Defending Against Adversarial Examples with K-Nearest Neighbor

Abstract

Robustness is an increasingly important property of machine learning models as they become more and more prevalent. We propose a defense against adversarial examples based on a k-nearest neighbor (kNN) on the intermediate activation of neural networks. Our scheme surpasses state-of-the-art defenses on MNIST and CIFAR-10 against l2-perturbation by a significant margin. With our models, the mean perturbation norm required to fool our MNIST model is 3.07 and 2.30 on CIFAR-10. Additionally, we propose a simple certifiable lower bound on the l2-norm of the adversarial perturbation using a more specific version of our scheme, a 1-NN on representations learned by a Lipschitz network. Our model provides a nontrivial average lower bound of the perturbation norm, comparable to other schemes on MNIST with similar clean accuracy.

arXiv commentInadequate experimental evaluation

References in corpus (18)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• A Survey on Deep Learning in Medical Image Analysis
• Auto-Encoding Variational Bayes
• Playing Atari with Deep Reinforcement Learning
• mixup: Beyond Empirical Risk Minimization
• End to End Learning for Self-Driving Cars
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Mastering Chess and Shogi by Self-Play with a General Reinforcement Learning Algorithm
• Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
• Towards the first adversarially robust neural network model on MNIST
• Lipschitz-Margin Training: Scalable Certification of Perturbation Invariance for Deep Neural Networks
• DeepFool: a simple and accurate method to fool deep neural networks
• Analyzing the Robustness of Nearest Neighbors to Adversarial Examples
• Sorting out Lipschitz function approximation
• L2-Nonexpansive Neural Networks
• Adversarial Training with Voronoi Constraints
• Limitations of the Lipschitz constant as a defense against adversarial examples

Cited by in corpus (5)

• Anomalous Example Detection in Deep Learning: A Survey
• AdvKnn: Adversarial Attacks On K-Nearest Neighbor Classifiers With Approximate Gradients
• Self-supervised Adversarial Training
• Online Anomaly Detection in Surveillance Videos with Asymptotic Bounds on False Alarm Rate
• Adversarial Examples for $k$-Nearest Neighbor Classifiers Based on Higher-Order Voronoi Diagrams