Attack as Defense: Characterizing Adversarial Examples using Robustness
arXiv:2103.07633
Abstract
As a new programming paradigm, deep learning has expanded its application to many real-world problems. At the same time, deep learning based software are found to be vulnerable to adversarial attacks. Though various defense mechanisms have been proposed to improve robustness of deep learning software, many of them are ineffective against adaptive attacks. In this work, we propose a novel characterization to distinguish adversarial examples from benign ones based on the observation that adversarial examples are significantly less robust than benign ones. As existing robustness measurement does not scale to large networks, we propose a novel defense framework, named attack as defense (A2D), to detect adversarial examples by effectively evaluating an example's robustness. A2D uses the cost of attacking an input for robustness evaluation and identifies those less robust examples as adversarial since less robust examples are easier to attack. Extensive experiment results on MNIST, CIFAR10 and ImageNet show that A2D is more effective than recent promising approaches. We also evaluate our defence against potential adaptive attacks and show that A2D is effective in defending carefully designed adaptive attacks, e.g., the attack success rate drops to 0% on CIFAR10.
References in corpus (15)
- Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
- Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
- DeepXplore: Automated Whitebox Testing of Deep Learning Systems
- A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks
- Countering Adversarial Images using Input Transformations
- Detecting Adversarial Samples from Artifacts
- Evaluating Robustness of Neural Networks with Mixed Integer Programming
- PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples
- Mitigating Adversarial Effects Through Randomization
- Testing Deep Neural Networks
- Efficient Formal Safety Analysis of Neural Networks
- A Dual Approach to Scalable Verification of Deep Networks
- MagNet and "Efficient Defenses Against Adversarial Attacks" are Not Robust to Adversarial Examples
- Gotta Catch 'Em All: Using Honeypots to Catch Adversarial Attacks on Neural Networks
- Testing Deep Learning Models for Image Analysis Using Object-Relevant Metamorphic Relations