Robust Deep Learning Ensemble against Deception

Abstract

Deep neural network (DNN) models are known to be vulnerable to maliciously crafted adversarial examples and to out-of-distribution inputs drawn sufficiently far away from the training data. How to protect a machine learning model against deception of both types of destructive inputs remains an open challenge. This paper presents XEnsemble, a diversity ensemble verification methodology for enhancing the adversarial robustness of DNN models against deception caused by either adversarial examples or out-of-distribution inputs. XEnsemble by design has three unique capabilities. First, XEnsemble builds diverse input denoising verifiers by leveraging different data cleaning techniques. Second, XEnsemble develops a disagreement-diversity ensemble learning methodology for guarding the output of the prediction model against deception. Third, XEnsemble provides a suite of algorithms to combine input verification and output verification to protect the DNN prediction models from both adversarial examples and out of distribution inputs. Evaluated using eleven popular adversarial attacks and two representative out-of-distribution datasets, we show that XEnsemble achieves a high defense success rate against adversarial examples and a high detection success rate against out-of-distribution data inputs, and outperforms existing representative defense methods with respect to robustness and defensibility.

References in corpus (11)

• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• A Baseline for Detecting Misclassified and Out-of-Distribution Examples in Neural Networks
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks
• Training Confidence-calibrated Classifiers for Detecting Out-of-Distribution Samples
• Snapshot Ensembles: Train 1, get M for free
• A Framework for Evaluating Gradient Leakage Attacks in Federated Learning
• Adversarial Examples in Deep Learning: Characterization and Divergence
• Out-of-Distribution Detection using Multiple Semantic Label Representations
• Defense Against the Dark Arts: An overview of adversarial example security research and future research directions
• MULDEF: Multi-model-based Defense Against Adversarial Examples for Neural Networks