Orthogonal Deep Models As Defense Against Black-Box Attacks

Abstract

Deep learning has demonstrated state-of-the-art performance for a variety of challenging computer vision tasks. On one hand, this has enabled deep visual models to pave the way for a plethora of critical applications like disease prognostics and smart surveillance. On the other, deep learning has also been found vulnerable to adversarial attacks, which calls for new techniques to defend deep models against these attacks. Among the attack algorithms, the black-box schemes are of serious practical concern since they only need publicly available knowledge of the targeted model. We carefully analyze the inherent weakness of deep models in black-box settings where the attacker may develop the attack using a model similar to the targeted model. Based on our analysis, we introduce a novel gradient regularization scheme that encourages the internal representation of a deep model to be orthogonal to another, even if the architectures of the two models are similar. Our unique constraint allows a model to concomitantly endeavour for higher accuracy while maintaining near orthogonal alignment of gradients with respect to a reference model. Detailed empirical study verifies that controlled misalignment of gradients under our orthogonality objective significantly boosts a model's robustness against transferable black-box adversarial attacks. In comparison to regular models, the orthogonal models are significantly more robust to a range of $l_p$ norm bounded perturbations. We verify the effectiveness of our technique on a variety of large-scale models.

Accepted in IEEE Access

References in corpus (25)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networks
• PyTorch: An Imperative Style, High-Performance Deep Learning Library
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• Sanity Checks for Saliency Maps
• Countering Adversarial Images using Input Transformations
• Adversarial Examples Are Not Bugs, They Are Features
• Understanding Adversarial Training: Increasing Local Stability of Neural Nets through Robust Optimization
• Black-box Adversarial Attacks with Limited Queries and Information
• Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradients
• Defensive Distillation is Not Robust to Adversarial Examples
• Adversarial Training Methods for Semi-Supervised Text Classification
• advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorch
• Improving Adversarial Robustness of Ensembles with Diversity Training
• Understanding and Enhancing the Transferability of Adversarial Examples
• Image Synthesis with a Single (Robust) Classifier
• Generative Adversarial Trainer: Defense to Adversarial Perturbations with GAN
• APE-GAN: Adversarial Perturbation Elimination with GAN
• DeepCloak: Masking Deep Neural Network Models for Robustness Against Adversarial Samples
• HopSkipJumpAttack: A Query-Efficient Decision-Based Attack
• CapProNet: Deep Feature Learning via Orthogonal Projections onto Capsule Subspaces
• A Survey of Black-Box Adversarial Attacks on Computer Vision Models
• Curls & Whey: Boosting Black-Box Adversarial Attacks
• Label Universal Targeted Attack