Exploring the Back Alleys: Analysing The Robustness of Alternative Neural Network Architectures against Adversarial Attacks
arXiv:1912.03609
Abstract
We investigate to what extent alternative variants of Artificial Neural Networks (ANNs) are susceptible to adversarial attacks. We analyse the adversarial robustness of conventional, stochastic ANNs and Spiking Neural Networks (SNNs) in the raw image space, across three different datasets. Our experiments reveal that stochastic ANN variants are almost equally as susceptible as conventional ANNs when faced with simple iterative gradient-based attacks in the white-box setting. However we observe, that in black-box settings, stochastic ANNs are more robust than conventional ANNs, when faced with boundary attacks, transferability and surrogate attacks. Consequently, we propose improved attacks and defence mechanisms for stochastic ANNs in black-box settings. When performing surrogate-based black-box attacks, one can employ stochastic models as surrogates to observe higher attack success on both stochastic and deterministic targets. This success can be further improved with our proposed Variance Mimicking (VM) surrogate training method, against stochastic targets. Finally, adopting a defender's perspective, we investigate the plausibility of employing stochastic switching of model mixtures as a viable hardening mechanism. We observe that such a scheme does provide a partial hardening.
References in corpus (15)
- Adam: A Method for Stochastic Optimization
- Estimating or Propagating Gradients Through Stochastic Neurons for Conditional Computation
- Towards Deep Learning Models Resistant to Adversarial Attacks
- Binarized Neural Networks
- Delving into Transferable Adversarial Examples and Black-box Attacks
- STDP-based spiking deep convolutional neural networks for object recognition
- Hierarchical Multiscale Recurrent Neural Networks
- Bio-inspired digit recognition using reward-modulated spike-timing-dependent plasticity in deep convolutional networks
- Improving Black-box Adversarial Attacks with a Transfer-based Prior
- SpykeTorch: Efficient Simulation of Convolutional Spiking Neural Networks with at most one Spike per Neuron
- Techniques for Learning Binary Stochastic Feedforward Neural Networks
- ARM: Augment-REINFORCE-Merge Gradient for Stochastic Binary Networks
- How far can we go without convolution: Improving fully-connected networks
- Combinatorial Attacks on Binarized Neural Networks
- A novel method for extracting interpretable knowledge from a spiking neural classifier with time-varying synaptic weights