Learning to Separate Clusters of Adversarial Representations for Robust Adversarial Detection

Abstract

Although deep neural networks have shown promising performances on various tasks, they are susceptible to incorrect predictions induced by imperceptibly small perturbations in inputs. A large number of previous works proposed to detect adversarial attacks. Yet, most of them cannot effectively detect them against adaptive whitebox attacks where an adversary has the knowledge of the model and the defense method. In this paper, we propose a new probabilistic adversarial detector motivated by a recently introduced non-robust feature. We consider the non-robust features as a common property of adversarial examples, and we deduce it is possible to find a cluster in representation space corresponding to the property. This idea leads us to probability estimate distribution of adversarial representations in a separate cluster, and leverage the distribution for a likelihood based adversarial detector.

References in corpus (21)

• Adam: A Method for Stochastic Optimization
• PyTorch: An Imperative Style, High-Performance Deep Learning Library
• Auto-Encoding Variational Bayes
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks
• Certified Adversarial Robustness via Randomized Smoothing
• Countering Adversarial Images using Input Transformations
• Detecting Adversarial Samples from Artifacts
• On the (Statistical) Detection of Adversarial Examples
• On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models
• An approach to reachability analysis for feed-forward ReLU neural networks
• Towards the first adversarially robust neural network model on MNIST
• Mitigating Adversarial Effects Through Randomization
• A Unified View of Piecewise Linear Neural Network Verification
• Training Confidence-calibrated Classifiers for Detecting Out-of-Distribution Samples
• Provably Minimally-Distorted Adversarial Examples
• Output Range Analysis for Deep Neural Networks
• MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radius
• Are Odds Really Odd? Bypassing Statistical Detection of Adversarial Examples
• Understanding the Limitations of Conditional Generative Models
• Controlling Over-generalization and its Effect on Adversarial Examples Generation and Detection