Robust feature learning for adversarial defense via hierarchical feature alignment

• Published in: Information sciences Vol. 560; pp. 256 - 270
• Main Authors: Zhang, Xiaoqin, Wang, Jinxin, Wang, Tao, Jiang, Runhua, Xu, Jiawei, Zhao, Li
• Format: Journal Article
• Language: English
• Published: Elsevier Inc 01.06.2021
• Subjects: Adversarial defense; Domain adaptation; Feature alignment; Optimal transport; Domain adaptation; Adversarial defense; Optimal transport; Feature alignment
• ISSN: 0020-0255; 1872-6291
• DOI: 10.1016/j.ins.2020.12.042

•We propose a hierarchical feature alignment method to learn robust features.•We improve the feature similarity along network layers with Wasserstein distance.•The method shows a robust generalization ability on adversarial examples. Deep neural networks have demonstrated excellent performance in most computer vision tasks in recent years. However, they are vulnerable to adversarial perturbations generated by adversarial attacks. These human-imperceptible perturbations often lead to severe distortion in the high-dimensional intermediate feature space, which is one of the major reasons for the vulnerabilities in deep neural networks. Therefore, input images with perturbations can completely change the predictions of the networks in the decision space. To overcome this drawback, we propose to progressively align the intermediate feature representations extracted from the adversarial domain with feature representations extracted from a clean domain through domain adaptation. The difference between two feature distributions can be accurately measured via an optimal transport-based Wasserstein distance. Thus, the deep networks are forced to learn robust and domain-invariant feature representations, so that the gap between the different domains is minimized and that the networks are no longer easily fooled by diverse adversaries. Extensive evaluations are conducted on four classification benchmark datasets in white-box attack scenarios. The evaluation results demonstrate a significant performance improvement over several state-of-the-art defense methods.