Effective and Robust Detection of Adversarial Examples via Benford-Fourier Coefficients

Abstract

Adversarial examples have been well known as a serious threat to deep neural networks (DNNs). In this work, we study the detection of adversarial examples, based on the assumption that the output and internal responses of one DNN model for both adversarial and benign examples follow the generalized Gaussian distribution (GGD), but with different parameters (i.e., shape factor, mean, and variance). GGD is a general distribution family to cover many popular distributions (e.g., Laplacian, Gaussian, or uniform). It is more likely to approximate the intrinsic distributions of internal responses than any specific distribution. Besides, since the shape factor is more robust to different databases rather than the other two parameters, we propose to construct discriminative features via the shape factor for adversarial detection, employing the magnitude of Benford-Fourier coefficients (MBF), which can be easily estimated using responses. Finally, a support vector machine is trained as the adversarial detector through leveraging the MBF features. Extensive experiments in terms of image classification demonstrate that the proposed detector is much more effective and robust on detecting adversarial examples of different crafting methods and different sources, compared to state-of-the-art adversarial detection methods.

arXiv commentMachine Intelligence Research, 2022

References in corpus (18)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networks
• Explaining and Harnessing Adversarial Examples
• Generative Adversarial Networks: An Overview
• Towards Deep Learning Models Resistant to Adversarial Attacks
• A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks
• Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
• Detecting Adversarial Samples from Artifacts
• On the (Statistical) Detection of Adversarial Examples
• Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
• On Detecting Adversarial Perturbations
• End2End Occluded Face Recognition by Masking Corrupted Features
• Early Methods for Detecting Adversarial Images
• A New Defense Against Adversarial Images: Turning a Weakness into a Strength
• LARNet: Lie Algebra Residual Network for Face Recognition
• Fast Prediction with SVM Models Containing RBF Kernels
• Maximum Mean Discrepancy Test is Aware of Adversarial Attacks
• A General Framework For Detecting Anomalous Inputs to DNN Classifiers