Defense Against Adversarial Attacks with Saak Transform

Abstract

Deep neural networks (DNNs) are known to be vulnerable to adversarial perturbations, which imposes a serious threat to DNN-based decision systems. In this paper, we propose to apply the lossy Saak transform to adversarially perturbed images as a preprocessing tool to defend against adversarial attacks. Saak transform is a recently-proposed state-of-the-art for computing the spatial-spectral representations of input images. Empirically, we observe that outputs of the Saak transform are very discriminative in differentiating adversarial examples from clean ones. Therefore, we propose a Saak transform based preprocessing method with three steps: 1) transforming an input image to a joint spatial-spectral representation via the forward Saak transform, 2) apply filtering to its high-frequency components, and, 3) reconstructing the image via the inverse Saak transform. The processed image is found to be robust against adversarial perturbations. We conduct extensive experiments to investigate various settings of the Saak transform and filtering functions. Without harming the decision performance on clean images, our method outperforms state-of-the-art adversarial defense methods by a substantial margin on both the CIFAR-10 and ImageNet datasets. Importantly, our results suggest that adversarial perturbations can be effectively and efficiently defended using state-of-the-art frequency analysis.

References in corpus (3)

• Delving into Transferable Adversarial Examples and Black-box Attacks
• Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradients
• Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression

Cited by in corpus (5)

• Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review
• Defending Against Universal Attacks Through Selective Feature Regeneration
• On the Limitations of Denoising Strategies as Adversarial Defenses
• Diminishing the Effect of Adversarial Perturbations via Refining Feature Representation
• On the Structural Sensitivity of Deep Convolutional Networks to the Directions of Fourier Basis Functions