Skip to main content
Article
Stylized Adversarial Defense
IEEE Transactions on Pattern Analysis and Machine Intelligence
  • Muzammal Naseer, Mohamed Bin Zayed University of Artificial Intelligence
  • Salman Khan, Mohamed Bin Zayed University of Artificial Intelligence
  • Munawar Hayat, Monash University
  • Fahad Shahbaz Khan, Mohamed Bin Zayed University of Artificial Intelligence
  • Fatih Porikli, Qualcomm Incorporated
Document Type
Article
Abstract

Deep Convolution Neural Networks (CNNs) can easily be fooled by subtle, imperceptible changes to the input images. To address this vulnerability, adversarial training creates perturbation patterns and includes them in the training set to robustify the model. In contrast to existing adversarial training methods that only use class-boundary information (e.g., using a cross-entropy loss), we propose to exploit additional information from the feature space to craft stronger adversaries that are in turn used to learn a robust model. Specifically, we use the style and content information of the target sample from another class, alongside its class-boundary information to create adversarial perturbations. We apply our proposed multi-task objective in a deeply supervised manner, extracting multi-scale feature knowledge to create maximally separating adversaries. Subsequently, we propose a max-margin adversarial training approach that minimizes the distance between source image and its adversary and maximizes the distance between the adversary and the target image. Our adversarial training approach demonstrates strong robustness compared to state-of-the-art defenses, generalizes well to naturally occurring corruptions and data distributional shifts, and retains the model's accuracy on clean examples.

DOI
10.1109/TPAMI.2022.3207917
Publication Date
9-19-2022
Keywords
  • Adversarial attacks,
  • adversarial training,
  • Computational modeling,
  • max-margin learning,
  • multi-task objective,
  • Multitasking,
  • Perturbation methods,
  • Predictive models,
  • Robustness,
  • style transfer,
  • Training,
  • Visualization
Comments

IR Deposit conditions:

OA version (pathway a) Accepted version

No embargo

When accepted for publication, set statement to accompany deposit (see policy)

Must link to publisher version with DOI

Publisher copyright and source must be acknowledged

Citation Information
M. Naseer, S. Khan, M. Hayat, F. S. Khan and F. Porikli, "Stylized Adversarial Defense," in IEEE Transactions on Pattern Analysis and Machine Intelligence, 2022, doi: 10.1109/TPAMI.2022.3207917.