$n$-ML: Mitigating Adversarial Examples via Ensembles of Topologically Manipulated Classifiers

Abstract

This paper proposes a new defense called $n$-ML against adversarial examples, i.e., inputs crafted by perturbing benign inputs by small amounts to induce misclassifications by classifiers. Inspired by $n$-version programming, $n$-ML trains an ensemble of $n$ classifiers, and inputs are classified by a vote of the classifiers in the ensemble. Unlike prior such approaches, however, the classifiers in the ensemble are trained specifically to classify adversarial examples differently, rendering it very difficult for an adversarial example to obtain enough votes to be misclassified. We show that $n$-ML roughly retains the benign classification accuracies of state-of-the-art models on the MNIST, CIFAR10, and GTSRB datasets, while simultaneously defending against adversarial examples with better resilience than the best defenses known to date and, in most cases, with lower classification-time overhead.

References in corpus (28)

• ADADELTA: An Adaptive Learning Rate Method
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Certified Adversarial Robustness via Randomized Smoothing
• Detecting Adversarial Samples from Artifacts
• On the (Statistical) Detection of Adversarial Examples
• Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep Learning
• Adversarial Transformation Networks: Learning to Generate Adversarial Examples
• On Detecting Adversarial Perturbations
• Improving Adversarial Robustness via Promoting Ensemble Diversity
• Semidefinite relaxations for certifying robustness to adversarial examples
• Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech Recognition
• A Convex Relaxation Barrier to Tight Robustness Verification of Neural Networks
• On the Robustness of the CVPR 2018 White-Box Adversarial Example Defenses
• Guessing Smart: Biased Sampling for Efficient Black-Box Adversarial Attacks
• Evasion and Hardening of Tree Ensemble Classifiers
• Improving Adversarial Robustness of Ensembles with Diversity Training
• PipeDream: Fast and Efficient Pipeline Parallel DNN Training
• Feature Denoising for Improving Adversarial Robustness
• Ensemble Methods as a Defense to Adversarial Perturbations Against Deep Neural Networks
• On the Limitation of Local Intrinsic Dimensionality for Characterizing the Subspaces of Adversarial Examples
• Robustness to Adversarial Examples through an Ensemble of Specialists
• Should Adversarial Attacks Use Pixel p-Norm?
• Robustifying Models Against Adversarial Attacks by Langevin Dynamics
• Protecting Neural Networks with Hierarchical Random Switching: Towards Better Robustness-Accuracy Trade-off for Stochastic Defenses

Cited by in corpus (1)

• Certifying Joint Adversarial Robustness for Model Ensembles