FACM: Intermediate Layer Still Retain Effective Features against Adversarial Examples

In strong adversarial attacks against deep neural networks (DNN), the generated adversarial example will mislead the DNN-implemented classifier by destroying the output features of the last layer. To enhance the robustness of the classifier, in our paper, a $\mathbf{\text{F}}$eature $\mathbf{\text{A}}$nalysis and $\mathbf{\text{C}}$onditional $\mathbf{\text{M}}$atching prediction distribution (FACM) model is proposed to utilize the features of intermediate layers to correct the classification. Specifically, we first prove that the intermediate layers of the classifier can still retain effective features for the original category, which is defined as the correction property in our paper. According to this, we propose the FACM model consisting of $\mathbf{\text{F}}$eature $\mathbf{\text{A}}$nalysis (FA) correction module, $\mathbf{\text{C}}$onditional $\mathbf{\text{M}}$atching $\mathbf{\text{P}}$rediction $\mathbf{\text{D}}$istribution (CMPD) correction module and decision module. The FA correction module is the fully connected layers constructed with the output of the intermediate layers as the input to correct the classification of the classifier. The CMPD correction module is a conditional auto-encoder, which can not only use the output of intermediate layers as the condition to accelerate convergence but also mitigate the negative effect of adversarial example training with the Kullback-Leibler loss to match prediction distribution. Through the empirically verified diversity property, the correction modules can be implemented synergistically to reduce the adversarial subspace. Hence, the decision module is proposed to integrate the correction modules to enhance the DNN classifier’s robustness. Specially, our model can be achieved by fine-tuning and can be combined with other model-specific defenses.