Defending Adversarial Attacks via Semantic Feature Manipulation

Machine learning models have demonstrated vulnerability to adversarial attacks, more specifically misclassification of examples. In this article, we propose a one-off and attack-agnostic Feature Manipulation (FM)-Defense detect purify examples in an interpretable efficient manner. The intuition is that the classification result normal image generally resistant non-significant intrinsic feature changes, e.g., varying thickness handwritten digits. contrast, are sensitive such changes since perturbation lacks transferability. To enable manipulation features, Combo-variational autoencoder applied learn disentangled latent codes reveal semantic features. resistance change over morphs, derived by reconstructing codes, used suspicious inputs. Furthermore, Combo-VAE enhanced with good quality considering class-shared class-unique We empirically demonstrate effectiveness detection purified instances. Our experiments on three datasets show FM-Defense can nearly 100 percent produced different state-of-the-art attacks. It achieves than 99 overall purification accuracy instances close manifold clean