Identifying Classes Susceptible to Adversarial Attacks

Abstract

Despite numerous attempts to defend deep learning based image classifiers, they remain susceptible to the adversarial attacks. This paper proposes a technique to identify susceptible classes, those classes that are more easily subverted. To identify the susceptible classes we use distance-based measures and apply them on a trained model. Based on the distance among original classes, we create mapping among original classes and adversarial classes that helps to reduce the randomness of a model to a significant amount in an adversarial setting. We analyze the high dimensional geometry among the feature classes and identify the k most susceptible target classes in an adversarial attack. We conduct experiments using MNIST, Fashion MNIST, CIFAR-10 (ImageNet and ResNet-32) datasets. Finally, we evaluate our techniques in order to determine which distance-based measure works best and how the randomness of a model changes with perturbation.

References in corpus (9)

• Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
• Adversarial Attacks on Neural Networks for Graph Data
• Synthesizing Robust Adversarial Examples
• Technical Report on the CleverHans v2.1.0 Adversarial Examples Library
• Adversarial Examples that Fool both Computer Vision and Time-Limited Humans
• Deep Defense: Training DNNs with Improved Adversarial Robustness
• Unravelling Robustness of Deep Learning based Face Recognition Against Adversarial Attacks
• Adversarial Attacks on Stochastic Bandits
• Robustness of classifiers to uniform $\ell \_p$ and Gaussian noise

Cited by in corpus (2)

• Repairing Deep Neural Networks: Fix Patterns and Challenges
• Representation Quality Of Neural Networks Links To Adversarial Attacks and Defences