Improving adversarial robustness of deep neural networks by using semantic information

Abstract

The vulnerability of deep neural networks (DNNs) to adversarial attack, which is an attack that can mislead state-of-the-art classifiers into making an incorrect classification with high confidence by deliberately perturbing the original inputs, raises concerns about the robustness of DNNs to such attacks. Adversarial training, which is the main heuristic method for improving adversarial robustness and the first line of defense against adversarial attacks, requires many sample-by-sample calculations to increase training size and is usually insufficiently strong for an entire network. This paper provides a new perspective on the issue of adversarial robustness, one that shifts the focus from the network as a whole to the critical part of the region close to the decision boundary corresponding to a given class. From this perspective, we propose a method to generate a single but image-agnostic adversarial perturbation that carries the semantic information implying the directions to the fragile parts on the decision boundary and causes inputs to be misclassified as a specified target. We call the adversarial training based on such perturbations "region adversarial training" (RAT), which resembles classical adversarial training but is distinguished in that it reinforces the semantic information missing in the relevant regions. Experimental results on the MNIST and CIFAR-10 datasets show that this approach greatly improves adversarial robustness even using a very small dataset from the training data; moreover, it can defend against FGSM adversarial attacks that have a completely different pattern from the model seen during retraining.

arXiv comment13 pages, 9 figures

References in corpus (33)

• Sequence to Sequence Learning with Neural Networks
• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• One pixel attack for fooling deep neural networks
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• Certified Defenses against Adversarial Examples
• Countering Adversarial Images using Input Transformations
• Technical Report on the CleverHans v2.1.0 Adversarial Examples Library
• Understanding Adversarial Training: Increasing Local Stability of Neural Nets through Robust Optimization
• Adversarial Machine Learning at Scale
• Fractional Max-Pooling
• Efficient Neural Network Robustness Certification with General Activation Functions
• Evaluating Robustness of Neural Networks with Mixed Integer Programming
• Formal Security Analysis of Neural Networks using Symbolic Intervals
• Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradients
• A study of the effect of JPG compression on adversarial images
• Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression
• Adversarial Training Methods for Semi-Supervised Text Classification
• Convolutional Kernel Networks
• Houdini: Fooling Deep Structured Prediction Models
• Foveation-based Mechanisms Alleviate Adversarial Examples
• Fast Feature Fool: A data independent approach to universal adversarial perturbations
• Biologically inspired protection of deep networks from adversarial attacks
• UPSET and ANGRI : Breaking High Performance Image Classifiers
• Generative Adversarial Trainer: Defense to Adversarial Perturbations with GAN
• APE-GAN: Adversarial Perturbation Elimination with GAN
• DeepCloak: Masking Deep Neural Network Models for Robustness Against Adversarial Samples
• Dense Associative Memory is Robust to Adversarial Inputs
• Cascade Adversarial Machine Learning Regularized with a Unified Embedding
• On the Effectiveness of Defensive Distillation

Cited by in corpus (1)

• Analyzing Adversarial Robustness of Deep Neural Networks in Pixel Space: a Semantic Perspective