QuSecNets: Quantization-based Defense Mechanism for Securing Deep Neural Network against Adversarial Attacks

Abstract

Adversarial examples have emerged as a significant threat to machine learning algorithms, especially to the convolutional neural networks (CNNs). In this paper, we propose two quantization-based defense mechanisms, Constant Quantization (CQ) and Trainable Quantization (TQ), to increase the robustness of CNNs against adversarial examples. CQ quantizes input pixel intensities based on a "fixed" number of quantization levels, while in TQ, the quantization levels are "iteratively learned during the training phase", thereby providing a stronger defense mechanism. We apply the proposed techniques on undefended CNNs against different state-of-the-art adversarial attacks from the open-source \textit{Cleverhans} library. The experimental results demonstrate 50%-96% and 10%-50% increase in the classification accuracy of the perturbed images generated from the MNIST and the CIFAR-10 datasets, respectively, on commonly used CNN (Conv2D(64, 8x8) - Conv2D(128, 6x6) - Conv2D(128, 5x5) - Dense(10) - Softmax()) available in \textit{Cleverhans} library.

References in corpus (6)

• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Stealing Machine Learning Models via Prediction APIs
• Defensive Distillation is Not Robust to Adversarial Examples
• A Roadmap Towards Resilient Internet of Things for Cyber-Physical Systems
• Security for Machine Learning-based Systems: Attacks and Challenges during Training and Inference
• TrISec: Training Data-Unaware Imperceptible Security Attacks on Deep Neural Networks

Cited by in corpus (7)

• Hardware and Software Optimizations for Accelerating Deep Neural Networks: Survey of Current Trends, Challenges, and the Road Ahead
• Secure and Trustworthy Artificial Intelligence-Extended Reality (AI-XR) for Metaverses
• Towards Energy-Efficient and Secure Edge AI: A Cross-Layer Framework
• Finding Deviated Behaviors of the Compressed DNN Models for Image Classifications
• RoVISQ: Reduction of Video Service Quality via Adversarial Attacks on Deep Learning-based Video Compression
• Consistent Valid Physically-Realizable Adversarial Attack against Crowd-flow Prediction Models
• Special Session: Towards an Agile Design Methodology for Efficient, Reliable, and Secure ML Systems