Unifying Bilateral Filtering and Adversarial Training for Robust Neural Networks

Abstract

Recent analysis of deep neural networks has revealed their vulnerability to carefully structured adversarial examples. Many effective algorithms exist to craft these adversarial examples, but performant defenses seem to be far away. In this work, we explore the use of edge-aware bilateral filtering as a projection back to the space of natural images. We show that bilateral filtering is an effective defense in multiple attack settings, where the strength of the adversary gradually increases. In the case of an adversary who has no knowledge of the defense, bilateral filtering can remove more than 90% of adversarial examples from a variety of different attacks. To evaluate against an adversary with complete knowledge of our defense, we adapt the bilateral filter as a trainable layer in a neural network and show that adding this layer makes ImageNet images significantly more robust to attacks. When trained under a framework of adversarial training, we show that the resulting model is hard to fool with even the best attack methods.

arXiv comment9 pages, 14 figures

References in corpus (14)

• Ensemble Adversarial Training: Attacks and Defenses
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Robust Physical-World Attacks on Deep Learning Models
• The Space of Transferable Adversarial Examples
• Technical Report on the CleverHans v2.1.0 Adversarial Examples Library
• Understanding Adversarial Training: Increasing Local Stability of Neural Nets through Robust Optimization
• A study of the effect of JPG compression on adversarial images
• Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression
• MagNet: a Two-Pronged Defense against Adversarial Examples
• Foveation-based Mechanisms Alleviate Adversarial Examples
• APE-GAN: Adversarial Perturbation Elimination with GAN
• On the Effectiveness of Defensive Distillation