Generalization of Defense Effects Learned from a Single Adversarial Attack

Adversarial attacks misled deep neural networks by injecting perturbations into input images. Training networks with adversarial examples defended against adversarial attacks. However, training with specific adversarial examples only defended against the corresponding attacks. To generalize the defense effect from one specific attack to other attacks, we proposed a method called Gradient Vicinity Adversarial Training (GVAT), which generated adversarial examples along directions sampled in the vicinity of the gradient. The defense effects of GVAT were evaluated using three attack methods: fast gradient sign method (FGSM), projected gradient descent (PGD), and Carlini–Wagner (CW) under the L2-norm constraint. A three-layer convolutional network was trained on the MNIST dataset, and two WideResNet-28-10 networks were trained on the CIFAR-10 and CIFAR-100 datasets respectively. Under the transfer-based black-box setting, the results showed that GVAT not only defended against the corresponding attacks that generated adversarial examples but also defended against other attacks. In other words, the defense effect of GVAT was generalized to other attacks under the transfer-based black-box setting.