Detecting Adversarial Patches with Class Conditional Reconstruction Networks

Abstract

Defending against physical adversarial attacks is a rapidly growing topic in deep learning and computer vision. Prominent forms of physical adversarial attacks, such as overlaid adversarial patches and objects, share similarities with digital attacks, but are easy for humans to notice. This leads us to explore the hypothesis that adversarial detection methods, which have been shown to be ineffective against adaptive digital adversarial examples, can be effective against these physical attacks. We use one such detection method based on autoencoder architectures, and perform adversarial patching experiments on MNIST, SVHN, and CIFAR10 against a CNN architecture and two CapsNet architectures. We also propose two modifications to the EM-Routed CapsNet architecture, Affine Voting and Matrix Capsule Dropout, to improve its classification performance. Our investigation shows that the detector retains some of its effectiveness even against adaptive adversarial patch attacks. In addition, detection performance tends to decrease among all the architectures with the increase of dataset complexity.

References in corpus (17)

• Adam: A Method for Stochastic Optimization
• Continuous control with deep reinforcement learning
• Intriguing properties of neural networks
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Synthesizing Robust Adversarial Examples
• Detecting Adversarial Samples from Artifacts
• On the (Statistical) Detection of Adversarial Examples
• On Detecting Adversarial Perturbations
• Capsules for Object Segmentation
• MagNet and "Efficient Defenses Against Adversarial Attacks" are Not Robust to Adversarial Examples
• On Physical Adversarial Patches for Object Detection
• A New Defense Against Adversarial Images: Turning a Weakness into a Strength
• Detecting and Diagnosing Adversarial Images with Class-Conditional Capsule Reconstructions
• Adversarial T-shirt! Evading Person Detectors in A Physical World
• Fooling Detection Alone is Not Enough: First Adversarial Attack against Multiple Object Tracking
• Towards Robust Detection of Adversarial Examples