ATHENA: A Framework based on Diverse Weak Defenses for Building Adversarial Defense

Abstract

There has been extensive research on developing defense techniques against adversarial attacks; however, they have been mainly designed for specific model families or application domains, therefore, they cannot be easily extended. Based on the design philosophy of ensemble of diverse weak defenses, we propose ATHENA---a flexible and extensible framework for building generic yet effective defenses against adversarial attacks. We have conducted a comprehensive empirical study to evaluate several realizations of ATHENA with four threat models including zero-knowledge, black-box, gray-box, and white-box. We also explain (i) why diversity matters, (ii) the generality of the defense framework, and (iii) the overhead costs incurred by ATHENA.

arXiv comment18 pages, 32 figures

References in corpus (32)

• Distilling the Knowledge in a Neural Network
• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• Ensemble Adversarial Training: Attacks and Defenses
• Wide Residual Networks
• Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Synthesizing Robust Adversarial Examples
• Certified Adversarial Robustness via Randomized Smoothing
• On Evaluating Adversarial Robustness
• Achieving Human Parity in Conversational Speech Recognition
• Countering Adversarial Images using Input Transformations
• Technical Report on the CleverHans v2.1.0 Adversarial Examples Library
• Adversarial Examples Are Not Bugs, They Are Features
• Adversarial Machine Learning at Scale
• Understanding Adversarial Training: Increasing Local Stability of Neural Nets through Robust Optimization
• Detecting Adversarial Samples from Artifacts
• On the (Statistical) Detection of Adversarial Examples
• Robustness May Be at Odds with Accuracy
• Shake-Shake regularization
• Adversarial Feature Selection against Evasion Attacks
• A study of the effect of JPG compression on adversarial images
• Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression
• NO Need to Worry about Adversarial Examples in Object Detection in Autonomous Vehicles
• Mitigating Adversarial Effects Through Randomization
• Improving Adversarial Robustness via Promoting Ensemble Diversity
• Simple Black-box Adversarial Attacks
• MagNet and "Efficient Defenses Against Adversarial Attacks" are Not Robust to Adversarial Examples
• On Adaptive Attacks to Adversarial Example Defenses
• Foveation-based Mechanisms Alleviate Adversarial Examples
• DeepFool: a simple and accurate method to fool deep neural networks
• Adversary Resistant Deep Neural Networks with an Application to Malware Detection

Cited by in corpus (4)

• Enhancing Certified Robustness via Smoothed Weighted Ensembling
• Certifying Joint Adversarial Robustness for Model Ensembles
• Where Does the Robustness Come from? A Study of the Transformation-based Ensemble Defence
• Do Deep Minds Think Alike? Selective Adversarial Attacks for Fine-Grained Manipulation of Multiple Deep Neural Networks