AID-Purifier: A Light Auxiliary Network for Boosting Adversarial Defense

In this study, we propose AID-Purifier that can boost the robustness of adversarially-trained networks by purifying their inputs. AID-Purifier is an auxiliary network that works as an add-on to an already trained main classifier. To keep it computationally light, it is trained as a discriminator with a binary cross-entropy loss. To obtain additionally useful information from the adversarial examples, the architecture design is closely related to the information maximization principle where two layers of the main classification network are piped into the auxiliary network. To assist the iterative optimization procedure of purification, the auxiliary network is trained with AVmixup. AID-Purifier can be also used together with other purifiers such as PixelDefend for an extra enhancement. Because input purification has been studied relative less when compared to adversarial training or gradient masking, we conduct extensive attack experiments to validate AID-Purifier’s robustness. The overall results indicate that the best performing adversarially-trained networks can be enhanced further with AID-Purifier. The code is available in https://github.com/yelobean/AIDPurifier.