Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examples

Abstract

Image compression-based approaches for defending against the adversarial-example attacks, which threaten the safety use of deep neural networks (DNN), have been investigated recently. However, prior works mainly rely on directly tuning parameters like compression rate, to blindly reduce image features, thereby lacking guarantee on both defense efficiency (i.e. accuracy of polluted images) and classification accuracy of benign images, after applying defense methods. To overcome these limitations, we propose a JPEG-based defensive compression framework, namely "feature distillation", to effectively rectify adversarial examples without impacting classification accuracy on benign data. Our framework significantly escalates the defense efficiency with marginal accuracy reduction using a two-step method: First, we maximize malicious features filtering of adversarial input perturbations by developing defensive quantization in frequency domain of JPEG compression or decompression, guided by a semi-analytical method; Second, we suppress the distortions of benign features to restore classification accuracy through a DNN-oriented quantization refine process. Our experimental results show that proposed "feature distillation" can significantly surpass the latest input-transformation based mitigations such as Quilting and TV Minimization in three aspects, including defense efficiency (improve classification accuracy from $\sim 20\%$ to $\sim 90\%$ on adversarial examples), accuracy of benign images after defense ($\le 1\%$ accuracy degradation), and processing time per image ($\sim 259\times$ Speedup). Moreover, our solution can also provide the best defense efficiency ($\sim 60\%$ accuracy) against the recent adaptive attack with least accuracy reduction ($\sim 1\%$) on benign images when compared with other input-transformation based defense methods.

arXiv comment2019 Conference on Computer Vision and Pattern Recognition (CVPR 2019)

References in corpus (16)

• MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applications
• End to End Learning for Self-Driving Cars
• Ensemble Adversarial Training: Attacks and Defenses
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Countering Adversarial Images using Input Transformations
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples
• Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
• A study of the effect of JPG compression on adversarial images
• Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression
• Mitigating Adversarial Effects Through Randomization
• Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey
• Shield: Fast, Practical Defense and Vaccination for Deep Learning using JPEG Compression
• Defending against Adversarial Images using Basis Functions Transformations
• The Effects of JPEG and JPEG2000 Compression on Attacks using Adversarial Examples

Cited by in corpus (5)

• Adversarial Machine Learning in Image Classification: A Survey Towards the Defender's Perspective
• Adversarial Examples Are a Natural Consequence of Test Error in Noise
• RoVISQ: Reduction of Video Service Quality via Adversarial Attacks on Deep Learning-based Video Compression
• One Bit Matters: Understanding Adversarial Examples as the Abuse of Redundancy
• Learning to Structure an Image with Few Colors