Pay Attention To The Global Component: An Effective Defense Approach against Adversarial Attacking

Abstract Deep neural networks (DNNs) approaches have been widely applied for real-world machine learning applications. However, they were shown to be vulnerable to adversarial attacks. Nature images blended with human indistinguishable perturbations, so-called adversarial samples, can cause mis-classification of DNNs. On the other hand, recent defense approaches still suffer from strong attacks. This paper proposes a Matrix-Completion and Component Attention (MCCA) framework, a novel defense framework that leverages matrix completion and attention mechanism to defend the DNNs against adversarial attacks. MCCA would process the input (perturbed) images by two steps: firstly, the matrix completion is applied on the randomly masked inputs to execute the “reconstruc-tion” process; then, the reconstructed images will go through a DNN attached with flexible “attention” modules to enhance its classification performance. We show that the mask-reconstruction process can clear the area poisoned by perturbation, and maintain the global component in the processed image; while the attention module will capture such global component during the feed-forward phase, further make the DNNs focus on the area of major component during the classification step. These two processes would make the DNNs consistent with the typical perception of human beings. We conduct comprehensive experiments on three image benchmarks, comparing MCCA with state-of-the-art defense approaches. The quantitative comparisons demonstrate that our defense approach consistently outperforms prior techniques, improving the robustness against both black-box and white-box attacks.