Early Methods for Detecting Adversarial Images

Abstract

Many machine learning classifiers are vulnerable to adversarial perturbations. An adversarial perturbation modifies an input to change a classifier's prediction without causing the input to seem substantially different to human perception. We deploy three methods to detect adversarial images. Adversaries trying to bypass our detectors must make the adversarial image less pathological or they will fail trying. Our best detection method reveals that adversarial images place abnormal emphasis on the lower-ranked principal components from PCA. Other detectors and a colorful saliency map are in an appendix.

ICLR 2017 Workshop Contribution

References in corpus (3)

• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Adversarial Perturbations Against Deep Neural Networks for Malware Classification
• Foveation-based Mechanisms Alleviate Adversarial Examples

Cited by in corpus (44)

• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Synthesizing Robust Adversarial Examples
• Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
• Adversarial Examples: Opportunities and Challenges
• Adversarial Examples: Attacks and Defenses for Deep Learning
• Adversarial Example Detection for DNN Models: A Review and Experimental Comparison
• Adversarial Machine Learning in Image Classification: A Survey Towards the Defender's Perspective
• Motivating the Rules of the Game for Adversarial Example Research
• Benchmarking Neural Network Robustness to Common Corruptions and Surface Variations
• Provably Minimally-Distorted Adversarial Examples
• A Survey of Safety and Trustworthiness of Deep Neural Networks: Verification, Testing, Adversarial Attack and Defence, and Interpretability
• Detecting and Diagnosing Adversarial Images with Class-Conditional Capsule Reconstructions
• Defending against Adversarial Images using Basis Functions Transformations
• Adversarial Examples - A Complete Characterisation of the Phenomenon
• Confidence-Calibrated Adversarial Training: Generalizing to Unseen Attacks
• "That Is a Suspicious Reaction!": Interpreting Logits Variation to Detect NLP Adversarial Attacks
• Divide, Denoise, and Defend against Adversarial Attacks
• Adversarial Learning in Statistical Classification: A Comprehensive Review of Defenses Against Attacks
• DaST: Data-free Substitute Training for Adversarial Attacks
• Two Souls in an Adversarial Image: Towards Universal Adversarial Example Detection using Multi-view Inconsistency
• Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Them
• Towards neural networks that provably know when they don't know
• GhostImage: Remote Perception Attacks against Camera-based Image Classification Systems
• Detection based Defense against Adversarial Examples from the Steganalysis Point of View
• Effective and Robust Detection of Adversarial Examples via Benford-Fourier Coefficients
• DropCluster: A structured dropout for convolutional networks
• Mitigating Evasion Attacks to Deep Neural Networks via Region-based Classification
• Cassandra: Detecting Trojaned Networks from Adversarial Perturbations
• Connecting the Dots: Detecting Adversarial Perturbations Using Context Inconsistency
• Detecting Adversarial Perturbations with Saliency
• Long-term Cross Adversarial Training: A Robust Meta-learning Method for Few-shot Classification Tasks
• Iterative Window Mean Filter: Thwarting Diffusion-based Adversarial Purification
• Implicit Generative Modeling of Random Noise during Training for Adversarial Robustness
• Moving Target Defense for Deep Visual Sensing against Adversarial Examples
• ExAD: An Ensemble Approach for Explanation-based Adversarial Detection
• Efficient detection of adversarial images
• Using Anomaly Feature Vectors for Detecting, Classifying and Warning of Outlier Adversarial Examples
• Mitigation of Adversarial Attacks through Embedded Feature Selection
• Effect of backdoor attacks over the complexity of the latent space distribution
• Clipping free attacks against artificial neural networks
• Attribution of Gradient Based Adversarial Attacks for Reverse Engineering of Deceptions
• Detecting Adversaries, yet Faltering to Noise? Leveraging Conditional Variational AutoEncoders for Adversary Detection in the Presence of Noisy Images
• Are L2 adversarial examples intrinsically different?
• Adversarial Imitation Attack