Improving Adversarial Robustness via Decoupled Visual Representation Masking

TL;DR

The paper tackles adversarial robustness by reframing robust representations as a balance between intra-class diversity and inter-class discriminability. It introduces Decoupled Visual Feature Masking (DFM), a block that splits features into visual discriminative components and non-visual components via a small decoupling net, applies masks with rates $r_1$ and $r_2$, and fuses them to form robust representations that disrupt adversarial noise. As a plug-in to existing adversarial training pipelines, it optimizes a min-max objective $\min_{\theta,\varphi} \mathbb{E}_{(x,y)\sim D}[\max_{\delta} L_{cls}(F_{\theta,\varphi}(x+\delta), y)]$ to improve defense performance. Empirically, DFM yields superior robustness on CIFAR-10/100 and Tiny-ImageNet against strong attacks (e.g., PGD, AutoAttack, EOTPGD), with measurable generalization gains to unseen attacks and a modest model-size increase, illustrating practical impact for real-world deployment.

Abstract

Deep neural networks are proven to be vulnerable to fine-designed adversarial examples, and adversarial defense algorithms draw more and more attention nowadays. Pre-processing based defense is a major strategy, as well as learning robust feature representation has been proven an effective way to boost generalization. However, existing defense works lack considering different depth-level visual features in the training process. In this paper, we first highlight two novel properties of robust features from the feature distribution perspective: 1) \textbf{Diversity}. The robust feature of intra-class samples can maintain appropriate diversity; 2) \textbf{Discriminability}. The robust feature of inter-class samples should ensure adequate separation. We find that state-of-the-art defense methods aim to address both of these mentioned issues well. It motivates us to increase intra-class variance and decrease inter-class discrepancy simultaneously in adversarial training. Specifically, we propose a simple but effective defense based on decoupled visual representation masking. The designed Decoupled Visual Feature Masking (DFM) block can adaptively disentangle visual discriminative features and non-visual features with diverse mask strategies, while the suitable discarding information can disrupt adversarial noise to improve robustness. Our work provides a generic and easy-to-plugin block unit for any former adversarial training algorithm to achieve better protection integrally. Extensive experimental results prove the proposed method can achieve superior performance compared with state-of-the-art defense approaches. The code is publicly available at \href{https://github.com/chenboluo/Adversarial-defense}{https://github.com/chenboluo/Adversarial-defense}.

Figures (6)

• Figure 1: (a) the t-SNE visualizations of PGD adversarial example on different methods. (b) the t-SNE visualizations of Auto Attack adversarial example on different methods. The robust feature of intra-class samples should maintain appropriate diversity, and the robust feature of inter-class samples should ensure adequate separation.
• Figure 2: Detailed design of the Decoupled Visual Feature Masking Block. Specifically, we decouple visual discriminative features from non-visual features by Feature Decoupled Net. Then, we mask them separately with different masking rates and combine the enhanced features.
• Figure 3: (a) the network architecture of ResNet18, (b) our proposed defense method with the Decoupled Visual Feature Masking block. We present the number of each residual module as well as the feature map size. The main difference between our method and ResNet18 is the addition of different Decoupled Visual Feature Masking block at different levels.
• Figure 4: Parameter Analysis. The figure shows the classification accuracy rates (percentage) of different mask ratio defenses against different attacks (higher is better) on the CIFAR-10 dataset.
• Figure 5: Left: (a) is the original image, (b) is the reconstruction result of $r_1$ branch with $r_1 = 0.01$ and $r_2 = 0.0$, (c) is the reconstruction result of $r_1$ branch with $r_1 = 0.01$ and $r_2 = 0.5$, and (d) is the reconstruction result of $r_1$ branch with $r_1 = 0.01$ and $r_2 = 0.9$. Right: (a) is the original image, (b) is the reconstruction result of $r_2$ branch with $r_1 = 0.01$ and $r_2 = 0.0$, (c) is the reconstruction result of $r_2$ branch with $r_1 = 0.01$ and $r_2 = 0.5$, and (d) is the reconstruction result of $r_2$ branch with $r_1 = 0.01$ and $r_2 = 0.9$.