Resilience from Diversity: Population-based approach to harden models against adversarial attacks

Abstract

Traditional deep learning networks (DNN) exhibit intriguing vulnerabilities that allow an attacker to force them to fail at their task. Notorious attacks such as the Fast Gradient Sign Method (FGSM) and the more powerful Projected Gradient Descent (PGD) generate adversarial samples by adding a magnitude of perturbation $\epsilon$ to the input's computed gradient, resulting in a deterioration of the effectiveness of the model's classification. This work introduces a model that is resilient to adversarial attacks. Our model leverages an established mechanism of defense which utilizes randomness and a population of DNNs. More precisely, our model consists of a population of $n$ diverse submodels, each one of them trained to individually obtain a high accuracy for the task at hand, while forced to maintain meaningful differences in their weights. Each time our model receives a classification query, it selects a submodel from its population at random to answer the query. To counter the attack transferability, diversity is introduced and maintained in the population of submodels. Thus introducing the concept of counter linking weights. A Counter-Linked Model (CLM) consists of a population of DNNs of the same architecture where a periodic random similarity examination is conducted during the simultaneous training to guarantee diversity while maintaining accuracy. Though the randomization technique proved to be resilient against adversarial attacks, we show that by retraining the DNNs ensemble or training them from the start with counter linking would enhance the robustness by around 20\% when tested on the MNIST dataset and at least 15\% when tested on the CIFAR-10 dataset. When CLM is coupled with adversarial training, this defense mechanism achieves state-of-the-art robustness.

arXiv comment12 pages, 6 figures, 5 tables

References in corpus (18)

• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Certified Defenses against Adversarial Examples
• Countering Adversarial Images using Input Transformations
• Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep Learning
• Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulation
• Stochastic Activation Pruning for Robust Adversarial Defense
• Mitigating Adversarial Effects Through Randomization
• Semidefinite relaxations for certifying robustness to adversarial examples
• Evaluating the Robustness of Neural Networks: An Extreme Value Theory Approach
• On the Robustness of the CVPR 2018 White-Box Adversarial Example Defenses
• Training for Faster Adversarial Robustness Verification via Inducing ReLU Stability
• Torchattacks: A PyTorch Repository for Adversarial Attacks
• Adv-BNN: Improved Adversarial Defense through Robust Bayesian Neural Network
• Analyzing the Robustness of Nearest Neighbors to Adversarial Examples
• Ensemble Methods as a Defense to Adversarial Perturbations Against Deep Neural Networks
• Feature Squeezing Mitigates and Detects Carlini/Wagner Adversarial Examples