Adversarial Phenomenon in the Eyes of Bayesian Deep Learning

Abstract

Deep Learning models are vulnerable to adversarial examples, i.e.\ images obtained via deliberate imperceptible perturbations, such that the model misclassifies them with high confidence. However, class confidence by itself is an incomplete picture of uncertainty. We therefore use principled Bayesian methods to capture model uncertainty in prediction for observing adversarial misclassification. We provide an extensive study with different Bayesian neural networks attacked in both white-box and black-box setups. The behaviour of the networks for noise, attacks and clean test data is compared. We observe that Bayesian neural networks are uncertain in their predictions for adversarial perturbations, a behaviour similar to the one observed for random Gaussian perturbations. Thus, we conclude that Bayesian neural networks can be considered for detecting adversarial examples.

arXiv comment13 pages, 7 figures

References in corpus (6)

• Explaining and Harnessing Adversarial Examples
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• On Calibration of Modern Neural Networks
• Bayesian Convolutional Neural Networks with Bernoulli Approximate Variational Inference
• Bayesian Active Learning for Classification and Preference Learning
• Adversarial Examples, Uncertainty, and Transfer Testing Robustness in Gaussian Process Hybrid Deep Networks

Cited by in corpus (13)

• Understanding Measures of Uncertainty for Adversarial Example Detection
• Adversarial Distillation of Bayesian Neural Network Posteriors
• Robustness of Bayesian Neural Networks to Gradient-Based Attacks
• Sufficient Conditions for Idealised Models to Have No Adversarial Examples: a Theoretical and Empirical Study with Bayesian Neural Networks
• Uncertainty Based Detection and Relabeling of Noisy Image Labels
• Bayesian Adversarial Spheres: Bayesian Inference and Adversarial Examples in a Noiseless Setting
• LiBRe: A Practical Bayesian Approach to Adversarial Detection
• Scalable Natural Gradient Langevin Dynamics in Practice
• Continual Learning Using Bayesian Neural Networks
• Efficient Computation Reduction in Bayesian Neural Networks Through Feature Decomposition and Memorization
• Scalable Multi-Class Bayesian Support Vector Machines for Structured and Unstructured Data
• Probabilistic Safety for Bayesian Neural Networks
• Deep Latent Defence