AFD: Defending Convolutional Neural Networks Without Using Adversarial Samples

The vulnerability of deep neural networks to adversarial attacks has attracted much research effort. Still, studies have shown that it is challenging to simultaneously achieve both strong robustness to adversarial attacks and low degradation in the performance on the original task, as there is always a trade-off between the two objectives. In this paper, we present a novel training strategy named Adversarial-Free Defense (AFD), which introduces a minimal change to a network architecture (by modifying the first convolution layer) while employing a learning algorithm that leads to special properties of the first-layer kernels. We show how this learning strategy enhances the robustness of the network to adversarial attacks (without using adversarial samples) while maintaining a reasonable performance on the original task. Empirical results including analysis in terms of the effective Lipschitz constant of the learned network suggest that, compared to most existing methods that rely on elaborate regularization schemes imposed on all layers, our seemingly simplistic approach demonstrates high effectiveness.