Paper | PPT | Checkpoints | Homepage | Certificate

Official PyTorch Implementation

Sen Pei, Jiaxi Sun, Xin Zhang, Qing Li, Shuo Li
Institute of Automation, Chinese Academy of Sciences

• pytorch, no strict version constraint.
• set GradientConcealment() in model/robust_layer.py as the top layer of your model in forward().

• Parameter-free, training-free, plug-and-play.
• Promising performance in both classification task and adversarial defense.
• Superior generalization across different model architectures, including CNN-based models and attention-based models.

• Download pre-trained models here:
  • RobustART
  • RobustBench
• Values below are AR (Attack Robustness) metric.

• Backbone does matter, ConvNext is better than SeResNet.
• Randomization is efficient for defending adversarial attacks.
• Data augmentation is vital for improving the classification performance, reducing overfitting.
• Gradient concealment dramatically improves AR metric of classifiers in presence of perturbed images.

• train_phase1/images/ : 22987 images for training
• train_phase1/label.txt : ground-truth file
• track1_test1/ : 20000 images for testing
• train_p2 : 127390 images within 100 categories

data_aug.py supports the following operations currently:

• PepperSaltNoise
• ColorPointNoise
• GaussianNoise
• Mosaic in black / gray / white / color
• RGBShuffle / ColorJitter
• Rotate
• HorizontalFlip / VerticalFlip
• RandomCut
• MotionBlur / GaussianBlur / ConventionalBlur
• Rain / Snow
• Extend
• BlockShuffle
• LocalShuffle (for learning local spatial feature)
• RandomPadding (for defense of adversarial attacks)

• transforms.Resize(256)
• transforms.RandomResizedCrop(224)
• Data augmentation schemes

• Adversarial training using fast gradient sign method.
• Resize and pad the input images for mitigating adversarial effects.
• Gradient concealment module for hiding the vulnerable direction of classifier's gradient.

• ConvNext(tiny) + FC + FGSM regularization + GCM(Gradient Concealment Module) + Randomization
• ConvNext(tiny) + ML Decoder + FGSM regularization + GCM(Gradient Concealment Module) + Randomization

• Training from scratch in a two-stage manner, we provide our checkpoints.
• The first stage: train ConvNext without ResizedPaddingLayer.
• The second stage: finetune ConvNext with ResizedPaddingLayer.

• python -m torch.distributed.launch --nproc_per_node=5 train.py --batch_size 64 --n_gpus=5
• If you have more GPUs, you can modify the nproc_per_node and n_gpus to utilize them.

• Explaining and Harnessing Adversarial Examples (NeurIPS, 2014)
• Deep Residual Learning for Image Recognition (CVPR, 2016)
• Squeeze-and-Excitation Networks (CVPR, 2018)
• Mitigating adversarial effects through randomization (ICLR, 2018)
• CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Features (ICCV, 2019)
• A ConvNet for the 2020s (CVPR, 2022)

@article{Pei2022Grad,
  title={Gradient Concealment: Free Lunch for Defending Adversarial Attacks},
  author={Sen Pei, Jiaxi Sun, Xiaopeng Zhang and Gaofeng Meng},
  archivePrefix={arXiv},
  primaryClass={cs.CV},
  year={2022}
}

• This work is done during the author's internship at ByteDance.
• The author would like to thank Xiaojie Jin and Ye Yuan for their support in both provided computing resources and vital discussions.