Analysis of Random Perturbations for Robust Convolutional Neural Networks

Abstract

Recent work has extensively shown that randomized perturbations of neural networks can improve robustness to adversarial attacks. The literature is, however, lacking a detailed compare-and-contrast of the latest proposals to understand what classes of perturbations work, when they work, and why they work. We contribute a detailed evaluation that elucidates these questions and benchmarks perturbation based defenses consistently. In particular, we show five main results: (1) all input perturbation defenses, whether random or deterministic, are equivalent in their efficacy, (2) attacks transfer between perturbation defenses so the attackers need not know the specific type of defense -- only that it involves perturbations, (3) a tuned sequence of noise layers across a network provides the best empirical robustness, (4) perturbation based defenses offer almost no robustness to adaptive attacks unless these perturbations are observed during training, and (5) adversarial examples in a close neighborhood of original inputs show an elevated sensitivity to perturbations in first and second-order analyses.

References in corpus (13)

• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• The Space of Transferable Adversarial Examples
• Countering Adversarial Images using Input Transformations
• Detecting Adversarial Samples from Artifacts
• Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers
• A study of the effect of JPG compression on adversarial images
• Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression
• Mitigating Adversarial Effects Through Randomization
• Hessian-based Analysis of Large Batch Training and Robustness to Adversaries
• First-order Adversarial Vulnerability of Neural Networks and Input Dimension
• Band-limited Training and Inference for Convolutional Neural Networks
• Defending against Whitebox Adversarial Attacks via Randomized Discretization
• Thwarting Adversarial Examples: An $L_0$-RobustSparse Fourier Transform