A New Defense Against Adversarial Images: Turning a Weakness into a Strength

Abstract

Natural images are virtually surrounded by low-density misclassified regions that can be efficiently discovered by gradient-guided search --- enabling the generation of adversarial images. While many techniques for detecting these attacks have been proposed, they are easily bypassed when the adversary has full knowledge of the detection mechanism and adapts the attack strategy accordingly. In this paper, we adopt a novel perspective and regard the omnipresence of adversarial perturbations as a strength rather than a weakness. We postulate that if an image has been tampered with, these adversarial directions either become harder to find with gradient methods or have substantially higher density than for natural images. We develop a practical test for this signature characteristic to successfully detect adversarial attacks, achieving unprecedented accuracy under the white-box setting where the adversary is given full knowledge of our detection mechanism.

arXiv commentNeurIPS 2019, 14 pages

Cited by in corpus (30)

• On Adaptive Attacks to Adversarial Example Defenses
• Label-Only Membership Inference Attacks
• Security and Privacy Issues in Deep Learning
• Vulnerability of deep neural networks for detecting COVID-19 cases from chest X-ray images to universal adversarial attacks
• Understanding the Decision Boundary of Deep Neural Networks: An Empirical Study
• On Real-time Image Reconstruction with Neural Networks for MRI-guided Radiotherapy
• RAID: Randomized Adversarial-Input Detection for Neural Networks
• Interpretability is a Kind of Safety: An Interpreter-based Ensemble for Adversary Defense
• A Thorough Comparison Study on Adversarial Attacks and Defenses for Common Thorax Disease Classification in Chest X-rays
• Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Them
• Effective and Robust Detection of Adversarial Examples via Benford-Fourier Coefficients
• Denoised Internal Models: a Brain-Inspired Autoencoder against Adversarial Attacks
• Using Undervolting as an On-Device Defense Against Adversarial Machine Learning Attacks
• Probing the Purview of Neural Networks via Gradient Analysis
• HoneyModels: Machine Learning Honeypots
• Indicators of Attack Failure: Debugging and Improving Optimization of Adversarial Examples
• Fooling LiDAR Perception via Adversarial Trajectory Perturbation
• Adversarial Training Makes Weight Loss Landscape Sharper in Logistic Regression
• Pelta: Shielding Transformers to Mitigate Evasion Attacks in Federated Learning
• Automated Discovery of Adaptive Attacks on Adversarial Defenses
• Picket: Guarding Against Corrupted Data in Tabular Data during Learning and Inference
• Detecting Adversarial Patches with Class Conditional Reconstruction Networks
• D-square-B: Deep Distribution Bound for Natural-looking Adversarial Attack
• HASI: Hardware-Accelerated Stochastic Inference, A Defense Against Adversarial Machine Learning Attacks
• The art of defense: letting networks fool the attacker
• Beating Attackers At Their Own Games: Adversarial Example Detection Using Adversarial Gradient Directions
• BAARD: Blocking Adversarial Examples by Testing for Applicability, Reliability and Decidability
• Are L2 adversarial examples intrinsically different?
• Target Training Does Adversarial Training Without Adversarial Samples
• Tricking Adversarial Attacks To Fail