Defending Against Universal Attacks Through Selective Feature Regeneration

Abstract

Deep neural network (DNN) predictions have been shown to be vulnerable to carefully crafted adversarial perturbations. Specifically, image-agnostic (universal adversarial) perturbations added to any image can fool a target network into making erroneous predictions. Departing from existing defense strategies that work mostly in the image domain, we present a novel defense which operates in the DNN feature domain and effectively defends against such universal perturbations. Our approach identifies pre-trained convolutional features that are most vulnerable to adversarial noise and deploys trainable feature regeneration units which transform these DNN filter activations into resilient features that are robust to universal perturbations. Regenerating only the top 50% adversarially susceptible activations in at most 6 DNN layers and leaving all remaining DNN activations unchanged, we outperform existing defense strategies across different network architectures by more than 10% in restored accuracy. We show that without any additional modification, our defense trained on ImageNet with one type of universal attack examples effectively defends against other types of unseen universal attacks.

arXiv commentCVPR 2020. Code: https://github.com/tsborkar/Selective-feature-regeneration Webpage: https://www.cs.princeton.edu/~fheide/SelectiveFeatureRegeneration/

References in corpus (27)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networks
• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• Caffe: Convolutional Architecture for Fast Feature Embedding
• Ensemble Adversarial Training: Attacks and Defenses
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Synthesizing Robust Adversarial Examples
• Robust Physical-World Attacks on Deep Learning Models
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Black-box Adversarial Attacks with Limited Queries and Information
• A study of the effect of JPG compression on adversarial images
• On Detecting Adversarial Perturbations
• Simple Black-Box Adversarial Perturbations for Deep Networks
• Fast Feature Fool: A data independent approach to universal adversarial perturbations
• Universal adversarial perturbations
• Feature Denoising for Improving Adversarial Robustness
• Evaluating and Understanding the Robustness of Adversarial Logit Pairing
• Adversarial camera stickers: A physical camera-based attack on deep learning systems
• Classification regions of deep neural networks
• Fortified Networks: Improving the Robustness of Deep Networks by Modeling the Manifold of Hidden Representations
• Divide, Denoise, and Defend against Adversarial Attacks
• Defense Against Adversarial Attacks with Saak Transform
• Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses
• Playing the Game of Universal Adversarial Perturbations
• DeepCorrect: Correcting DNN models against Image Distortions

Cited by in corpus (7)

• Adversarial Example Detection for DNN Models: A Review and Experimental Comparison
• A Survey On Universal Adversarial Attack
• Defending Person Detection Against Adversarial Patch Attack by using Universal Defensive Frame
• Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses
• On the Limitations of Denoising Strategies as Adversarial Defenses
• Frequency-Tuned Universal Adversarial Attacks
• Real-time Detection of Practical Universal Adversarial Perturbations