LiBRe: A Practical Bayesian Approach to Adversarial Detection

Abstract

Despite their appealing flexibility, deep neural networks (DNNs) are vulnerable against adversarial examples. Various adversarial defense strategies have been proposed to resolve this problem, but they typically demonstrate restricted practicability owing to unsurmountable compromise on universality, effectiveness, or efficiency. In this work, we propose a more practical approach, Lightweight Bayesian Refinement (LiBRe), in the spirit of leveraging Bayesian neural networks (BNNs) for adversarial detection. Empowered by the task and attack agnostic modeling under Bayes principle, LiBRe can endow a variety of pre-trained task-dependent DNNs with the ability of defending heterogeneous adversarial attacks at a low cost. We develop and integrate advanced learning techniques to make LiBRe appropriate for adversarial detection. Concretely, we build the few-layer deep ensemble variational and adopt the pre-training & fine-tuning workflow to boost the effectiveness and efficiency of LiBRe. We further provide a novel insight to realise adversarial detection-oriented uncertainty quantification without inefficiently crafting adversarial examples during training. Extensive empirical studies covering a wide range of scenarios verify the practicability of LiBRe. We also conduct thorough ablation studies to evidence the superiority of our modeling and learning strategies.

arXiv commentIEEE/ CVF International Conference on Computer Vision and Pattern Recognition (CVPR), 2021

References in corpus (32)

• Adam: A Method for Stochastic Optimization
• Explaining and Harnessing Adversarial Examples
• What Uncertainties Do We Need in Bayesian Deep Learning for Computer Vision?
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Learning Face Representation from Scratch
• cuDNN: Efficient Primitives for Deep Learning
• A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks
• Theoretically Principled Trade-off between Robustness and Accuracy
• Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
• Variational Dropout and the Local Reparameterization Trick
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Detecting Adversarial Samples from Artifacts
• On the (Statistical) Detection of Adversarial Examples
• Deep Ensembles: A Loss Landscape Perspective
• Cross-Age LFW: A Database for Studying Cross-Age Face Recognition in Unconstrained Environments
• Multiplicative Normalizing Flows for Variational Bayesian Neural Networks
• On Detecting Adversarial Perturbations
• Bayesian Dark Knowledge
• Bayesian Deep Learning and a Probabilistic Perspective of Generalization
• Understanding Measures of Uncertainty for Adversarial Example Detection
• Practical Deep Learning with Bayesian Principles
• Functional Variational Bayesian Neural Networks
• Physical Adversarial Examples for Object Detectors
• Structured and Efficient Variational Deep Learning with Matrix Gaussian Posteriors
• Implicit Weight Uncertainty in Neural Networks
• Dropout as a Bayesian Approximation: Appendix
• Gradient Estimators for Implicit Models
• A Spectral Approach to Gradient Estimation for Implicit Distributions
• Being Bayesian, Even Just a Bit, Fixes Overconfidence in ReLU Networks
• On the Limitation of Local Intrinsic Dimensionality for Characterizing the Subspaces of Adversarial Examples
• Adversarial Phenomenon in the Eyes of Bayesian Deep Learning
• The Limitations of Model Uncertainty in Adversarial Settings