Adversarial Data Robustness via Implicit Neural Representation

Since data-level robustness is a new area, the meaning about robustness designed with spatial coordinates is not clear.

Response: Robustness is not directly related to spatial coordinates. The spatial coordinates are used as the input of the INR to output the corresponding RGB values. Our method allows for the incorporation of the classifier's relevant information into the parameters of the INR to force the INR to reach a robust state.

The explanation about why the robust data can only be created via adversarial training in Section 3.1 is not convincing enough.

Response: Thank you for your suggestion. We think adversarial training could be an effective method for robust data generation. So, we change this sentence into:

"Considering the effectiveness of adversarial training in countering adversarial attacks, it could also be a valuable approach for generating robust data."

The authors motivate the adversarial data robustness by assuming many users do not have knowledge for adversarial training on their models. However, the proposed strategy still needs robust training for INR model. This is one caveat for the motivation.

Our approach is particularly suitable for situations where adversarial training at the model level is challenging. For instance, adversarially training a large-scale foundational model can be complex. In response, model developers can define a secure data format within their frameworks to enhance safety. Additionally, our concept of 'defense-in-creation' could serve as a safety module integrated with the foundational model. This setup would require that any images inputted into such a large-scale foundational model first pass through this safety module, which would remove adversarial perturbations.

It would be helpful to evaluate stronger attacks like Auto Attack besides CW and PGD.

Thank you for your suggestion. We conducted experiments by adapting AutoAttack for images during INR creation, and the results show that our defense-in-creation can reach high accuracy. We will add the results to the revised paper. For attack during transmission, due to the data being represented as INR, it is not feasible to directly apply AutoAttack to the INR parameters. Thus, the current AutoAttack cannot directly attack INR parameters.

Is this approach compatible with model-level adversarial training? I am curious if applying both data-level and model-level approaches would lead to stronger robustness over SOTA?

Yes. It is compatible with model-level adversarial training. As we do not have specific requirements for downstream models, they can also be an adversarial-robust network model. We will further study the cooperation with model-level approaches in our future work.

The paper introduces the concept of storing data as INRs for adversarial robustness, but it lacks clarity on how these representations can be derived for testing data. Given that testing data is typically only accessible during the testing phase, the paper should address the challenge of generating specific INRs for each testing image. For now, I would treat INR as a mere image generator.

Response: As we said in our submission, even for a new image, we only need to represent it to its corresponding INR format by incorporating the classifier property. Thus, in our experiments, for each classifier, we directly transfer their corresponding testing data into the INR format by incorporating the classifier property. Then, we can achieve the envisioned robustness.

The experimental design in the paper appears to lack fairness, which fails to prove the efficacy of the proposed method.

Response: We propose to incorporate the classifier's related information into the data format. Therefore, we should train INR for each image individually. We spend time on INR creation, but not on training models adversarially. Therefore, it is hard to compare the efficacy with other methods simply.

Please provide a more in-depth justification for the choice of INR as a data representation method for adversarial robustness.

Response: We just utilize the distinguished overfitting property of INR [1] to incorporate the classifier property into the data format. Then, we can achieve higher robustness. We can also consider image pixels as learnable parameters and optimize these learnable parameters adversarially. However, such a straightforward solution significantly undermines image quality since the pixel values are directly manipulated.

[1] Strümpler, Yannick, et al. "Implicit neural representations for image compression." ECCV. 2022.

How do the authors envision real-world applications where adversarial data robustness using INR would be particularly beneficial?

Response: This is needed when the model developers have a higher demand for robustness especially for some established specific models. In this situation, if they have high demands for the safety of their models and feel reluctant to do any alterations to their models, our setup would be useful for them. They only need to create robust data without any alternations to their models.

In the proposed setup, how can users derive INR representations for testing data, considering that in adversarial training, testing data is typically not accessible during training?

Response: Even for a totally new image, we only need to overfit it to its corresponding INR format by considering the classifier property. Thus, in our experiments, for each classifier, we directly transfer their corresponding testing data into the INR format by incorporating the classifier property. Then, we can achieve the envisioned robustness.

Are there any potential biases or confounding factors in the experimental setup that need to be addressed?

Response: We have emphasized in the article that due to the distinct nature of the envisioned scenario from traditional adversarial defense, our experimental setup differs accordingly. We obtain robust data representations for each image through defense-in-creation, which can withstand attacks during both creation and transmission. Similar to other INR methods, we do not specifically require a training dataset, which sets it apart from the traditional scenario.

Can the proposed framework used to defend unseen attacks?

Yes. In our experiment setting, we use 10-step PGD for INR training, while we test FGSM, 100-step PGD, and CW attacks for evaluation. We present the results of the experiments in Table 2.

Please provide the computational cost of the proposed method and compare it with other baselines.

In our experiments, we did not focus on time efficiency or computational costs, as most of the tasks could be completed swiftly using a single GPU. Typically, standard INR encoding is accomplished in about 7.12 seconds. When incorporating data robustness into the process, the entire training session can be concluded in under 175.50 seconds. Since conventional adversarial training methods like PGD-AT take 3-30 times longer than standard training [1], the time consumption of our method is also acceptable. It is also worth noting from prior research that 7-PGD adversarial training for CIFAR-10 takes more than 5000 minutes [2]. Besides, adversarial training for a diffusion model may require "millions of generated data even on small datasets such as CIFAR-10 on 8 $\times$ A100 GPUs, which is inefficient in the training phase"[3].

[1] Bai, Tao, et al. "Recent Advances in Adversarial Training for Adversarial Robustness." IJCAI 2021

[2] Shafahi, Ali, et al. "Adversarial training for free!." NeurIPS 2019.

[3] Wang, Zekai, et al. "Better diffusion models further improve adversarial training." ICML 2023.

The attack during creation formulated in Eq (2) is not an adaptive attack. Specifically, an adaptive attacking objective should be like

where the INR decoding and reconstruction process implemented by $\Psi\circ f\_{\theta}$ should be involved.

Response: We elucidate the connection between Eq. (2) and the adaptive attack. We define $\Phi: I \mapsto f\_\theta$ as the mapping from the image $I$ to the intermediate representation (INR) $f\_\theta$, and $\Psi: f\_\theta \mapsto \hat{I}$ as the mapping from the INR to the reconstructed image $\hat{I}$. Considering the adaptive attack, Eq. (2) should be written as

However, the mapping from the image $I$ to the intermediate representation (INR) $f\_\theta$ is obtained through optimizing Eq. (1). Therefore, the process $\Psi\circ \Phi$ is not amenable to gradient propagation. However, we can observe a property that $\Psi\circ \Phi(I)\approx I$. Based on the Backward Pass Differentiable Approximation (BPDA) method described in reference [1], we can estimate the gradient as $\nabla\_{I}\Psi\circ \Phi(I) \approx \nabla\_{I} I = 1$. Consequently, the above equation can be written as

This aligns with our formulation of Attack during creation in our paper. In fact, based on experimental results, this attack method is capable of successfully attacking methods utilizing conventional INR encoding. However, it can only be applied to the images undergoing encoding. Empirical evidence demonstrates that by considering additional adversarial loss during INR creation, we can effectively eliminate the perturbations added to the image.

[1] Athalye et al. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. ICML 2018

There are two extra computations introduced by the proposed method: first is the optimization process of $f\_{\theta}$, which is required to be optimized for each input image (i.e., cannot be amortized); second is the defense-in-creation process of Eq (4), which requires adversarial training by perturbing model parameters. The authors should report the empirical cost (e.g., computational time) for these two operations.

The time for the first process is 7.12 seconds. The time for the second process is 175.50 seconds when no optimization for computational costs is considered. Besides, our setup does not need any time for training an adversarially robust downstream network model like previous methods. Since conventional adversarial training methods like PGD-AT take 3-30 times longer than standard training [1], the time consumption of our method is also acceptable.

[1] Bai, Tao, et al. "Recent Advances in Adversarial Training for Adversarial Robustness." IJCAI 2021

The considered attacking methods such as PGD/DPGD, CW and FGSM are not strong. The authors should evaluate their methods under strong attacks like AutoAttack[3] and compare with the state-of-the-art models listed on RobustBench[4].

References:

[1] Athalye et al. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. ICML 2018

[2] Carlini et al. On evaluating adversarial robustness. arXiv 2019

[3] Croce and Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. ICML 2020

[4] https://robustbench.github.io/

Response: The AutoAttack has not been specifically studied for INR. We conducted experiments by adapting AutoAttack for images during INR creation, and the results show that our defense-in-creation can reach high accuracy. For attack during transmission, due to the data being represented as INR, it is not feasible to directly apply AutoAttack to the INR parameters.

The paper starts its discussion by arguing that adversarial training is hard to deploy. The paper reads: "*Despite its effectiveness, adversarial training requires that users possess a detailed understanding of training settings. *" In my view, this argument can even be used for using vanilla neural networks. One can make the same argument that even for using/training regular neural networks users need a detailed understanding of model architecture, optimization process, etc. There are no major differences that separates adversarial training from vanilla training, and I feel that motivating the core problem around such arguments is weak.

Response: We want to emphasize that adversarial training must consider potential attacks during model training or finetune the specific model to achieve adversarial robustness. However, when large-scale foundational model has become more popular today. Retraining specific models may become more difficult or even impossible [1]. In this situation, those model creators may define a specific data format suitable for their large-scale foundational models. Then, rather than directly retraining the model for adversarial robustness, our data robustness provides a more versatile solution. Besides, our experiments demonstrates that this unique robust data is able to achieve high robustness for specific models.

[1] Hoffmann, Jordan, et al. "An empirical analysis of compute-optimal large language model training." Advances in Neural Information Processing Systems 35 (2022): 30016-30030.

Why this process is efficient? Why the user doesn't send their data directly?

Response: This process may undermine the efficiency at the data side. However, it eliminates the need for time-consuming retraining or fine-tuning of the specific model. By incorporating the classifiers during the creation of INR, our method has achieved higher robustness for specific models in the current setting.

If we directly send images, such incorporation can significantly undermine the image quality as shown in the "Pixel manipulation" experiment.

What is special about this threat model?

Response: INR can encode the data into network parameters. By representing the data into INR, we are able to easily incorporate information of specific classifier into INR. Then, such unique data representation is able to achieve high robustness for specific models.

Since we utilize INR for data representation, we need to consider perturbations to the INR parameters in the threat model.

Using NeRF to encode a scene and then transmitting it would have made a much better threat model as NeRFs are encoding multiple scenes in one representation. However, using the current threat model for 2D images seems less intuitive and might not make any practical sense.

Response: NeRF is designed to encode a single, specific scene, utilizing multiple images from that scene for training. It is not capable of encoding multiple scenes within a single model. NeRF is also inapproproate for the tasks in our scenario requiring the representation of individual images. Besides, the use of INR for 2D image storage and transmission has been extensively studied. For example, [1] proposed that INR can achieve super-resolution image storage. [2] [3] considered using INR for image compression and transmission. [4] considered representing images as INR for neural network training. [5] implemented INR representation on the ImageNet dataset. Therefore, adopting INR as a cornerstone is practical and feasible.

[1] Nguyen, Quan H., and William J. Beksi. "Single image super-resolution via a dual interactive implicit neural network." Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision. 2023.

[2] Strümpler, Yannick, et al. "Implicit neural representations for image compression." European Conference on Computer Vision. 2022.

[3] Dupont, Emilien, et al. "COIN: COmpression with Implicit Neural representations." Neural Compression: From Information Theory to Applications--Workshop@ ICLR 2021. 2021.

[4] Rusu, Andrei A., et al. "Hindering Adversarial Attacks with Implicit Neural Representations." International Conference on Machine Learning. PMLR, 2022.

[5] Singh, Rajhans, Ankita Shukla, and Pavan Turaga. "Polynomial Implicit Neural Representations For Large Diverse Datasets." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2023.

Thank you for your question.

Our goal is to produce robust data for specific models. These data can be collected as a robust database. Our method can make the data in the database robust against adversarial attacks. In your case, if the attacker provides an adversarial INR beyond this database, it can be easily detected that this data does not belong to the database.

First of all, thanks for your work in the paper. I have a question about "Proposed defense method to produce INR against adversarial attacks".

Since the downstream model is fixed, given any image in test dataset, you can generate an adversarial INR to make the downstream model fail (Figure 2). To make the INR robust, you train the INR using the robustness loss with the real label (line 5 in algorithm3), which is unavailable for image in test dataset.

If $\lambda_2$ in equation (4) is set to zero (no information about real label), the accuracy is quite low (Table 4 in appendix). Besides, the accuracy is almost 100% for FGSM/PGD in INR, even higher than the normal input. Isn't that strange?