MixDefense: A Defense-in-Depth Framework for Adversarial Example Detection Based on Statistical and Semantic Analysis

Abstract

Machine learning with deep neural networks (DNNs) has become one of the foundation techniques in many safety-critical systems, such as autonomous vehicles and medical diagnosis systems. DNN-based systems, however, are known to be vulnerable to adversarial examples (AEs) that are maliciously perturbed variants of legitimate inputs. While there has been a vast body of research to defend against AE attacks in the literature, the performances of existing defense techniques are still far from satisfactory, especially for adaptive attacks, wherein attackers are knowledgeable about the defense mechanisms and craft AEs accordingly. In this work, we propose a multilayer defense-in-depth framework for AE detection, namely MixDefense. For the first layer, we focus on those AEs with large perturbations. We propose to leverage the `noise' features extracted from the inputs to discover the statistical difference between natural images and tampered ones for AE detection. For AEs with small perturbations, the inference result of such inputs would largely deviate from their semantic information. Consequently, we propose a novel learning-based solution to model such contradictions for AE detection. Both layers are resilient to adaptive attacks because there do not exist gradient propagation paths for AE generation. Experimental results with various AE attack methods on image classification datasets show that the proposed MixDefense solution outperforms the existing AE detection techniques by a considerable margin.

References in corpus (27)

• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Theoretically Principled Trade-off between Robustness and Accuracy
• On Evaluating Adversarial Robustness
• Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
• cGANs with Projection Discriminator
• Technical Report on the CleverHans v2.1.0 Adversarial Examples Library
• Detecting Adversarial Samples from Artifacts
• On the (Statistical) Detection of Adversarial Examples
• A study of the effect of JPG compression on adversarial images
• Spatially Transformed Adversarial Examples
• Adversarial Transformation Networks: Learning to Generate Adversarial Examples
• On Detecting Adversarial Perturbations
• MagNet: a Two-Pronged Defense against Adversarial Examples
• Improving Adversarial Robustness via Promoting Ensemble Diversity
• Adversarial Examples Are a Natural Consequence of Test Error in Noise
• Pervasive Label Errors in Test Sets Destabilize Machine Learning Benchmarks
• Deep Defense: Training DNNs with Improved Adversarial Robustness
• Gotta Catch 'Em All: Using Honeypots to Catch Adversarial Attacks on Neural Networks
• Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbations
• Shield: Fast, Practical Defense and Vaccination for Deep Learning using JPEG Compression
• Opportunities and Challenges in Deep Learning Adversarial Robustness: A Survey
• PyTorch Metric Learning
• Adversarial Attacks on Variational Autoencoders
• Defending against Whitebox Adversarial Attacks via Randomized Discretization
• Detecting Adversarial Examples and Other Misclassifications in Neural Networks by Introspection