Fight Perturbations with Perturbations: Defending Adversarial Attacks via Neuron Influence

TL;DR

This work addresses the vulnerability of deep neural networks to adversarial perturbations by introducing Neuron-level Inverse Perturbation (NIP), an attack-agnostic defense built on the concept of neuron influence $\\sigma_n = (\\partial y_c/\\partial \\varphi_n(x))\\cdot \\varphi_n(x)$. By ranking neurons as front, tail, or remaining, NIP generates inverse perturbations that strengthen high-influence neurons while weakening low-influence ones, and applies adaptive input modifications during inference without retraining. Across 13 attacks and multiple datasets/models, NIP consistently achieves higher defense success rates and preserves benign accuracy better than state-of-the-art reactive and proactive baselines, while also extending to speaker recognition and online platforms. The paper further analyzes adaptive threats, parameter sensitivity, and interpretability, illustrating the practical value and robustness of neuron-influence guided input modifications for real-world adversarial robustness.

Abstract

The vulnerabilities of deep learning models towards adversarial attacks have attracted increasing attention, especially when models are deployed in security-critical domains. Numerous defense methods, including reactive and proactive ones, have been proposed for model robustness improvement. Reactive defenses, such as conducting transformations to remove perturbations, usually fail to handle large perturbations. The proactive defenses that involve retraining, suffer from the attack dependency and high computation cost. In this paper, we consider defense methods from the general effect of adversarial attacks that take on neurons inside the model. We introduce the concept of neuron influence, which can quantitatively measure neurons' contribution to correct classification. Then, we observe that almost all attacks fool the model by suppressing neurons with larger influence and enhancing those with smaller influence. Based on this, we propose \emph{Neuron-level Inverse Perturbation} (NIP), a novel defense against general adversarial attacks. It calculates neuron influence from benign examples and then modifies input examples by generating inverse perturbations that can in turn strengthen neurons with larger influence and weaken those with smaller influence.

Figures (12)

• Figure 1: Changes of neuron influence on benign and adversarial examples on average. Dataset: CIFAR-10; model: VGG19 simonyan2014very; layer: flatten layer with 512 neurons.
• Figure 2: Front neurons $\Omega_f$, remaining neurons $\Omega_r$ and tail neurons $\Omega_t$. Influence values are normalized to [0,1].
• Figure 3: The overview of NIP.
• Figure 4: Comparison of defense results against white-box and black-box attacks on different datasets and models.
• Figure 5: DSR of NIP and three baselines under different perturbation sizes.