In this paper, we study the adversarial attack and defence problem in deep learning from the perspective of Fourier analysis. We first explicitly compute the Fourier transform of deep ReLU neural networks and show that there exist decaying but non-zero high frequency components in the Fourier spectrum of neural networks. We then demonstrate that the vulnerability of neural networks towards adversarial samples can be attributed to these insignificant but non-zero high frequency components. Based on this analysis, we propose to use a simple post-averaging technique to smooth out these high frequency components to improve the robustness of neural networks against adversarial attacks. Experimental results on the ImageNet and the CIFAR-10 datasets have shown that our proposed method is universally effective to defend many existing adversarial attacking methods proposed in the literature, including FGSM, PGD, DeepFool and C&W attacks. Our post-averaging method is simple since it does not require any re-training, and meanwhile it can successfully defend over 80-96% of the adversarial samples generated by these methods without introducing significant performance degradation (less than 2%) on the original clean images.
The paper proposes an approach for improving robustness of already trained artificial neural networks with relu activation functions. The main motivation comes from signal processing where robustness is typically obtained via averaging moduli of Fourier coefficients over some frequency band (e.g., mel-frequency coefficients and deep scattering spectrum are based on this principle). The strategy amounts to sampling several random direction vectors in a ball of constant radius centered at a training example and averaging their predictions. The empirical estimate of the expected predictor value over the ball centered at a training example is used as its hypothesis value.
The approach is introduced by first expressing an artificial neural network with relu activations as a piecewise linear function (Definition 2.1, Lemma 2.2, Theorem 2.3). The paper then makes an observation that the instance space can be further sub-divided such that the network can be written as a sum of piecewise functions defined over regions given by positive linear combinations of linearly independent vectors (Definition 2.4, Theorem 2.5). A linear transformation of the instance space then allows for writing that function in canonical basis and computing its Fourier transform (Lemma 2.6, Theorem 2.7). The paper then makes an observation that the inverse of the linear transform used for making a change of basis (mapping to the canonical basis) can introduce instabilities to piecewise linear components defined over small regions (the inverse matrix appears in the Fourier transform). To address this instability, the paper relies on prior work by Jiang et al. (1999, 2003) and assigns the expected value over some ball centered at a training example as its prediction (which should be equivalent to performing averaging over bands in the Fourier domain). The integral is analytically intractable and, thus, the authors do an empirical estimate by averaging values in different random directions around the example. The experiments show that the method does not exhibit any serious instability with respect to the number points selected in that way.
The strategy does not require any additional training of the network and can be easily applied to already trained models with relu activations.
In the experiments, the approach is evaluated on standard adversarial attacking mechanisms: fast gradient sign method (Goodfellow et al., 2014), projected gradient descent method (Kurakin et al., 2016; Madry et al., 2017), deep fool attack method (Moosavi-Dezfooli et al., 2016) and L_2 method (Carlini & Wagner, 2017). I am not very familiar with the related work but this seems to be sufficient number of baselines to assess the effectiveness of the approach. The experiments are performed on ImageNet and Cifar10 datasets and show that the approach can make standard ResNet models more robust to the listed attacking strategies. It might be useful to test the approach with several different architectures (e.g., multi-layer perceptrons with different number of hidden layers, mix of convolutional and fully connected blocks etc).
In summary, the paper is well written and easy follow. The idea itself is simple but the intuition behind it is rather interesting and (to the best of my knowledge) provides novel insights into the workings of artificial neural networks with relu activations.