Remove to Regenerate: Boosting Adversarial Generalization With Attack Invariance

Adversarial attacks pose a huge challenge to the deployment of deep neural networks (DNNs) in security-sensitive applications. Adversarial defense methods are developed to resist adversarial perturbation. However, most defenses overlook the generalization to various attacks. In medical field, it is known that targeted therapy is a treatment approach at the cellular and molecular levels that targets already identified carcinogenic sites. Inspired by the popular targeted therapies for cancer, we view adversarial attacks as local lesions of natural benign samples. The mechanism behind this assumption implies our key finding that the salient attack components in an adversarial sample dominate the attacking process, while trivial attack components unexpectedly provide trustworthy evidence for obtaining generalizable robustness. Based on this finding, an explainable but efficient Adversarial Surgery and Regeneration (ASR) model following the targeted therapy mechanism is developed to improve the adversarial generalization of DNNs, which has three merits: 1) A score-based Pixel Surgery (PS) module is proposed to remove the salient attack components while retaining the trivial attack components as a kind of attack-invariant information. 2) A Semantic Regeneration module (SR) based on a conditional alignment extrapolator is proposed to restore the discriminative content from the attack-free trivial components, which achieves pixel and semantic consistency for adversarial samples. 3) To further harmonize robustness and accuracy and address such an intractable problem in adversarial defense, a self-augmentation regularizer with adversarial R-drop (ARD) is designed. Experiments on numerous benchmarks show the superiority of the proposed ASR approach. The code can be found in https://github.com/fxw13/ASR.