Interpreting and Improving Adversarial Robustness of Deep Neural Networks with Neuron Sensitivity

Abstract

Deep neural networks (DNNs) are vulnerable to adversarial examples where inputs with imperceptible perturbations mislead DNNs to incorrect results. Despite the potential risk they bring, adversarial examples are also valuable for providing insights into the weakness and blind-spots of DNNs. Thus, the interpretability of a DNN in the adversarial setting aims to explain the rationale behind its decision-making process and makes deeper understanding which results in better practical applications. To address this issue, we try to explain adversarial robustness for deep models from a new perspective of neuron sensitivity which is measured by neuron behavior variation intensity against benign and adversarial examples. In this paper, we first draw the close connection between adversarial robustness and neuron sensitivities, as sensitive neurons make the most non-trivial contributions to model predictions in the adversarial setting. Based on that, we further propose to improve adversarial robustness by constraining the similarities of sensitive neurons between benign and adversarial examples which stabilizes the behaviors of sensitive neurons towards adversarial noises. Moreover, we demonstrate that state-of-the-art adversarial training methods improve model robustness by reducing neuron sensitivities which in turn confirms the strong connections between adversarial robustness and neuron sensitivity as well as the effectiveness of using sensitive neurons to build robust models. Extensive experiments on various datasets demonstrate that our algorithm effectively achieves excellent results.

arXiv commentAccepted by IEEE Transaction on Image Processing

References in corpus (26)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networks
• Sequence to Sequence Learning with Neural Networks
• Beyond a Gaussian Denoiser: Residual Learning of Deep CNN for Image Denoising
• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• Methods for Interpreting and Understanding Deep Neural Networks
• FFDNet: Toward a Fast and Flexible Solution for CNN based Image Denoising
• Ensemble Adversarial Training: Attacks and Defenses
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Object Detectors Emerge in Deep Scene CNNs
• Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Understanding Adversarial Training: Increasing Local Stability of Neural Nets through Robust Optimization
• Robustness May Be at Odds with Accuracy
• A study of the effect of JPG compression on adversarial images
• On Detecting Adversarial Perturbations
• Simple Black-box Adversarial Attacks
• Dual Deep Network for Visual Tracking
• Are All Layers Created Equal?
• Towards Interpretable Deep Neural Networks by Leveraging Adversarial Examples
• DeepCloak: Masking Deep Neural Network Models for Robustness Against Adversarial Samples
• Towards Interpretable Deep Neural Networks by Leveraging Adversarial Examples
• Interpreting Adversarial Examples by Activation Promotion and Suppression
• Training Robust Deep Neural Networks via Adversarial Noise Propagation
• DeepFense: Online Accelerated Defense Against Adversarial Deep Learning

Cited by in corpus (12)

• Understanding Adversarial Attacks on Deep Learning Based Medical Image Analysis Systems
• How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defenses
• Towards a Robust Deep Neural Network in Texts: A Survey
• Training Robust Deep Neural Networks via Adversarial Noise Propagation
• Bias-based Universal Adversarial Patch Attack for Automatic Check-out
• Exploring Inconsistent Knowledge Distillation for Object Detection with Data Augmentation
• Patch-wise++ Perturbation for Adversarial Targeted Attacks
• A Comprehensive Evaluation Framework for Deep Model Robustness
• Graph-Based Similarity of Neural Network Representations
• One Neuron to Fool Them All
• Challenging the adversarial robustness of DNNs based on error-correcting output codes
• Towards A Conceptually Simple Defensive Approach for Few-shot classifiers Against Adversarial Support Samples