Real-time Detection of Practical Universal Adversarial Perturbations
arXiv:2105.07334
Abstract
Universal Adversarial Perturbations (UAPs) are a prominent class of adversarial examples that exploit the systemic vulnerabilities and enable physically realizable and robust attacks against Deep Neural Networks (DNNs). UAPs generalize across many different inputs; this leads to realistic and effective attacks that can be applied at scale. In this paper we propose HyperNeuron, an efficient and scalable algorithm that allows for the real-time detection of UAPs by identifying suspicious neuron hyper-activations. Our results show the effectiveness of HyperNeuron on multiple tasks (image classification, object detection), against a wide variety of universal attacks, and in realistic scenarios, like perceptual ad-blocking and adversarial patches. HyperNeuron is able to simultaneously detect both adversarial mask and patch UAPs with comparable or better performance than existing UAP defenses whilst introducing a significantly reduced latency of only 0.86 milliseconds per image. This suggests that many realistic and practical universal attacks can be reliably mitigated in real-time, which shows promise for the robust deployment of machine learning systems.
References in corpus (13)
- Very Deep Convolutional Networks for Large-Scale Image Recognition
- Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
- Synthesizing Robust Adversarial Examples
- ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness
- Fast is better than free: Revisiting adversarial training
- DPatch: An Adversarial Patch Attack on Object Detectors
- Fast Feature Fool: A data independent approach to universal adversarial perturbations
- Physical Adversarial Examples for Object Detectors
- Adversarial Objects Against LiDAR-Based Autonomous Driving Systems
- Defending Against Universal Attacks Through Selective Feature Regeneration
- Transfer of Adversarial Robustness Between Perturbation Types
- Physically Realizable Adversarial Examples for LiDAR Object Detection
- Jacobian Regularization for Mitigating Universal Adversarial Perturbations