Deep neural networks have demonstrated cutting edge performance on various tasks including classification. However, it is well known that adversarially designed imperceptible perturbation of the input can mislead advanced classifiers. In this paper, Permutation Phase Defense (PPD), is proposed as a novel method to resist adversarial attacks. PPD combines random permutation of the image with phase component of its Fourier transform. The basic idea behind this approach is to turn adversarial defense problems analogously into symmetric cryptography, which relies solely on safekeeping of the keys for security. In PPD, safe keeping of the selected permutation ensures effectiveness against adversarial attacks. Testing PPD on MNIST and CIFAR-10 datasets yielded state-of-the-art robustness against the most powerful adversarial attacks currently available.
This paper explores the idea of utilizing a secret random permutation in the Fourier phase domain to defense against adversarial examples. The idea is drawn from cryptography, where the random permutation is treated as a secret key that the adversarial does not have access to. This setting has practical limitations, but is plausible in theory.
While the defense technique is certainly novel and inspired, its use case seems limited to simple datasets such as MNIST. The permuted phase component does not admit weight sharing and invariances exploited by convolutional networks, which results in severely hindered clean accuracy -- only 96% on MNIST and 45% on CIFAR-10 for a single model. While the security of a model against adversarial attacks is important, a defense should not sacrifice clean accuracy to such an extent. For this weakness, I recommend rejection but encourage the authors to continue exploring in this direction for a more suitable scheme that does not compromise clean accuracy.
Pros:
- Novel defense technique against very challenging white-box attacks.
- Sound threat model drawn from traditional security.
- Clearly written.
Cons:
- Poor clean accuracy makes the technique very impractical.
- Insufficient baselines. While the permutation is kept as a secret, it is plausible that the adversary may attempt to learn the transformation when given enough input-output pairs. Also, the adversary may attack an ensemble of PPD models for different random permutations (i.e. expectation over random permutations). The authors should introduce an appropriate threat model and evaluate this defense against plausible attacks under that threat model.