Deflecting Adversarial Attacks

Abstract

There has been an ongoing cycle where stronger defenses against adversarial attacks are subsequently broken by a more advanced defense-aware attack. We present a new approach towards ending this cycle where we "deflect'' adversarial attacks by causing the attacker to produce an input that semantically resembles the attack's target class. To this end, we first propose a stronger defense based on Capsule Networks that combines three detection mechanisms to achieve state-of-the-art detection performance on both standard and defense-aware attacks. We then show that undetected attacks against our defense often perceptually resemble the adversarial target class by performing a human study where participants are asked to label images produced by the attack. These attack images can no longer be called "adversarial'' because our network classifies them the same way as humans do.

References in corpus (5)

• A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks
• On Evaluating Adversarial Robustness
• Detecting Adversarial Samples from Artifacts
• On the (Statistical) Detection of Adversarial Examples
• Are Odds Really Odd? Bypassing Statistical Detection of Adversarial Examples

Cited by in corpus (5)

• FDA3 : Federated Defense Against Adversarial Attacks for Cloud-Based IIoT Applications
• SoftHebb: Bayesian Inference in Unsupervised Hebbian Soft Winner-Take-All Networks
• Capsule Network is Not More Robust than Convolutional Network
• Feature Distillation With Guided Adversarial Contrastive Learning
• Recurrent Attention Models with Object-centric Capsule Representation for Multi-object Recognition