Using High-Level Representation Difference Constraint and Relative Reconstruction Constraint for Defending against Adversarial Attacks

Abstract

Adversarial examples in which imperceptible perturbations to the input can easily subvert a well-trained model’s prediction pose huge potential security threats to deep neural networks (DNNs). As an effective way to resist adversarial samples, input reconstruction can eliminate the antagonism of adversarial examples in the inference process without involving modifications to the target model’s structure and parameters. However, preprocessing inputs often results in some loss of the protected model’s prediction accuracy. In this paper, we introduce a new input reconstruction method that adopts the high-level representation difference constraint and the relative reconstruction constraint on a dual autoencoder to advance the prediction accuracy of the protected model. The high-level representation difference constraint utilizes the gap between the protected model’s high-level representations, activated by clean images, and their adversarial examples to guide the training of the dual autoencoder. Additionally, the relative reconstruction constraint is imposed on latent representations and their noisy versions to advance the robustness of the dual autoencoder to tiny perturbations. The extensive empirical experiments on two real datasets, CIFAR-10 and ImageNet, show that the presented approach demonstrates exceptional performance in resisting different types of attacks.