Defending against Whitebox Adversarial Attacks via Randomized Discretization

Abstract

Adversarial perturbations dramatically decrease the accuracy of state-of-the-art image classifiers. In this paper, we propose and analyze a simple and computationally efficient defense strategy: inject random Gaussian noise, discretize each pixel, and then feed the result into any pre-trained classifier. Theoretically, we show that our randomized discretization strategy reduces the KL divergence between original and adversarial inputs, leading to a lower bound on the classification accuracy of any classifier against any (potentially whitebox) ${\ell }_{\infty }$-bounded adversarial attack. Empirically, we evaluate our defense on adversarial examples generated by a strong iterative PGD attack. On ImageNet, our defense is more robust than adversarially-trained networks and the winning defenses of the NIPS 2017 Adversarial Attacks & Defenses competition.

In proceedings of the 22nd International Conference on Artificial Intelligence and Statistics

Cited by in corpus (9)

• Are Perceptually-Aligned Gradients a General Property of Robust Classifiers?
• Dirty Road Can Attack: Security of Deep Learning based Automated Lane Centering under Physical-World Attack
• Are Adversarial Examples Created Equal? A Learnable Weighted Minimax Risk for Robustness under Non-uniform Attacks
• Learning Diverse-Structured Networks for Adversarial Robustness
• On Procedural Adversarial Noise Attack And Defense
• Smoothed Inference for Adversarially-Trained Models
• MixDefense: A Defense-in-Depth Framework for Adversarial Example Detection Based on Statistical and Semantic Analysis
• Colored Noise Injection for Training Adversarially Robust Neural Networks
• Analysis of Random Perturbations for Robust Convolutional Neural Networks