Robustifying models against adversarial attacks by Langevin dynamics.

Area of Science:

• Artificial Intelligence
• Machine Learning Security

Background:

• Deep learning models are vulnerable to adversarial attacks, with existing defenses often being bypassed.
• The arms race between attack and defense strategies highlights the persistent challenge of achieving robustness.

Purpose of the Study:

• To propose a novel defense strategy against adversarial attacks on deep learning models.
• To enhance model robustness by driving off-manifold adversarial samples towards high-density data regions.

Main Methods:

• Utilizing the Metropolis-adjusted Langevin algorithm (MALA) with perceptual boundaries.
• Introducing a generative model via a supervised Denoising Autoencoder (sDAE) aligned with a discriminative classifier.
• Developing the MALA for DEfense (MALADE) algorithm with broad dispersion-projection.

Main Results:

• MALADE effectively drives adversarial samples towards the data generating distribution.
• The dispersion-projection mechanism prevents precise alignment for white-box attacks.
• MALADE demonstrated state-of-the-art performance against sophisticated adversarial attacks.

Conclusions:

• MALADE offers a simple yet effective defense against adversarial attacks.
• The method is applicable to any classifier, providing robust defense and off-manifold sample detection.
• This approach advances the field of adversarial robustness in deep learning.