially trained ResNet-101 and ResNet-152 baselines, and their versions with 4 denoising blocks (non-local Gaussian/dot product, bilateral, 3×3 mean, 3×3 median, a null version, and ResNet-164 with 4 additional bottlenecks); the CAAD 2018 submission version uses ResNeXt-101-32×8 with denoising in all residual blocks.
   • Dataset: ImageNet (about 1.28 million training images, 1000 classes), evaluated on the 50,000 validation images.
   • Baselines: ALP (Inception-v3, numbers quoted from the original paper); the black-box comparison is the CAAD 2017 champion (Liao et al.).
   • Metrics: white-box is top-1 accuracy on adversarial examples; black-box is all-or-nothing accuracy.
   • Attack parameters: white-box PGD ε=16, 10–2000 iterations; black-box ε=32, while the model is trained only with ε=16.
   • Number of repetitions: in the clean-image setting, the R-152 baseline was trained independently 3 times to estimate natural variation; the adversarial experiments do not report the number of repetitions.

   Main results

   Top-1 accuracy under white-box PGD (ε=16) (according to Figure 6):

   Swipe horizontally to read the table

   Model	10 iterations	100 iterations	2000 iterations
   ALP, Inception-v3 (quoted from [10])	27.9%	not reported	not reported
   R-101 baseline	49.7%	not reported	not reported
   R-152 baseline	52.5%	45.5%	39.2%
   R-152 + 4 denoising blocks (non-local Gaussian)	55.7%	46.8%	42.6%

   • The authors state that the denoising blocks bring consistent improvements at each number of attack iterations: 3.2 percentage points above the R-152 baseline at 10 iterations, and 3.4 percentage points above at 2000 iterations.
   • The authors note that the comparison with ALP is system-level (backbone, implementation, etc. all differ).
   • The authors observe diminishing returns for the attacker after 1000–2000 iterations; and state that a 2000-iteration PGD attack on ImageNet had not been explored previously.

   Ablation of denoising operation variants (Figure 7)

   • With 4 blocks added to R-152 and PGD up to 100 iterations: all denoising variants (mean, median, bilateral, both non-local variants) outperform the R-152 baseline, the version with 4 additional bottleneck blocks (ResNet-164), and the null version (1×1 convolution only).
   • The null version has the same number of parameters as the mean/median/dot product versions but performs worse, from which the authors conclude that the extra parameters are not the main cause of the improvement and that feature denoising itself is effective.
   • The non-local Gaussian version is best, but only slightly better than the dot product version; subsequent experiments use the Gaussian version by default.

   Black-box attacks (Table 2)

   • Against the top five attackers of CAAD 2017 (ε=32, all-or-nothing): R-152 baseline 43.1%, with 4 non-local Gaussian denoising blocks 46.4%, dot product version 46.2%, null version 44.1%; the CAAD 2017 champion only 0.04%, and 13.4% after removing its two most vulnerable attackers.
   • Local filtering (mean, median, bilateral) gives 43.6%–44.4%, which the authors state is not a convincing improvement over the null version, and they consider non-local denoising more important for black-box robustness.
   • Adding denoising blocks after every residual block (non-local Gaussian, with 2×2 max pooling subsampling) reaches 49.5%, 6.4 percentage points above the baseline.

   CAAD 2018 competition (Figure 8)

   • The submission based on the method in this paper (ResNeXt-101-32×8 + non-local denoising in all residual blocks, single model single crop) achieves 50.6% against 48 unknown attackers (ε=32, all-or-nothing, secret test set), ranking first; second place is 40.8%, and third to fifth places are 8.6%, 3.6%, 0.6%.
   • This submission version achieves 56.0% and 40.4% under ImageNet white-box 10-/100-iteration PGD respectively, which the authors state is slightly lower than the R-152 model in Section 6.1 because its training parameter settings differ slightly.

   Other ablations and analyses

   • Denoising block design (Table 1, R-152 + 4 non-local Gaussian blocks): removing the 1×1 convolution drops from 55.7%/45.5% to 52.1%/36.8% under 10-/100-iteration PGD; removing the residual connection makes training unstable and the loss does not decrease (recorded as NaN).
   • Clean images (Table 3): without adversarial training, the difference between each denoising variant and the baseline is within ±0.2% (baseline 78.91%), and the authors state that the denoising blocks have no advantage in the clean setting; adding non-local blocks to R-50 improves clean accuracy by 0.7%, with diminishing returns on R-152.
   • Clean accuracy cost: the adversarially trained R-152 baseline achieves 62.32% on clean images (clean training is 78.91%); the adversarially trained non-local Gaussian denoising version achieves 65.30% (clean training is 79.08%).

   Collapse this answer

5. 05What are some points that can be further explored?

   The authors note that feature noise is difficult to measure quantitatively and that the trade-off between adversarial and clean training is left for the future; experiments are limited to ImageNet and PGD-family attacks.

   Limitations and future directions noted by the authors

   • Feature noise is easy to observe qualitatively but difficult to measure quantitatively, and comparing noise levels across different architectures and training methods is nontrivial (Section 3).
   • Training a convolutional network containing a median filter is an open problem (Section 4.2).
   • The accuracy trade-off between adversarial training and clean training has been observed previously, and the authors say they expect it to become a topic of future research (Section 6.3).
   • The authors hope the work will encourage researchers to design convolutional network architectures with "intrinsic" adversarial robustness (Section 7).

   Scope of experiments

   • Evaluation is performed only on ImageNet classification, with backbones ResNet-50/101/152 and ResNeXt-101-32×8 (Section 6).
   • White-box evaluation uses PGD as the attacker; the authors also evaluated FGSM, iterative FGSM and its momentum variant, and state that PGD is the strongest among them, but they do not report numbers for these attacks (Section 6.1 footnote).
   • Black-box evaluation covers the top five attackers of CAAD 2017 and the 48 unknown attackers of CAAD 2018, with perturbation ε=32, while the model is trained only with ε=16 (Section 6.2).
   • The adversarial experiments do not report the number of repetitions or variance; only the R-152 baseline in the clean-image setting was trained independently 3 times (Table 3).
   • The comparison with ALP is a system-level comparison, with different backbones and implementations; the authors did not perform a same-backbone control (Section 6.1).

   Collapse this answer

6. 06Summarize the main content of the paper

   Feature denoising blocks plus adversarial training improve robustness under both white-box and black-box attacks on ImageNet, and won first place in the CAAD 2018 defense track.

   An adversarial defense paper: the authors observed that although adversarial perturbations are small in pixel space, they produce noise in the feature maps of convolutional networks (Figure 1, 2), and on this basis proposed adding feature denoising blocks in the middle layers of the network, combined with adversarial training for end-to-end training.

   • Method: The denoising block consists of a denoising operation (non-local means, bilateral, mean, median filtering) plus a 1×1 convolution and a residual connection, added by default at the end of the four stages of ResNet; training uses PGD (ε=16, 30 iterations) adversarial training, implemented in a distributed fashion on 128 GPUs.
   • White-box results (ImageNet, PGD ε=16): R-152 with 4 non-local Gaussian denoising blocks reaches 55.7% under a 10-iteration attack, higher than the R-152 baseline's 52.5% and ALP's 27.9%; under a 2000-iteration attack it reaches 42.6% (baseline 39.2%) (Figure 6).
   • Ablation: All denoising variants outperform the baseline, the bottleneck-block version, and a null version with the same number of parameters; the authors conclude from this that the improvement comes from denoising rather than extra parameters; removing the 1×1 convolution or the residual connection causes a clear degradation or failure to train (Figure 7, Table 1).
   • Black-box results: Against the top five attackers of CAAD 2017 (ε=32, all-or-nothing) it reaches 46.4% (baseline 43.1%); in the CAAD 2018 defense track it achieves 50.6% against 48 unknown attackers, ranking first, about 10 percentage points ahead of the second place's 40.8% (Table 2, Figure 8).
   • Cost and boundaries: The denoising blocks give no gain on clean images (within ±0.2%); adversarial training lowers clean accuracy from 78.91% to 62.32% (65.30% for the denoising version), and the authors say this trade-off is left for future research.
   • Authors' conclusion: Certain architectural designs (denoising blocks) have a particular advantage for adversarial robustness, even with no improvement in the clean setting; the authors hope to inspire architecture designs with "intrinsic" robustness.

   Collapse this answer

Related papers