Detecting Adversarial Examples by Input Transformations, Defense Perturbations, and Voting

Abstract

Over the last few years, convolutional neural networks (CNNs) have proved to reach super-human performance in visual recognition tasks. However, CNNs can easily be fooled by adversarial examples, i.e., maliciously-crafted images that force the networks to predict an incorrect output while being extremely similar to those for which a correct output is predicted. Regular adversarial examples are not robust to input image transformations, which can then be used to detect whether an adversarial example is presented to the network. Nevertheless, it is still possible to generate adversarial examples that are robust to such transformations. This paper extensively explores the detection of adversarial examples via image transformations and proposes a novel methodology, called \textit{defense perturbation}, to detect robust adversarial examples with the same input transformations the adversarial examples are robust to. Such a \textit{defense perturbation} is shown to be an effective counter-measure to robust adversarial examples. Furthermore, multi-network adversarial examples are introduced. This kind of adversarial examples can be used to simultaneously fool multiple networks, which is critical in systems that use network redundancy, such as those based on architectures with majority voting over multiple CNNs. An extensive set of experiments based on state-of-the-art CNNs trained on the Imagenet dataset is finally reported.

References in corpus (19)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• End to End Learning for Self-Driving Cars
• A Survey of the Recent Architectures of Deep Convolutional Neural Networks
• Synthesizing Robust Adversarial Examples
• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• Countering Adversarial Images using Input Transformations
• Systematic evaluation of CNN advances on the ImageNet
• Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
• Adversarial Examples: Opportunities and Challenges
• MagNet: a Two-Pronged Defense against Adversarial Examples
• Identity Mappings in Deep Residual Networks
• Mitigating Adversarial Effects Through Randomization
• DeepFool: a simple and accurate method to fool deep neural networks
• Universal adversarial perturbations
• Improving Transferability of Adversarial Examples with Input Diversity
• Maximal Jacobian-based Saliency Map Attack
• A Survey of Safety and Trustworthiness of Deep Neural Networks: Verification, Testing, Adversarial Attack and Defence, and Interpretability

Cited by in corpus (4)

• On the Real-World Adversarial Robustness of Real-Time Semantic Segmentation Models for Autonomous Driving
• Increasing the Confidence of Deep Neural Networks by Coverage Analysis
• On the Minimal Adversarial Perturbation for Deep Neural Networks with Provable Estimation Error
• Unsupervised Detection of Adversarial Examples with Model Explanations