BUZz: BUffer Zones for defending adversarial examples in image classification

Abstract

We propose a novel defense against all existing gradient based adversarial attacks on deep neural networks for image classification problems. Our defense is based on a combination of deep neural networks and simple image transformations. While straightforward in implementation, this defense yields a unique security property which we term buffer zones. We argue that our defense based on buffer zones offers significant improvements over state-of-the-art defenses. We are able to achieve this improvement even when the adversary has access to the {\em entire} original training data set and unlimited query access to the defense. We verify our claim through experimentation using Fashion-MNIST and CIFAR-10: We demonstrate $<11\%$ attack success rate -- significantly lower than what other well-known state-of-the-art defenses offer -- at only a price of a $11-18\%$ drop in clean accuracy. By using a new intuitive metric, we explain why this trade-off offers a significant improvement over prior work.

References in corpus (16)

• Adam: A Method for Stochastic Optimization
• Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networks
• Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
• Ensemble Adversarial Training: Attacks and Defenses
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Certified Adversarial Robustness via Randomized Smoothing
• Countering Adversarial Images using Input Transformations
• Detecting Adversarial Samples from Artifacts
• Adversarial Examples: Attacks and Defenses for Deep Learning
• On Detecting Adversarial Perturbations
• MagNet and "Efficient Defenses Against Adversarial Attacks" are Not Robust to Adversarial Examples
• On Adaptive Attacks to Adversarial Example Defenses
• Visual Concepts and Compositional Voting
• MULDEF: Multi-model-based Defense Against Adversarial Examples for Neural Networks

Cited by in corpus (1)

• Beware the Black-Box: on the Robustness of Recent Defenses to Adversarial Examples