Frequency Centric Defense Mechanisms against Adversarial Examples
arXiv:2110.13935 · doi:10.1145/3475724.3483610
Abstract
Adversarial example (AE) aims at fooling a Convolution Neural Network by introducing small perturbations in the input image.The proposed work uses the magnitude and phase of the Fourier Spectrum and the entropy of the image to defend against AE. We demonstrate the defense in two ways: by training an adversarial detector and denoising the adversarial effect. Experiments were conducted on the low-resolution CIFAR-10 and high-resolution ImageNet datasets. The adversarial detector has 99% accuracy for FGSM and PGD attacks on the CIFAR-10 dataset. However, the detection accuracy falls to 50% for sophisticated DeepFool and Carlini & Wagner attacks on ImageNet. We overcome the limitation by using autoencoder and show that 70% of AEs are correctly classified after denoising.
arXiv commentAdvM '21: Proceedings of the 1st International Workshop on Adversarial Learning for Multimedia, at ACM Multimedia '21
References in corpus (10)
- Very Deep Convolutional Networks for Large-Scale Image Recognition
- Explaining and Harnessing Adversarial Examples
- Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
- Towards Deep Learning Models Resistant to Adversarial Attacks
- A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks
- Rethinking the Inception Architecture for Computer Vision
- A Fourier Perspective on Model Robustness in Computer Vision
- PuVAE: A Variational Autoencoder to Purify Adversarial Examples
- Detecting AutoAttack Perturbations in the Frequency Domain
- On the Structural Sensitivity of Deep Convolutional Networks to the Directions of Fourier Basis Functions