Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression

Abstract

Deep neural networks (DNNs) have achieved great success in solving a variety of machine learning (ML) problems, especially in the domain of image recognition. However, recent research showed that DNNs can be highly vulnerable to adversarially generated instances, which look seemingly normal to human observers, but completely confuse DNNs. These adversarial samples are crafted by adding small perturbations to normal, benign images. Such perturbations, while imperceptible to the human eye, are picked up by DNNs and cause them to misclassify the manipulated instances with high confidence. In this work, we explore and demonstrate how systematic JPEG compression can work as an effective pre-processing step in the classification pipeline to counter adversarial attacks and dramatically reduce their effects (e.g., Fast Gradient Sign Method, DeepFool). An important component of JPEG compression is its ability to remove high frequency signal components, inside square blocks of an image. Such an operation is equivalent to selective blurring of the image, helping remove additive perturbations. Further, we propose an ensemble-based technique that can be constructed quickly from a given well-performing DNN, and empirically show how such an ensemble that leverages JPEG compression can protect a model from multiple types of adversarial attacks, without requiring knowledge about the model.

References in corpus (8)

• Explaining and Harnessing Adversarial Examples
• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN
• Detecting Adversarial Samples from Artifacts
• Adversarial Perturbations Against Deep Neural Networks for Malware Classification
• A study of the effect of JPG compression on adversarial images
• Foveation-based Mechanisms Alleviate Adversarial Examples
• The Limitations of Deep Learning in Adversarial Settings

Cited by in corpus (69)

• Adversarial Machine Learning in Image Classification: A Survey Towards the Defender's Perspective
• Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey
• Motivating the Rules of the Game for Adversarial Example Research
• Adversarial Examples Are a Natural Consequence of Test Error in Noise
• Traffic Sign Detection under Challenging Conditions: A Deeper Look Into Performance Variations and Spectral Characteristics
• Unrestricted Adversarial Examples via Semantic Manipulation
• Shield: Fast, Practical Defense and Vaccination for Deep Learning using JPEG Compression
• Defending against Adversarial Images using Basis Functions Transformations
• Adversarial Examples - A Complete Characterisation of the Phenomenon
• Adversarial Attacks and Defenses in Physiological Computing: A Systematic Review
• Towards a Robust and Trustworthy Machine Learning System Development: An Engineering Perspective
• Traffic Signs in the Wild: Highlights from the IEEE Video and Image Processing Cup 2017 Student Competition [SP Competitions]
• ConFoc: Content-Focus Protection Against Trojan Attacks on Neural Networks
• Morphence: Moving Target Defense Against Adversarial Examples
• Defense Against Adversarial Attacks with Saak Transform
• Towards resilient machine learning for ransomware detection
• Challenging Environments for Traffic Sign Detection: Reliability Assessment under Inclement Conditions
• Defense against Adversarial Attacks Using High-Level Representation Guided Denoiser
• Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examples
• Combating Adversarial Attacks Using Sparse Representations
• DUP-Net: Denoiser and Upsampler Network for 3D Adversarial Point Clouds Defense
• Improving adversarial robustness of deep neural networks by using semantic information
• Adversarial Examples on Object Recognition: A Comprehensive Survey
• ATHENA: A Framework based on Diverse Weak Defenses for Building Adversarial Defense
• AdvDrop: Adversarial Attack to DNNs by Dropping Information
• On the Limitations of Denoising Strategies as Adversarial Defenses
• Adversarial Perturbations Prevail in the Y-Channel of the YCbCr Color Space
• Block Switching: A Stochastic Approach for Deep Learning Security
• Adversarial Robustness Assessment: Why both $L_0$ and $L_{\infty }$ Attacks Are Necessary
• Decision-based Universal Adversarial Attack
• Adv-watermark: A Novel Watermark Perturbation for Adversarial Examples
• Detection based Defense against Adversarial Examples from the Steganalysis Point of View
• Adversarial Defense by Suppressing High-frequency Components
• Adversarial Defense of Image Classification Using a Variational Auto-Encoder
• Cyber-Physical Security Vulnerabilities Identification and Classification in Smart Manufacturing -- A Defense-in-Depth Driven Framework and Taxonomy
• Adversarial Defense by Stratified Convolutional Sparse Coding
• Adversarial Reinforcement Learning under Partial Observability in Autonomous Computer Network Defence
• Exploiting the Inherent Limitation of L0 Adversarial Examples
• Robust Adversarial Learning via Sparsifying Front Ends
• Automated Discovery of Adaptive Attacks on Adversarial Defenses
• Advancing Adversarial Training by Injecting Booster Signal
• Butterfly Effect: Bidirectional Control of Classification Performance by Small Additive Perturbation
• Analytical Moment Regularizer for Gaussian Robust Networks
• Mitigating Gradient-based Adversarial Attacks via Denoising and Compression
• Feature-Filter: Detecting Adversarial Examples through Filtering off Recessive Features
• Deep Neural Network Perception Models and Robust Autonomous Driving Systems
• FineFool: Fine Object Contour Attack via Attention
• A Unified Game-Theoretic Interpretation of Adversarial Robustness
• Once a MAN: Towards Multi-Target Attack via Learning Multi-Target Adversarial Network Once
• Reinforcement Learning for Autonomous Defence in Software-Defined Networking
• AdvFilter: Predictive Perturbation-aware Filtering against Adversarial Attack via Multi-domain Learning
• The Helmholtz Method: Using Perceptual Compression to Reduce Machine Learning Complexity
• Anti-Bandit Neural Architecture Search for Model Defense
• AdvMS: A Multi-source Multi-cost Defense Against Adversarial Attacks
• Moving Target Defense for Deep Visual Sensing against Adversarial Examples
• D-square-B: Deep Distribution Bound for Natural-looking Adversarial Attack
• Unifying Bilateral Filtering and Adversarial Training for Robust Neural Networks
• Perceptual Deep Neural Networks: Adversarial Robustness through Input Recreation
• Representation Quality Of Neural Networks Links To Adversarial Attacks and Defences
• Search Space of Adversarial Perturbations against Image Filters
• Content-Adaptive Pixel Discretization to Improve Model Robustness
• Analysis of Random Perturbations for Robust Convolutional Neural Networks
• Defending Against Adversarial Attacks Using Random Forests
• Defense Through Diverse Directions
• Countering Adversarial Examples: Combining Input Transformation and Noisy Training
• Moiré Attack (MA): A New Potential Risk of Screen Photos
• Defense-friendly Images in Adversarial Attacks: Dataset and Metrics for Perturbation Difficulty
• Stochastic-HMDs: Adversarial Resilient Hardware Malware Detectors through Voltage Over-scaling
• An Efficient Pre-processing Method to Eliminate Adversarial Effects