Detecting Localized Adversarial Examples: A Generic Approach using Critical Region Analysis

Abstract

Deep neural networks (DNNs) have been applied in a wide range of applications,e.g.,face recognition and image classification; however,they are vulnerable to adversarial examples. By adding a small amount of imperceptible perturbations,an attacker can easily manipulate the outputs of a DNN. Particularly,the localized adversarial examples only perturb a small and contiguous region of the target object,so that they are robust and effective in both digital and physical worlds. Although the localized adversarial examples have more severe real-world impacts than traditional pixel attacks,they have not been well addressed in the literature. In this paper,we propose a generic defense system called TaintRadar to accurately detect localized adversarial examples via analyzing critical regions that have been manipulated by attackers. The main idea is that when removing critical regions from input images,the ranking changes of adversarial labels will be larger than those of benign labels. Compared with existing defense solutions,TaintRadar can effectively capture sophisticated localized partial attacks, e.g.,the eye-glasses attack,while not requiring additional training or fine-tuning of the original model's structure. Comprehensive experiments have been conducted in both digital and physical worlds to verify the effectiveness and robustness of our defense.

References in corpus (12)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• How transferable are features in deep neural networks?
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Technical Report on the CleverHans v2.1.0 Adversarial Examples Library
• AdvHat: Real-world adversarial attack on ArcFace Face ID system
• PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples
• On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models
• A study of the effect of JPG compression on adversarial images
• Curriculum Adversarial Training
• Interpretable Deep Learning under Fire

Cited by in corpus (2)

• ScaleCert: Scalable Certified Defense against Adversarial Patches with Sparse Superficial Layers
• Localizing Adversarial Attacks To Produces More Imperceptible Noise