Blending adversarial training and representation-conditional purification via aggregation improves adversarial robustness
This work addresses the problem of adversarial attacks for image classification models, offering a novel defense that advances state-of-the-art robustness, though it is incremental as it builds on existing paradigms.
The paper tackles adversarial robustness in image classification by proposing CARSO, a defense that synergistically combines adversarial training and purification, achieving significant improvements in robust accuracy against AutoAttack on Cifar-10, Cifar-100, and TinyImageNet-200 datasets.
In this work, we propose a novel adversarial defence mechanism for image classification - CARSO - blending the paradigms of adversarial training and adversarial purification in a synergistic robustness-enhancing way. The method builds upon an adversarially-trained classifier, and learns to map its internal representation associated with a potentially perturbed input onto a distribution of tentative clean reconstructions. Multiple samples from such distribution are classified by the same adversarially-trained model, and a carefully chosen aggregation of its outputs finally constitutes the robust prediction of interest. Experimental evaluation by a well-established benchmark of strong adaptive attacks, across different image datasets, shows that CARSO is able to defend itself against adaptive end-to-end white-box attacks devised for stochastic defences. Paying a modest clean accuracy toll, our method improves by a significant margin the state-of-the-art for Cifar-10, Cifar-100, and TinyImageNet-200 $\ell_\infty$ robust classification accuracy against AutoAttack. Code, and instructions to obtain pre-trained models are available at: https://github.com/emaballarin/CARSO .