Diminishing the Effect of Adversarial Perturbations via Refining Feature Representation

Abstract

Deep neural networks are highly vulnerable to adversarial examples, which imposes severe security issues for these state-of-the-art models. Many defense methods have been proposed to mitigate this problem. However, a lot of them depend on modification or additional training of the target model. In this work, we analytically investigate each layer's representation of non-perturbed and perturbed images and show the effect of perturbations on each of these representations. Accordingly, a method based on whitening coloring transform is proposed in order to diminish the misrepresentation of any desirable layer caused by adversaries. Our method can be applied to any layer of any arbitrary model without the need of any modification or additional training. Due to the fact that the full whitening of the layer's representation is not easily differentiable, our proposed method is superbly robust against white-box attacks. Furthermore, we demonstrate the strength of our method against some state-of-the-art black-box attacks.

arXiv commentAccepted at NeuralIPS 2019 workshop on Safety and Robustness in Decision Making

References in corpus (15)

• Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Delving into Transferable Adversarial Examples and Black-box Attacks
• On Evaluating Adversarial Robustness
• EMNIST: an extension of MNIST to handwritten letters
• Countering Adversarial Images using Input Transformations
• Detecting Adversarial Samples from Artifacts
• Black-box Adversarial Attacks with Limited Queries and Information
• DARTS: Deceiving Autonomous Cars with Toxic Signs
• Benchmarking Neural Network Robustness to Common Corruptions and Surface Variations
• Defense Against Adversarial Attacks with Saak Transform
• Enhancing the Robustness of Deep Neural Networks by Boundary Conditional GAN
• Robustifying Models Against Adversarial Attacks by Langevin Dynamics
• Blind Pre-Processing: A Robust Defense Method Against Adversarial Examples