Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models

Abstract

In recent years, deep neural network approaches have been widely adopted for machine learning tasks, including classification. However, they were shown to be vulnerable to adversarial perturbations: carefully crafted small perturbations can cause misclassification of legitimate images. We propose Defense-GAN, a new framework leveraging the expressive capability of generative models to defend deep neural networks against such attacks. Defense-GAN is trained to model the distribution of unperturbed images. At inference time, it finds a close output to a given image which does not contain the adversarial changes. This output is then fed to the classifier. Our proposed method can be used with any classification model and does not modify the classifier structure or training procedure. It can also be used as a defense against any attack as it does not assume knowledge of the process for generating the adversarial examples. We empirically show that Defense-GAN is consistently effective against different attack methods and improves on existing defense strategies. Our code has been made publicly available at https://github.com/kabkabm/defensegan

Published as a conference paper at the Sixth International Conference on Learning Representations (ICLR 2018)

References in corpus (5)

• Distilling the Knowledge in a Neural Network
• Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
• Ensemble Adversarial Training: Attacks and Defenses
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Early Methods for Detecting Adversarial Images

Cited by in corpus (110)

• Theoretically Principled Trade-off between Robustness and Accuracy
• Adversarial Attack and Defense on Graph Data: A Survey
• A Review on Generative Adversarial Networks: Algorithms, Theory, and Applications
• A General Framework for Adversarial Examples with Objectives
• Are Labels Required for Improving Adversarial Robustness?
• Adversarial Machine Learning in Image Classification: A Survey Towards the Defender's Perspective
• A Review of Adversarial Attack and Defense for Classification Methods
• Action Robust Reinforcement Learning and Applications in Continuous Control
• Improving the Transferability of Adversarial Examples with Resized-Diverse-Inputs, Diversity-Ensemble and Region Fitting
• The Limitations of Adversarial Training and the Blind-Spot Attack
• A Latent Encoder Coupled Generative Adversarial Network (LE-GAN) for Efficient Hyperspectral Image Super-resolution
• Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbations
• Convergence of Adversarial Training in Overparametrized Neural Networks
• Detecting Adversarial Examples by Input Transformations, Defense Perturbations, and Voting
• Adversarially Robust Few-Shot Learning: A Meta-Learning Approach
• Defense Methods Against Adversarial Examples for Recurrent Neural Networks
• Do Wider Neural Networks Really Help Adversarial Robustness?
• Label Smoothing and Logit Squeezing: A Replacement for Adversarial Training?
• Defend Deep Neural Networks Against Adversarial Examples via Fixed and Dynamic Quantized Activation Functions
• LDP-FL: Practical Private Aggregation in Federated Learning with Local Differential Privacy
• Adversarial Attacks and Defenses in Physiological Computing: A Systematic Review
• Learning to Defend by Learning to Attack
• ECG-Adv-GAN: Detecting ECG Adversarial Examples with Conditional Generative Adversarial Networks
• Generative Adversarial Networks: A Survey Towards Private and Secure Applications
• A Survey of Black-Box Adversarial Attacks on Computer Vision Models
• Adversarial Defense Framework for Graph Neural Network
• Generating 3D Adversarial Point Clouds
• What You See is Not What the Network Infers: Detecting Adversarial Examples Based on Semantic Contradiction
• Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examples
• Towards Understanding Adversarial Examples Systematically: Exploring Data Size, Task and Model Factors
• Enhancing the Robustness of Deep Neural Networks by Boundary Conditional GAN
• Medical Image Harmonization Using Deep Learning Based Canonical Mapping: Toward Robust and Generalizable Learning in Imaging
• Breaking Transferability of Adversarial Samples with Randomness
• Two Souls in an Adversarial Image: Towards Universal Adversarial Example Detection using Multi-view Inconsistency
• PatchCensor: Patch Robustness Certification for Transformers via Exhaustive Testing
• Orchestrating the Development Lifecycle of Machine Learning-Based IoT Applications: A Taxonomy and Survey
• Multitask Learning Strengthens Adversarial Robustness
• Convergence and Margin of Adversarial Training on Separable Data
• FakeTagger: Robust Safeguards against DeepFake Dissemination via Provenance Tracking
• On Certifying Non-uniform Bound against Adversarial Attacks
• Fine-grained Synthesis of Unrestricted Adversarial Examples
• Effective and Robust Detection of Adversarial Examples via Benford-Fourier Coefficients
• Adversarial Visual Robustness by Causal Intervention
• Denoised Internal Models: a Brain-Inspired Autoencoder against Adversarial Attacks
• Boosting Adversarial Attacks on Neural Networks with Better Optimizer
• APRICOT: A Dataset of Physical Adversarial Attacks on Object Detection
• Better the Devil you Know: An Analysis of Evasion Attacks using Out-of-Distribution Adversarial Examples
• Differentially Private Deep Learning with Smooth Sensitivity
• Imbalanced Gradients: A Subtle Cause of Overestimated Adversarial Robustness
• Developing Future Human-Centered Smart Cities: Critical Analysis of Smart City Security, Interpretability, and Ethical Challenges
• CAGFuzz: Coverage-Guided Adversarial Generative Fuzzing Testing of Deep Learning Systems
• Using Single-Step Adversarial Training to Defend Iterative Adversarial Examples
• Improving Global Adversarial Robustness Generalization With Adversarially Trained GAN
• Improving the Tightness of Convex Relaxation Bounds for Training Certifiably Robust Classifiers
• Attacking and Defending Machine Learning Applications of Public Cloud
• Effects of Loss Functions And Target Representations on Adversarial Robustness
• CAP-GAN: Towards Adversarial Robustness with Cycle-consistent Attentional Purification
• Feature Prioritization and Regularization Improve Standard Accuracy and Adversarial Robustness
• On the Need for Topology-Aware Generative Models for Manifold-Based Defenses
• DAPAS : Denoising Autoencoder to Prevent Adversarial attack in Semantic Segmentation
• Optimal Transport Classifier: Defending Against Adversarial Attacks by Regularized Deep Embedding
• Rearchitecting Classification Frameworks For Increased Robustness
• Towards Robust Neural Networks via Close-loop Control
• GanDef: A GAN based Adversarial Training Defense for Neural Network Classifier
• Random Directional Attack for Fooling Deep Neural Networks
• Trust but Verify: An Information-Theoretic Explanation for the Adversarial Fragility of Machine Learning Systems, and a General Defense against Adversarial Attacks
• RAIN: A Simple Approach for Robust and Accurate Image Classification Networks
• Perturbations are not Enough: Generating Adversarial Examples with Spatial Distortions
• Purifying Adversarial Perturbation with Adversarially Trained Auto-encoders
• Auditing AI models for Verified Deployment under Semantic Specifications
• Improved Adversarial Training via Learned Optimizer
• A unified view on differential privacy and robustness to adversarial examples
• Latent Adversarial Defence with Boundary-guided Generation
• Understanding and Achieving Efficient Robustness with Adversarial Supervised Contrastive Learning
• Defective Convolutional Networks
• Applying Tensor Decomposition to image for Robustness against Adversarial Attack
• Collaborative Sampling in Generative Adversarial Networks
• AdvFoolGen: Creating Persistent Troubles for Deep Classifiers
• DAFAR: Defending against Adversaries by Feedback-Autoencoder Reconstruction
• ZK-GanDef: A GAN based Zero Knowledge Adversarial Training Defense for Neural Networks
• White-Box Adversarial Defense via Self-Supervised Data Estimation
• Random Network Distillation as a Diversity Metric for Both Image and Text Generation
• The art of defense: letting networks fool the attacker
• Improving White-box Robustness of Pre-processing Defenses via Joint Adversarial Training
• A Survey on Assessing the Generalization Envelope of Deep Neural Networks: Predictive Uncertainty, Out-of-distribution and Adversarial Samples
• Defending Adversarial Attacks via Semantic Feature Manipulation
• Who is Responsible for Adversarial Defense?
• Meta Gradient Adversarial Attack
• Recovery Guarantees for Compressible Signals with Adversarial Noise
• Robust Single-step Adversarial Training with Regularizer
• Private Deep Learning with Teacher Ensembles
• A Distributionally Robust Optimization Method for Adversarial Multiple Kernel Learning
• Non-Determinism in Neural Networks for Adversarial Robustness
• A Useful Taxonomy for Adversarial Robustness of Neural Networks
• Affine Disentangled GAN for Interpretable and Robust AV Perception
• Adversarial Attacks with Time-Scale Representations
• Thwarting finite difference adversarial attacks with output randomization
• Game Theory for Adversarial Attacks and Defenses
• Towards Optimal Randomized Strategies in Adversarial Example Game
• Image Decomposition and Classification through a Generative Model
• Nested Learning For Multi-Granular Tasks
• Reject Illegal Inputs with Generative Classifier Derived from Any Discriminative Classifier
• Likelihood Landscapes: A Unifying Principle Behind Many Adversarial Defenses
• HAD-GAN: A Human-perception Auxiliary Defense GAN to Defend Adversarial Examples
• Generalizing Neural Networks by Reflecting Deviating Data in Production
• Using an ensemble color space model to tackle adversarial examples
• Not Just Cloud Privacy: Protecting Client Privacy in Teacher-Student Learning
• Do Deep Minds Think Alike? Selective Adversarial Attacks for Fine-Grained Manipulation of Multiple Deep Neural Networks
• Stochastic-HMDs: Adversarial Resilient Hardware Malware Detectors through Voltage Over-scaling
• Guess First to Enable Better Compression and Adversarial Robustness