Block Switching: A Stochastic Approach for Deep Learning Security

Abstract

Recent study of adversarial attacks has revealed the vulnerability of modern deep learning models. That is, subtly crafted perturbations of the input can make a trained network with high accuracy produce arbitrary incorrect predictions, while maintain imperceptible to human vision system. In this paper, we introduce Block Switching (BS), a defense strategy against adversarial attacks based on stochasticity. BS replaces a block of model layers with multiple parallel channels, and the active channel is randomly assigned in the run time hence unpredictable to the adversary. We show empirically that BS leads to a more dispersed input gradient distribution and superior defense effectiveness compared with other stochastic defenses such as stochastic activation pruning (SAP). Compared to other defenses, BS is also characterized by the following features: (i) BS causes less test accuracy drop; (ii) BS is attack-independent and (iii) BS is compatible with other defenses and can be used jointly with others.

arXiv commentAccepted by AdvML19: Workshop on Adversarial Learning Methods for Machine Learning and Data Mining at KDD, Anchorage, Alaska, USA, August 5th, 2019, 5 pages

References in corpus (8)

• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• Caffe: Convolutional Architecture for Fast Feature Embedding
• End to End Learning for Self-Driving Cars
• Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods
• Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression
• Stochastic Activation Pruning for Robust Adversarial Defense
• Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey