ML-LOO: Detecting Adversarial Examples with Feature Attribution

Abstract

Deep neural networks obtain state-of-the-art performance on a series of tasks. However, they are easily fooled by adding a small adversarial perturbation to input. The perturbation is often human imperceptible on image data. We observe a significant difference in feature attributions of adversarially crafted examples from those of original ones. Based on this observation, we introduce a new framework to detect adversarial examples through thresholding a scale estimate of feature attribution scores. Furthermore, we extend our method to include multi-layer feature attributions in order to tackle the attacks with mixed confidence levels. Through vast experiments, our method achieves superior performances in distinguishing adversarial examples from popular attack methods on a variety of real data sets among state-of-the-art detection methods. In particular, our method is able to detect adversarial examples of mixed confidence levels, and transfer between different attacking methods.

References in corpus (19)

• Axiomatic Attribution for Deep Networks
• Learning Important Features Through Propagating Activation Differences
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks
• Delving into Transferable Adversarial Examples and Black-box Attacks
• How to Explain Individual Classification Decisions
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Understanding Neural Networks through Representation Erasure
• Detecting Adversarial Samples from Artifacts
• On the (Statistical) Detection of Adversarial Examples
• Robustness May Be at Odds with Accuracy
• On Detecting Adversarial Perturbations
• A Boundary Tilting Persepective on the Phenomenon of Adversarial Examples
• Guessing Smart: Biased Sampling for Efficient Black-Box Adversarial Attacks
• Training verified learners with learned verifiers
• Interpretation of Neural Networks is Fragile
• On the Limitation of Local Intrinsic Dimensionality for Characterizing the Subspaces of Adversarial Examples

Cited by in corpus (6)

• Generalized Out-of-Distribution Detection: A Survey
• Detection of Face Recognition Adversarial Attacks
• Interpreting Adversarial Examples by Activation Promotion and Suppression
• Adversarial Attacks and Defenses: An Interpretation Perspective
• A Unified Game-Theoretic Interpretation of Adversarial Robustness
• BOSH: An Efficient Meta Algorithm for Decision-based Attacks