RAID: Randomized Adversarial-Input Detection for Neural Networks

Abstract

In recent years, neural networks have become the default choice for image classification and many other learning tasks, even though they are vulnerable to so-called adversarial attacks. To increase their robustness against these attacks, there have emerged numerous detection mechanisms that aim to automatically determine if an input is adversarial. However, state-of-the-art detection mechanisms either rely on being tuned for each type of attack, or they do not generalize across different attack types. To alleviate these issues, we propose a novel technique for adversarial-image detection, RAID, that trains a secondary classifier to identify differences in neuron activation values between benign and adversarial inputs. Our technique is both more reliable and more effective than the state of the art when evaluated against six popular attacks. Moreover, a straightforward extension of RAID increases its robustness against detection-aware adversaries without affecting its effectiveness.

10 pages of content plus 2 pages of bibliography. Submitted to ISSTA

References in corpus (17)

• Scikit-learn: Machine Learning in Python
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• DeepXplore: Automated Whitebox Testing of Deep Learning Systems
• On Evaluating Adversarial Robustness
• Detecting Adversarial Samples from Artifacts
• On the (Statistical) Detection of Adversarial Examples
• Defensive Distillation is Not Robust to Adversarial Examples
• On Detecting Adversarial Perturbations
• Testing Deep Neural Networks
• A New Defense Against Adversarial Images: Turning a Weakness into a Strength
• Combinatorial Testing for Deep Learning Systems
• Bypassing Feature Squeezing by Increasing Adversary Strength
• When Explainability Meets Adversarial Learning: Detecting Adversarial Examples using SHAP Signatures
• There is Limited Correlation between Coverage and Robustness for Deep Neural Networks
• Adversarial Robustness Toolbox v1.0.0
• Are Odds Really Odd? Bypassing Statistical Detection of Adversarial Examples
• On the Limitation of MagNet Defense against $L_1$-based Adversarial Examples

Cited by in corpus (3)

• Adversarial Example Detection for DNN Models: A Review and Experimental Comparison
• Towards Scalable Verification of Deep Reinforcement Learning
• Models of Computational Profiles to Study the Likelihood of DNN Metamorphic Test Cases