On The Utility of Conditional Generation Based Mutual Information for Characterizing Adversarial Subspaces

Abstract

Recent studies have found that deep learning systems are vulnerable to adversarial examples; e.g., visually unrecognizable adversarial images can easily be crafted to result in misclassification. The robustness of neural networks has been studied extensively in the context of adversary detection, which compares a metric that exhibits strong discriminate power between natural and adversarial examples. In this paper, we propose to characterize the adversarial subspaces through the lens of mutual information (MI) approximated by conditional generation methods. We use MI as an information-theoretic metric to strengthen existing defenses and improve the performance of adversary detection. Experimental results on MagNet defense demonstrate that our proposed MI detector can strengthen its robustness against powerful adversarial attacks.

arXiv commentAccepted to IEEE GlobalSIP 2018

References in corpus (11)

• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
• MagNet: a Two-Pronged Defense against Adversarial Examples
• Adversarial Examples, Uncertainty, and Transfer Testing Robustness in Gaussian Process Hybrid Deep Networks
• Attacking the Madry Defense Model with $L_1$-based Adversarial Examples
• EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examples
• On the Limitation of Local Intrinsic Dimensionality for Characterizing the Subspaces of Adversarial Examples
• AlphaGAN: Generative adversarial networks for natural image matting
• On the Limitation of MagNet Defense against $L_1$-based Adversarial Examples
• Is Robustness the Cost of Accuracy? -- A Comprehensive Study on the Robustness of 18 Deep Image Classification Models