Shield: Fast, Practical Defense and Vaccination for Deep Learning using JPEG Compression

Abstract

The rapidly growing body of research in adversarial machine learning has demonstrated that deep neural networks (DNNs) are highly vulnerable to adversarially generated images. This underscores the urgent need for practical defense that can be readily deployed to combat attacks in real-time. Observing that many attack strategies aim to perturb image pixels in ways that are visually imperceptible, we place JPEG compression at the core of our proposed Shield defense framework, utilizing its capability to effectively "compress away" such pixel manipulation. To immunize a DNN model from artifacts introduced by compression, Shield "vaccinates" a model by re-training it with compressed images, where different compression levels are applied to generate multiple vaccinated models that are ultimately used together in an ensemble defense. On top of that, Shield adds an additional layer of protection by employing randomization at test time that compresses different regions of an image using random compression levels, making it harder for an adversary to estimate the transformation performed. This novel combination of vaccination, ensembling, and randomization makes Shield a fortified multi-pronged protection. We conducted extensive, large-scale experiments using the ImageNet dataset, and show that our approaches eliminate up to 94% of black-box attacks and 98% of gray-box attacks delivered by the recent, strongest attacks, such as Carlini-Wagner's L2 and DeepFool. Our approaches are fast and work without requiring knowledge about the model.

under review at KDD'18

References in corpus (13)

• Explaining and Harnessing Adversarial Examples
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Synthesizing Robust Adversarial Examples
• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• Robust Physical-World Attacks on Deep Learning Models
• Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN
• Adversarial Perturbations Against Deep Neural Networks for Malware Classification
• A study of the effect of JPG compression on adversarial images
• Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression
• Ensemble Methods as a Defense to Adversarial Perturbations Against Deep Neural Networks
• Note on Attacking Object Detectors with Adversarial Stickers
• Improving Network Robustness against Adversarial Attacks with Compact Convolution

Cited by in corpus (13)

• Adversarial Examples Are a Natural Consequence of Test Error in Noise
• NetFense: Adversarial Defenses against Privacy Attacks on Neural Networks for Graph Data
• Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examples
• PAC-learning in the presence of evasion adversaries
• Adversarial Defense of Image Classification Using a Variational Auto-Encoder
• The Efficacy of SHIELD under Different Threat Models
• A Data Augmentation-based Defense Method Against Adversarial Attacks in Neural Networks
• Fine-tuning Is Not Enough: A Simple yet Effective Watermark Removal Attack for DNN Models
• Augmenting Model Robustness with Transformation-Invariant Attacks
• FBI: Fingerprinting models with Benign Inputs
• MixDefense: A Defense-in-Depth Framework for Adversarial Example Detection Based on Statistical and Semantic Analysis
• SAD: Saliency-based Defenses Against Adversarial Examples
• Deep Latent Defence