Deep models are state-of-the-art for many computer vision tasks including image classification and object detection. However, it has been shown that deep models are vulnerable to adversarial examples. We highlight how one-hot encoding directly contributes to this vulnerability and propose breaking away from this widely-used, but highly-vulnerable mapping. We demonstrate that by leveraging a different output encoding, multi-way encoding, we can make models more robust. Our approach makes it more difficult for adversaries to find useful gradients for generating adversarial attacks. We present state-of-the-art robustness results for black-box, white-box attacks, and achieve higher clean accuracy on four benchmark datasets: MNIST, CIFAR-10, CIFAR-100, and SVHN when combined with adversarial training. The strength of our approach is also presented in the form of an attack for model watermarking, raising challenges in detecting stolen models. Deep learning models are vulnerable to adversarial examples BID19 ]. Evidence shows that adversarial examples are transferable BID14 ; BID11 ]. This weakness can be exploited even if the adversary does not know the target model under attack, posing severe concerns about the security of the models. This is because an adversary can use a substitute model for generating adversarial examples for the target model, also known as black-box attacks.Black-box attacks such as BID4 rely on perturbing input by adding an amount dependent upon the gradient of the loss function with respect to the input of a substitute model. An example adversarial attack is x adv = x + sign(∇ x Loss(f (x)), where f (x) is the model used to generate the attack. This added "noise" can fool a model although it may not be visually evident to a human. The assumption of such gradient-based approaches is that the gradients with respect to the input, of the substitute and target models, are correlated.Our key observation is that the setup of conventional deep classification frameworks aids in the correlation of such gradients. Typically, a cross-entropy loss, a soft-max layer, and a one-hot vector encoding for a target label are used when training deep models. These conventions make a model more vulnerable to black-box attacks. This setting constrains the encoding length, and the number of possible non-zero gradient directions at the encoding layer. This makes it easier for an adversary to pick a harmful gradient direction and perform an attack.We aim to increase the adversarial robustness of deep models. Our multi-way encoding representation relaxes the one-hot encoding to a real number encoding, and embeds the encoding in a space that has dimension higher than the number of classes. These encoding methods lead to an increased number of possible gradient directions, as illustrated in Figure 1 . This makes it more difficult for an adversary to pick a harmful direction that would cause a misclassification of a correctly classified point, generating a targeted or untargeted attack. Untargeted attacks aim to misclassify a point, while targeted attacks aim to misclassify a point to a specific target class. Multi-way encoding also helps improve a model's robustness in cases where the adversary has full knowledge of the target model under attack: a white-box attack. The benefits of multi-way encoding are demonstrated in experiments with four benchmark datasets: MNIST, CIFAR-10, CIFAR-100, and SVHN.We also demonstrate the strength of our approach by introducing an attack for the recent model watermarking algorithm of BID24 , which deliberately trains a model to misclassify (a) (b) (c) Figure 1 : Demonstration of the benefit of relaxing and increasing the encoding dimensionality, for a binary classification problem at the final encoding layer. C i is the codebook encoding for class i, axis s i represents the output activation of neuron i in the output encoding layer, where i = 1, . . . , l and l is the encoding dimensionality. The depicted points are correctly classified points of the green and blue classes. The arrows depict the possible non-zero perturbation directions sign( ∂Loss ∂si ). (a) 2D 1of K softmax-crossentropy setup: Only two non-zero gradient directions exist for a 1of K encoding. Of these two directions, only one is an adversarial direction, depicted in red. (b) 2D multi-way encoding: Four non-zero perturbation directions exist. The fraction of directions that now move a point to the adversarial class (red) drops. (c) 3D multi-way encoding: A higher dimensional encoding results in a significantly lower fraction of gradient perturbations whose direction would move an input from the green ground-truth class to the blue class, or vice versa. certain watermarked images. We interpret such watermarked images as adversarial examples. We demonstrate that the multi-way encoding reduces the transferability of the watermarked images, making it more challenging to detect stolen models.We summarize our contributions as follows:1. We show that the traditional 1of K mapping is a source of vulnerability to adversarial gradients. 2. We propose a novel solution using multi-way encoding to alleviate the vulnerability caused by the 1of K mapping. 3. We empirically show that the proposed approach improves model robustness against both black-box and white-box attacks. 4. We also show how to apply our encoding framework in attacking the recently proposed model watermarking scheme of BID24 .
We demonstrate that by leveraging a multi-way output encoding, rather than the widely used one-hot encoding, we can make deep models more robust to adversarial attacks. This paper proposes replacing the final cross-entropy layer trained on one-hot labels in classifiers by encoding each label as a high-dimensional vector and training the classifier to minimize L2 distance from the encoding of the correct class. Authors propose new method against adversarial attacks that shows significant amount of gains compared to baselines