(AD)[formula omitted]: Adversarial domain adaptation to defense with adversarial perturbation removal

Abstract

Deep Neural Networks (DNNs) are demonstrated to be vulnerable to adversarial examples, which are crafted by adding adversarial perturbations to the legitimate examples. To address this issue, some defense methods have been proposed. Among them, the adversarial training (AT) is a popular method to improve the robustness of DNNs. However, theory analysis has shown that in the adversarial training framework, the improvement of the robustness will lead to a decline of standard accuracy. In this paper, we propose a modularized defense framework, namely Adversarial Domain Adaptation to Defense ((AD)2). Different from all adversarial training methods, (AD)2 detects adversarial example using a generative algorithm and applies the adversarial domain adaptation method to remove adversarial perturbation. Experimental results show that (AD)2 is effective to remove the adversarial perturbation and mitigate the odds between the robustness and standard accuracy for DNNs.