Using an ensemble color space model to tackle adversarial examples

Abstract

Minute pixel changes in an image drastically change the prediction that the deep learning model makes. One of the most significant problems that could arise due to this, for instance, is autonomous driving. Many methods have been proposed to combat this with varying amounts of success. We propose a 3 step method for defending such attacks. First, we denoise the image using statistical methods. Second, we show that adopting multiple color spaces in the same model can help us to fight these adversarial attacks further as each color space detects certain features explicit to itself. Finally, the feature maps generated are enlarged and sent back as an input to obtain even smaller features. We show that the proposed model does not need to be trained to defend an particular type of attack and is inherently more robust to black-box, white-box, and grey-box adversarial attack techniques. In particular, the model is 56.12 percent more robust than compared models in case of white box attacks when the models are not subject to adversarial example training.

References in corpus (11)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Distilling the Knowledge in a Neural Network
• Ensemble Adversarial Training: Attacks and Defenses
• Wide Residual Networks
• Pixel Recurrent Neural Networks
• Certified Defenses against Adversarial Examples
• Countering Adversarial Images using Input Transformations
• Detecting Adversarial Samples from Artifacts
• Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
• Divide, Denoise, and Defend against Adversarial Attacks
• The Effect of Color Space Selection on Detectability and Discriminability of Colored Objects