Divide, Denoise, and Defend against Adversarial Attacks

Abstract

Deep neural networks, although shown to be a successful class of machine learning algorithms, are known to be extremely unstable to adversarial perturbations. Improving the robustness of neural networks against these attacks is important, especially for security-critical applications. To defend against such attacks, we propose dividing the input image into multiple patches, denoising each patch independently, and reconstructing the image, without losing significant image content. We call our method D3. This proposed defense mechanism is non-differentiable which makes it non-trivial for an adversary to apply gradient-based attacks. Moreover, we do not fine-tune the network with adversarial examples, making it more robust against unknown attacks. We present an analysis of the tradeoff between accuracy and robustness against adversarial attacks. We evaluate our method under black-box, grey-box, and white-box settings. On the ImageNet dataset, our method outperforms the state-of-the-art by 19.7% under grey-box setting, and performs comparably under black-box setting. For the white-box setting, the proposed method achieves 34.4% accuracy compared to the 0% reported in the recent works.

References in corpus (16)

• Ensemble Adversarial Training: Attacks and Defenses
• Pixel Recurrent Neural Networks
• YouTube-8M: A Large-Scale Video Classification Benchmark
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• Detecting Adversarial Samples from Artifacts
• Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulation
• Spatially Transformed Adversarial Examples
• Adversarial Transformation Networks: Learning to Generate Adversarial Examples
• On Detecting Adversarial Perturbations
• Simple Black-Box Adversarial Perturbations for Deep Networks
• Early Methods for Detecting Adversarial Images
• Robustness of classifiers: from adversarial to random noise
• Fast Feature Fool: A data independent approach to universal adversarial perturbations
• Defense against Adversarial Attacks Using High-Level Representation Guided Denoiser
• Geometric robustness of deep networks: analysis and improvement

Cited by in corpus (13)

• Adversarial Machine Learning in Image Classification: A Survey Towards the Defender's Perspective
• Defending Against Universal Attacks Through Selective Feature Regeneration
• Pasadena: Perceptually Aware and Stealthy Adversarial Denoise Attack
• Adversarial Defense via Data Dependent Activation Function and Total Variation Minimization
• On the Limitations of Denoising Strategies as Adversarial Defenses
• Defense against adversarial attacks on deep convolutional neural networks through nonlocal denoising
• Random Directional Attack for Fooling Deep Neural Networks
• Adversarial Defense by Stratified Convolutional Sparse Coding
• Ensemble Defense with Data Diversity: Weak Correlation Implies Strong Robustness
• A unified view on differential privacy and robustness to adversarial examples
• Class-Aware Domain Adaptation for Improving Adversarial Robustness
• Adversarial Attacks on Cognitive Self-Organizing Networks: The Challenge and the Way Forward
• Using an ensemble color space model to tackle adversarial examples