Dynamic Defense Approach for Adversarial Robustness in Deep Neural Networks via Stochastic Ensemble Smoothed Model

Abstract

Deep neural networks have been shown to suffer from critical vulnerabilities under adversarial attacks. This phenomenon stimulated the creation of different attack and defense strategies similar to those adopted in cyberspace security. The dependence of such strategies on attack and defense mechanisms makes the associated algorithms on both sides appear as closely reciprocating processes. The defense strategies are particularly passive in these processes, and enhancing initiative of such strategies can be an effective way to get out of this arms race. Inspired by the dynamic defense approach in cyberspace, this paper builds upon stochastic ensemble smoothing based on defense method of random smoothing and model ensemble. Proposed method employs network architecture and smoothing parameters as ensemble attributes, and dynamically change attribute-based ensemble model before every inference prediction request. The proposed method handles the extreme transferability and vulnerability of ensemble models under white-box attacks. Experimental comparison of ASR-vs-distortion curves with different attack scenarios shows that even the attacker with the highest attack capability cannot easily exceed the attack success rate associated with the ensemble smoothed model, especially under untargeted attacks.

arXiv comment17 pages,8 figures

References in corpus (15)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• End to End Learning for Self-Driving Cars
• The Effectiveness of Data Augmentation in Image Classification using Deep Learning
• Wide Residual Networks
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Certified Adversarial Robustness via Randomized Smoothing
• Using Pre-Training Can Improve Model Robustness and Uncertainty
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Efficient Neural Network Robustness Certification with General Activation Functions
• Evaluating Robustness of Neural Networks with Mixed Integer Programming
• Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers
• Improving Adversarial Robustness via Promoting Ensemble Diversity
• Certified Adversarial Robustness with Additive Noise
• Deep Neural Networks as 0-1 Mixed Integer Linear Programs: A Feasibility Study
• Benchmarking Adversarial Robustness