Stochastic Activation Pruning for Robust Adversarial Defense

Abstract

Neural networks are known to be vulnerable to adversarial examples. Carefully chosen perturbations to real images, while imperceptible to humans, induce misclassification and threaten the reliability of deep learning systems in the wild. To guard against adversarial examples, we take inspiration from game theory and cast the problem as a minimax zero-sum game between the adversary and the model. In general, for such games, the optimal strategy for both players requires a stochastic policy, also known as a mixed strategy. In this light, we propose Stochastic Activation Pruning (SAP), a mixed strategy for adversarial defense. SAP prunes a random subset of activations (preferentially pruning those with smaller magnitude) and scales up the survivors to compensate. We can apply SAP to pretrained networks, including adversarially trained models, without fine-tuning, providing robustness against adversarial examples. Experiments demonstrate that SAP confers robustness against attacks, increasing accuracy and preserving calibration.

arXiv commentICLR 2018

References in corpus (9)

• Intriguing properties of neural networks
• Ensemble Adversarial Training: Attacks and Defenses
• MXNet: A Flexible and Efficient Machine Learning Library for Heterogeneous Distributed Systems
• On Calibration of Modern Neural Networks
• Towards Deep Learning Models Resistant to Adversarial Attacks
• The Space of Transferable Adversarial Examples
• Delving into adversarial attacks on deep policies
• Biologically inspired protection of deep networks from adversarial attacks
• On the Effectiveness of Defensive Distillation

Cited by in corpus (75)

• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Theoretically Principled Trade-off between Robustness and Accuracy
• Adversarial Weight Perturbation Helps Robust Generalization
• Adversarial Machine Learning in Image Classification: A Survey Towards the Defender's Perspective
• Motivating the Rules of the Game for Adversarial Example Research
• A Review of Adversarial Attack and Defense for Classification Methods
• Robust Pre-Training by Adversarial Contrastive Learning
• Adversarial Attack and Defense on Point Sets
• The Limitations of Adversarial Training and the Blind-Spot Attack
• Improving Adversarial Robustness via Channel-wise Activation Suppressing
• Towards Robust Neural Networks via Random Self-ensemble
• Adversarial Examples - A Complete Characterisation of the Phenomenon
• NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks
• Do Wider Neural Networks Really Help Adversarial Robustness?
• Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks
• Defensive Quantization: When Efficiency Meets Robustness
• Daedalus: Breaking Non-Maximum Suppression in Object Detection via Adversarial Examples
• Adversarial Robustness: From Self-Supervised Pre-Training to Fine-Tuning
• Defend Deep Neural Networks Against Adversarial Examples via Fixed and Dynamic Quantized Activation Functions
• DeepHunter: Hunting Deep Neural Network Defects via Coverage-Guided Fuzzing
• Robust Neural Networks using Randomized Adversarial Training
• Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses
• Post-Training Piecewise Linear Quantization for Deep Neural Networks
• RANDOM MASK: Towards Robust Convolutional Neural Networks
• Achieving Adversarial Robustness via Sparsity
• Breaking Transferability of Adversarial Samples with Randomness
• Adversarial Examples on Object Recognition: A Comprehensive Survey
• Improving the Robustness of Deep Neural Networks via Adversarial Training with Triplet Loss
• Adversarial Feature Augmentation and Normalization for Visual Recognition
• Towards Practical Lottery Ticket Hypothesis for Adversarial Training
• On Certifying Non-uniform Bound against Adversarial Attacks
• Block Switching: A Stochastic Approach for Deep Learning Security
• Denoised Internal Models: a Brain-Inspired Autoencoder against Adversarial Attacks
• Robustness and Transferability of Universal Attacks on Compressed Models
• On the Need for Topology-Aware Generative Models for Manifold-Based Defenses
• Effects of Loss Functions And Target Representations on Adversarial Robustness
• Defending against Adversarial Attack towards Deep Neural Networks via Collaborative Multi-task Training
• Improving Global Adversarial Robustness Generalization With Adversarially Trained GAN
• Attacking and Defending Machine Learning Applications of Public Cloud
• Improving the Robustness of Transformer-based Large Language Models with Dynamic Attention
• Rearchitecting Classification Frameworks For Increased Robustness
• Adversarial Parameter Defense by Multi-Step Risk Minimization
• Predicting Adversarial Examples with High Confidence
• Intelligence plays dice: Stochasticity is essential for machine learning
• Purifying Adversarial Perturbation with Adversarially Trained Auto-encoders
• Ptolemy: Architecture Support for Robust Deep Learning
• Noise Optimization for Artificial Neural Networks
• Ensemble-in-One: Learning Ensemble within Random Gated Networks for Enhanced Adversarial Robustness
• Iterative Window Mean Filter: Thwarting Diffusion-based Adversarial Purification
• AdvFoolGen: Creating Persistent Troubles for Deep Classifiers
• The art of defense: letting networks fool the attacker
• Meta Gradient Adversarial Attack
• A Useful Taxonomy for Adversarial Robustness of Neural Networks
• Challenging the adversarial robustness of DNNs based on error-correcting output codes
• Resilience from Diversity: Population-based approach to harden models against adversarial attacks
• Local Competition and Stochasticity for Adversarial Robustness in Deep Learning
• Local Competition and Uncertainty for Adversarial Robustness in Deep Learning
• Stochastic-HMDs: Adversarial Resilient Hardware Malware Detectors through Voltage Over-scaling
• Defenses Against Multi-Sticker Physical Domain Attacks on Classifiers
• Adversarial Machine Learning in Text Analysis and Generation
• A Neuro-Inspired Autoencoding Defense Against Adversarial Perturbations
• Towards Optimal Randomized Strategies in Adversarial Example Game
• Game Theory for Adversarial Attacks and Defenses
• Evaluating adversarial robustness in simulated cerebellum
• Linking average- and worst-case perturbation robustness via class selectivity and dimensionality
• Harnessing adversarial examples with a surprisingly simple defense
• Defense Through Diverse Directions
• Weighted Average Precision: Adversarial Example Detection in the Visual Perception of Autonomous Vehicles
• MadNet: Using a MAD Optimization for Defending Against Adversarial Attacks
• Absum: Simple Regularization Method for Reducing Structural Sensitivity of Convolutional Neural Networks
• Towards Quality Assurance of Software Product Lines with Adversarial Configurations
• Enhancing Transformation-based Defenses using a Distribution Classifier
• Erratum Concerning the Obfuscated Gradients Attack on Stochastic Activation Pruning
• A Model-Based Derivative-Free Approach to Black-Box Adversarial Examples: BOBYQA
• Thwarting finite difference adversarial attacks with output randomization