Unveiling Illusionary Robust Features: A Novel Approach for Adversarial Defenses in Deep Neural Networks

Abstract

Deep Neural Networks (DNNs) are vulnerable to visually imperceptible perturbations, known as Adversarial Examples (AEs). The leading hypothesis attributes this susceptibility to “non-robust features,” which are highly predictive but fragile. Recent studies have challenged the robustness of models trained on robust features. One study demonstrates that models trained on robust features are vulnerable to AutoAttack in cross-paradigm settings. Another study showing the susceptibility of robust models to attacks based on Projected Gradient Descent (PGD) when attackers have complete knowledge of the robust model suggests the presence of “illusionary robust features”—robust features highly correlated with incorrect labels—as the root cause of this vulnerability. These findings complicate the analysis of DNNs’ robustness and reveal limitations, without offering concrete solutions. This paper extends previous works by reevaluating the susceptibility of the “robust model” to AutoAttack. Considering “illusionary robust features” as the root cause of this susceptibility, we propose a novel robustification algorithm that generates a “purified robust dataset”. This robustification method not only nullifies the effect of features weakly correlated with correct labels (non-robust features) but also features highly correlated with incorrect labels (illusionary robust features). We evaluated the robustness of the models trained on “standard”, “robust”, and “purified robust” datasets against various strategies based on state-of-the-art AutoAttack and PGD attacks. These evaluations resulted in a better understanding of how the presence of “non-robust” and “illusionary robust” features in datasets and classifiers and their entanglements can result in the susceptibility of DNNs. Our experiment also shows that employing our robustification method, which filters out the effect of “non-robust” and “illusionary robust” features in both train and test sets, effectively addresses the vulnerabilities of DNNs, regardless of the mentioned entanglements. The contributions of this paper advance the understanding of DNN vulnerabilities and provide a more robust solution against sophisticated adversarial attacks.