PixelDefend: Leveraging Generative Models to Understand and Defend\n against Adversarial Examples

Abstract

Adversarial perturbations of normal images are usually imperceptible to\nhumans, but they can seriously confuse state-of-the-art machine learning\nmodels. What makes them so special in the eyes of image classifiers? In this\npaper, we show empirically that adversarial examples mainly lie in the low\nprobability regions of the training distribution, regardless of attack types\nand targeted models. Using statistical hypothesis testing, we find that modern\nneural density models are surprisingly good at detecting imperceptible image\nperturbations. Based on this discovery, we devised PixelDefend, a new approach\nthat purifies a maliciously perturbed image by moving it back towards the\ndistribution seen in the training data. The purified image is then run through\nan unmodified classifier, making our method agnostic to both the classifier and\nthe attacking method. As a result, PixelDefend can be used to protect already\ndeployed models and be combined with other model-specific defenses. Experiments\nshow that our method greatly improves resilience across a wide variety of\nstate-of-the-art attacking methods, increasing accuracy on the strongest attack\nfrom 63% to 84% for Fashion MNIST and from 32% to 70% for CIFAR-10.\n