Countering Adversarial Images using Input Transformations

Abstract

This paper investigates strategies that defend against adversarial-example attacks on image-classification systems by transforming the inputs before feeding them to the system. Specifically, we study applying image transformations such as bit-depth reduction, JPEG compression, total variance minimization, and image quilting before feeding the image to a convolutional network classifier. Our experiments on ImageNet show that total variance minimization and image quilting are very effective defenses in practice, in particular, when the network is trained on transformed images. The strength of those defenses lies in their non-differentiable nature and their inherent randomness, which makes it difficult for an adversary to circumvent the defenses. Our best defense eliminates 60% of strong gray-box and 90% of strong black-box attacks by a variety of major attack methods

12 pages, 6 figures, submitted to ICLR 2018

References in corpus (10)

• Adam: A Method for Stochastic Optimization
• End to End Learning for Self-Driving Cars
• Ensemble Adversarial Training: Attacks and Defenses
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Adversarial Machine Learning at Scale
• A study of the effect of JPG compression on adversarial images
• NO Need to Worry about Adversarial Examples in Object Detection in Autonomous Vehicles
• Parseval Networks: Improving Robustness to Adversarial Examples
• Houdini: Fooling Deep Structured Prediction Models
• Learning Adversary-Resistant Deep Neural Networks

Cited by in corpus (156)

• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Fast is better than free: Revisiting adversarial training
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• A Comprehensive Survey on Test-Time Adaptation under Distribution Shifts
• Adversarial Weight Perturbation Helps Robust Generalization
• A General Framework for Adversarial Examples with Objectives
• On the Convergence and Robustness of Adversarial Training
• Adversarial Machine Learning in Image Classification: A Survey Towards the Defender's Perspective
• Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey
• Adversarial Sample Detection for Deep Neural Network through Model Mutation Testing
• advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorch
• Adversarial Examples Are a Natural Consequence of Test Error in Noise
• Adversarial Examples that Fool Detectors
• Characterizing Audio Adversarial Examples Using Temporal Dependency
• Low Frequency Adversarial Perturbation
• Malware Makeover: Breaking ML-based Static Analysis by Modifying Executable Bytes
• Test-Time Training with Self-Supervision for Generalization under Distribution Shifts
• Adversarial Attack and Defense on Point Sets
• Improving the Transferability of Adversarial Examples with Resized-Diverse-Inputs, Diversity-Ensemble and Region Fitting
• The Limitations of Adversarial Training and the Blind-Spot Attack
• ME-Net: Towards Effective Adversarial Robustness with Matrix Estimation
• Towards Evaluating the Robustness of Deep Diagnostic Models by Adversarial Attack
• Convergence of Adversarial Training in Overparametrized Neural Networks
• A Survey of Safety and Trustworthiness of Deep Neural Networks: Verification, Testing, Adversarial Attack and Defence, and Interpretability
• Detecting Adversarial Examples by Input Transformations, Defense Perturbations, and Voting
• Fawkes: Protecting Privacy against Unauthorized Deep Learning Models
• Defending against Adversarial Images using Basis Functions Transformations
• Overfitting in adversarially robust deep learning
• Towards Robust Neural Networks via Random Self-ensemble
• Detecting Adversarial Samples for Deep Neural Networks through Mutation Testing
• Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks
• Denoised Smoothing: A Provable Defense for Pretrained Classifiers
• Fooling OCR Systems with Adversarial Text Images
• Do Wider Neural Networks Really Help Adversarial Robustness?
• Defend Deep Neural Networks Against Adversarial Examples via Fixed and Dynamic Quantized Activation Functions
• Understanding the Decision Boundary of Deep Neural Networks: An Empirical Study
• GenAttack: Practical Black-box Attacks with Gradient-Free Optimization
• A Survey on Security Attacks and Defense Techniques for Connected and Autonomous Vehicles
• A Survey of Black-Box Adversarial Attacks on Computer Vision Models
• Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examples
• Enhancing the Robustness of Deep Neural Networks by Boundary Conditional GAN
• Improving adversarial robustness of deep neural networks by using semantic information
• ConvNets and ImageNet Beyond Accuracy: Understanding Mistakes and Uncovering Biases
• Seeing isn't Believing: Practical Adversarial Attack Against Object Detectors
• Confidence from Invariance to Image Transformations
• Natural and Adversarial Error Detection using Invariance to Image Transformations
• Playing the Game of Universal Adversarial Perturbations
• Breaking Transferability of Adversarial Samples with Randomness
• Robustifying Models Against Adversarial Attacks by Langevin Dynamics
• Large Margin Deep Networks for Classification
• Adversarial Example Games
• Improving Network Robustness against Adversarial Attacks with Compact Convolution
• Identifying and Resisting Adversarial Videos Using Temporal Consistency
• Enhancing Gradient-based Attacks with Symbolic Intervals
• PuVAE: A Variational Autoencoder to Purify Adversarial Examples
• A Thorough Comparison Study on Adversarial Attacks and Defenses for Common Thorax Disease Classification in Chest X-rays
• Adversarial Examples on Object Recognition: A Comprehensive Survey
• ATHENA: A Framework based on Diverse Weak Defenses for Building Adversarial Defense
• Retrieval-Augmented Convolutional Neural Networks for Improved Robustness against Adversarial Examples
• FakeTagger: Robust Safeguards against DeepFake Dissemination via Provenance Tracking
• Fuzzy Unique Image Transformation: Defense Against Adversarial Attacks On Deep COVID-19 Models
• Query-Efficient Black-Box Attack by Active Learning
• Fine-grained Synthesis of Unrestricted Adversarial Examples
• Evaluation of Momentum Diverse Input Iterative Fast Gradient Sign Method (M-DI2-FGSM) Based Attack Method on MCS 2018 Adversarial Attacks on Black Box Face Recognition System
• Adversarial Perturbations Prevail in the Y-Channel of the YCbCr Color Space
• Adversarial Feature Augmentation and Normalization for Visual Recognition
• On Certifying Non-uniform Bound against Adversarial Attacks
• A Person Re-identification Data Augmentation Method with Adversarial Defense Effect
• AdvKnn: Adversarial Attacks On K-Nearest Neighbor Classifiers With Approximate Gradients
• Boosting Adversarial Attacks on Neural Networks with Better Optimizer
• Decision-based Universal Adversarial Attack
• Generative Dynamic Patch Attack
• Denoised Internal Models: a Brain-Inspired Autoencoder against Adversarial Attacks
• Over-parameterized Adversarial Training: An Analysis Overcoming the Curse of Dimensionality
• Imbalanced Gradients: A Subtle Cause of Overestimated Adversarial Robustness
• Better the Devil you Know: An Analysis of Evasion Attacks using Out-of-Distribution Adversarial Examples
• RNAS-CL: Robust Neural Architecture Search by Cross-Layer Knowledge Distillation
• Effects of Loss Functions And Target Representations on Adversarial Robustness
• Strength in Numbers: Trading-off Robustness and Computation via Adversarially-Trained Ensembles
• On the Need for Topology-Aware Generative Models for Manifold-Based Defenses
• CAP-GAN: Towards Adversarial Robustness with Cycle-consistent Attentional Purification
• Attacking and Defending Machine Learning Applications of Public Cloud
• On Adversarial Robustness of 3D Point Cloud Classification under Adaptive Attacks
• Defense-VAE: A Fast and Accurate Defense against Adversarial Attacks
• Dealing with Adversarial Player Strategies in the Neural Network Game iNNk through Ensemble Learning
• Adversarial Defense by Stratified Convolutional Sparse Coding
• Towards Characterizing Adversarial Defects of Deep Learning Software from the Lens of Uncertainty
• Structure-Preserving Transformation: Generating Diverse and Transferable Adversarial Examples
• Towards Understanding Limitations of Pixel Discretization Against Adversarial Attacks
• Improving Adversarial Robustness via Unlabeled Out-of-Domain Data
• Customizing an Adversarial Example Generator with Class-Conditional GANs
• Model-Based Robust Deep Learning: Generalizing to Natural, Out-of-Distribution Data
• BUZz: BUffer Zones for defending adversarial examples in image classification
• Predicting Adversarial Examples with High Confidence
• RAIN: A Simple Approach for Robust and Accurate Image Classification Networks
• Ensemble Defense with Data Diversity: Weak Correlation Implies Strong Robustness
• Medical Aegis: Robust adversarial protectors for medical images
• QAIR: Practical Query-efficient Black-Box Attacks for Image Retrieval
• Purifying Adversarial Perturbation with Adversarially Trained Auto-encoders
• Understanding Catastrophic Overfitting in Adversarial Training
• Ptolemy: Architecture Support for Robust Deep Learning
• Drawing Robust Scratch Tickets: Subnetworks with Inborn Robustness Are Found within Randomly Initialized Networks
• Attack as Defense: Characterizing Adversarial Examples using Robustness
• FineFool: Fine Object Contour Attack via Attention
• Adversarial Robustness for Unsupervised Domain Adaptation
• AdvFoolGen: Creating Persistent Troubles for Deep Classifiers
• AdvFilter: Predictive Perturbation-aware Filtering against Adversarial Attack via Multi-domain Learning
• Deep Neural Network Perception Models and Robust Autonomous Driving Systems
• Adversarial collision attacks on image hashing functions
• Understanding the Error in Evaluating Adversarial Robustness
• Diminishing the Effect of Adversarial Perturbations via Refining Feature Representation
• On Extensions of CLEVER: A Neural Network Robustness Evaluation Algorithm
• The Vulnerability of the Neural Networks Against Adversarial Examples in Deep Learning Algorithms
• Resilience from Diversity: Population-based approach to harden models against adversarial attacks
• Augmenting Model Robustness with Transformation-Invariant Attacks
• Robust Single-step Adversarial Training with Regularizer
• Local Competition and Uncertainty for Adversarial Robustness in Deep Learning
• The art of defense: letting networks fool the attacker
• Local Competition and Stochasticity for Adversarial Robustness in Deep Learning
• A Useful Taxonomy for Adversarial Robustness of Neural Networks
• An Empirical Study of DNNs Robustification Inefficacy in Protecting Visual Recommenders
• Non-Determinism in Neural Networks for Adversarial Robustness
• ADA: A Game-Theoretic Perspective on Data Augmentation for Object Detection
• Content-Adaptive Pixel Discretization to Improve Model Robustness
• Robust and Information-theoretically Safe Bias Classifier against Adversarial Attacks
• Universal Adversarial Perturbations for CNN Classifiers in EEG-Based BCIs
• Analysis of Random Perturbations for Robust Convolutional Neural Networks
• Can audio-visual integration strengthen robustness under multimodal attacks?
• Orthogonal Deep Models As Defense Against Black-Box Attacks
• Robust Text CAPTCHAs Using Adversarial Examples
• A Neuro-Inspired Autoencoding Defense Against Adversarial Perturbations
• Achieving Adversarial Robustness Requires An Active Teacher
• Learning to Separate Clusters of Adversarial Representations for Robust Adversarial Detection
• Defense-friendly Images in Adversarial Attacks: Dataset and Metrics for Perturbation Difficulty
• Delving into Deep Image Prior for Adversarial Defense: A Novel Reconstruction-based Defense Framework
• AID-Purifier: A Light Auxiliary Network for Boosting Adversarial Defense
• Closing the Gap: Achieving Better Accuracy-Robustness Tradeoffs against Query-Based Attacks
• Human Imperceptible Attacks and Applications to Improve Fairness
• Tightening the Approximation Error of Adversarial Risk with Auto Loss Function Search
• Sparse Coding Frontend for Robust Neural Networks
• An Integrated Approach to Produce Robust Models with High Efficiency
• Shape Defense Against Adversarial Attacks
• On Intrinsic Dataset Properties for Adversarial Machine Learning
• Spatiotemporal Attacks for Embodied Agents
• Defense Through Diverse Directions
• Using an ensemble color space model to tackle adversarial examples
• Defenses Against Multi-Sticker Physical Domain Attacks on Classifiers
• Adversarial Ranking Attack and Defense
• Weighted Average Precision: Adversarial Example Detection in the Visual Perception of Autonomous Vehicles
• Improving Resistance to Adversarial Deformations by Regularizing Gradients
• Towards Quality Assurance of Software Product Lines with Adversarial Configurations
• Universal Physical Camouflage Attacks on Object Detectors
• Enhancing Transformation-based Defenses using a Distribution Classifier
• Likelihood Landscapes: A Unifying Principle Behind Many Adversarial Defenses
• A general metric for identifying adversarial images
• Defending Against Adversarial Attacks Using Random Forests