Embodied Active Defense: Leveraging Recurrent Feedback to Counter
  Adversarial Patches
Lingxuan Wu Xiao Yang Yinpeng Dong Liuwei Xie Hang Su Jun Zhu
The vulnerability of deep neural networks to adversarial patches has
motivated numerous defense strategies for boosting model robustness. However,
the prevailing defenses depend on single observation or pre-established
adversary information to counter adversarial patches, often failing to be
confronted with unseen or adaptive adversarial attacks and easily exhibiting
unsatisfying performance in dynamic 3D environments. Inspired by active human
perception and recurrent feedback mechanisms, we develop Embodied Active
Defense (EAD), a proactive defensive strategy that actively contextualizes
environmental information to address misaligned adversarial patches in 3D
real-world settings. To achieve this, EAD develops two central recurrent
sub-modules, i.e., a perception module and a policy module, to implement two
critical functions of active vision. These models recurrently process a series
of beliefs and observations, facilitating progressive refinement of their
comprehension of the target object and enabling the development of strategic
actions to counter adversarial patches in 3D environments. To optimize learning
efficiency, we incorporate a differentiable approximation of environmental
dynamics and deploy patches that are agnostic to the adversary strategies.
Extensive experiments demonstrate that EAD substantially enhances robustness
against a variety of patches within just a few steps through its action policy
in safety-critical tasks (e.g., face recognition and object detection), without
compromising standard accuracy. Furthermore, due to the attack-agnostic
characteristic, EAD facilitates excellent generalization to unseen attacks,
diminishing the averaged attack success rate by 95 percent across a range of
unseen adversarial attacks.