Feature Distillation GAN: An Adversarial Example Defense Method Based on Feature Reconstruction

Purifying and reconstructing adversarial examples into benign ones by generative models is a class of defense methods to eliminate adversarial perturbations. These methods do not make assumptions on adversarial attacks or model architectures, and thus can defend classifiers against unseen threats. In this work, we propose a new GAN-based adversarial purification method Feature Distillation GAN (FDGAN). We consider how to eliminate the feature differences between adversarial examples and benign examples which are difficult for humans to perceive. We extract and analyze the differences between the adversarial examples and the benign examples from multiple dimensionals. On the basis of comparing the differences among various features, we propose a new feature-level perspective on adversarial purification, design a new adversarial example purification method for image inputs, and implement our method based on GAN. Experimental results show that FDGAN is effective against unknown adversarial attacks and outperforms all the purification methods we used for comparison. Evaluating FDGAN against strong adaptive attacks, the robust accuracy of FDGAN under AutoAttack (L∞ = 8/255) exceeds the SOTA adversarial training methods on the Robustbench. Furthermore, FDGAN has lower training cost and can be combined with a variety of model-based defense strategies to further improve the defense effectiveness.