Adversarial Examples in Deep Learning: Characterization and Divergence

Abstract

The burgeoning success of deep learning has raised the security and privacy concerns as more and more tasks are accompanied with sensitive data. Adversarial attacks in deep learning have emerged as one of the dominating security threat to a range of mission-critical deep learning systems and applications. This paper takes a holistic and principled approach to perform statistical characterization of adversarial examples in deep learning. We provide a general formulation of adversarial examples and elaborate on the basic principle for adversarial attack algorithm design. We introduce easy and hard categorization of adversarial attacks to analyze the effectiveness of adversarial examples in terms of attack success rate, degree of change in adversarial perturbation, average entropy of prediction qualities, and fraction of adversarial examples that lead to successful attacks. We conduct extensive experimental study on adversarial behavior in easy and hard attacks under deep learning models with different hyperparameters and different deep learning frameworks. We show that the same adversarial attack behaves differently under different hyperparameters and across different frameworks due to the different features learned under different deep learning model training process. Our statistical characterization with strong empirical evidence provides a transformative enlightenment on mitigation strategies towards effective countermeasures against present and future adversarial attacks.

References in corpus (10)

• Explaining and Harnessing Adversarial Examples
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• Robust Physical-World Attacks on Deep Learning Models
• Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
• The Space of Transferable Adversarial Examples
• On the Limitation of Local Intrinsic Dimensionality for Characterizing the Subspaces of Adversarial Examples
• Retrieval-Augmented Convolutional Neural Networks for Improved Robustness against Adversarial Examples
• Blind Pre-Processing: A Robust Defense Method Against Adversarial Examples

Cited by in corpus (6)

• Adversarial Machine Learning in Image Classification: A Survey Towards the Defender's Perspective
• TOG: Targeted Adversarial Objectness Gradient Attacks on Real-time Object Detection Systems
• Deep Neural Network Ensembles against Deception: Ensemble Diversity, Accuracy and Robustness
• Cross-Layer Strategic Ensemble Defense Against Adversarial Examples
• Robust Deep Learning Ensemble against Deception
• Denoising and Verification Cross-Layer Ensemble Against Black-box Adversarial Attacks