Two Souls in an Adversarial Image: Towards Universal Adversarial Example Detection using Multi-view Inconsistency

Abstract

In the evasion attacks against deep neural networks (DNN), the attacker generates adversarial instances that are visually indistinguishable from benign samples and sends them to the target DNN to trigger misclassifications. In this paper, we propose a novel multi-view adversarial image detector, namely Argos, based on a novel observation. That is, there exist two "souls" in an adversarial instance, i.e., the visually unchanged content, which corresponds to the true label, and the added invisible perturbation, which corresponds to the misclassified label. Such inconsistencies could be further amplified through an autoregressive generative approach that generates images with seed pixels selected from the original image, a selected label, and pixel distributions learned from the training data. The generated images (i.e., the "views") will deviate significantly from the original one if the label is adversarial, demonstrating inconsistencies that Argos expects to detect. To this end, Argos first amplifies the discrepancies between the visual content of an image and its misclassified label induced by the attack using a set of regeneration mechanisms and then identifies an image as adversarial if the reproduced views deviate to a preset degree. Our experimental results show that Argos significantly outperforms two representative adversarial detectors in both detection accuracy and robustness against six well-known adversarial attacks. Code is available at: https://github.com/sohaib730/Argos-Adversarial_Detection

References in corpus (25)

• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Wide Residual Networks
• A Survey of Deep Learning Techniques for Autonomous Driving
• Pixel Recurrent Neural Networks
• A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks
• Theoretically Principled Trade-off between Robustness and Accuracy
• DeepID3: Face Recognition with Very Deep Neural Networks
• Evasion Attacks against Machine Learning at Test Time
• Certified Adversarial Robustness via Randomized Smoothing
• Technical Report on the CleverHans v2.1.0 Adversarial Examples Library
• Detecting Adversarial Samples from Artifacts
• On the (Statistical) Detection of Adversarial Examples
• Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods
• Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
• Februus: Input Purification Defense Against Trojan Attacks on Deep Neural Network Systems
• Adversarial Examples that Fool both Computer Vision and Time-Limited Humans
• Early Methods for Detecting Adversarial Images
• Adversarial and Clean Data Are Not Twins
• A Tale of Evil Twins: Adversarial Inputs versus Poisoned Models
• Detecting and Diagnosing Adversarial Images with Class-Conditional Capsule Reconstructions
• Are Odds Really Odd? Bypassing Statistical Detection of Adversarial Examples
• Adversarial Detection and Correction by Matching Prediction Distributions
• Anytime Sampling for Autoregressive Models via Ordered Autoencoding