The art of defense: letting networks fool the attacker

Abstract

Robust environment perception is critical for autonomous cars, and adversarial defenses are the most effective and widely studied ways to improve the robustness of environment perception. However, all of previous defense methods decrease the natural accuracy, and the nature of the DNNs itself has been overlooked. To this end, in this paper, we propose a novel adversarial defense for 3D point cloud classifier that makes full use of the nature of the DNNs. Due to the disorder of point cloud, all point cloud classifiers have the property of permutation invariant to the input point cloud. Based on this nature, we design invariant transformations defense (IT-Defense). We show that, even after accounting for obfuscated gradients, our IT-Defense is a resilient defense against state-of-the-art (SOTA) 3D attacks. Moreover, IT-Defense do not hurt clean accuracy compared to previous SOTA 3D defenses. Our code is available at: {\footnotesize{\url{https://github.com/cuge1995/IT-Defense}}}.

References in corpus (20)

• Adam: A Method for Stochastic Optimization
• Intriguing properties of neural networks
• Language Models are Few-Shot Learners
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Fast is better than free: Revisiting adversarial training
• Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
• Countering Adversarial Images using Input Transformations
• Making Convolutional Networks Shift-Invariant Again
• Adversarial Machine Learning at Scale
• PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples
• Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
• Stochastic Activation Pruning for Robust Adversarial Defense
• Improving Adversarial Robustness via Promoting Ensemble Diversity
• AdvPC: Transferable Adversarial Perturbations on 3D Point Clouds
• Rethinking Softmax Cross-Entropy Loss for Adversarial Robustness
• You Only Propagate Once: Accelerating Adversarial Training via Maximal Principle
• A New Defense Against Adversarial Images: Turning a Weakness into a Strength
• Cascade Adversarial Machine Learning Regularized with a Unified Embedding
• ME-Net: Towards Effective Adversarial Robustness with Matrix Estimation
• IF-Defense: 3D Adversarial Point Cloud Defense via Implicit Function based Restoration