What You See is Not What the Network Infers: Detecting Adversarial Examples Based on Semantic Contradiction

Abstract

Adversarial examples (AEs) pose severe threats to the applications of deep neural networks (DNNs) to safety-critical domains, e.g., autonomous driving. While there has been a vast body of AE defense solutions, to the best of our knowledge, they all suffer from some weaknesses, e.g., defending against only a subset of AEs or causing a relatively high accuracy loss for legitimate inputs. Moreover, most existing solutions cannot defend against adaptive attacks, wherein attackers are knowledgeable about the defense mechanisms and craft AEs accordingly. In this paper, we propose a novel AE detection framework based on the very nature of AEs, i.e., their semantic information is inconsistent with the discriminative features extracted by the target DNN model. To be specific, the proposed solution, namely ContraNet, models such contradiction by first taking both the input and the inference result to a generator to obtain a synthetic output and then comparing it against the original input. For legitimate inputs that are correctly inferred, the synthetic output tries to reconstruct the input. On the contrary, for AEs, instead of reconstructing the input, the synthetic output would be created to conform to the wrong label whenever possible. Consequently, by measuring the distance between the input and the synthetic output with metric learning, we can differentiate AEs from legitimate inputs. We perform comprehensive evaluations under various AE attack scenarios, and experimental results show that ContraNet outperforms existing solutions by a large margin, especially under adaptive attacks. Moreover, our analysis shows that successful AEs that can bypass ContraNet tend to have much-weakened adversarial semantics. We have also shown that ContraNet can be easily combined with adversarial training techniques to achieve further improved AE defense capabilities.

arXiv commentAccepted to NDSS 2022. Camera-ready version with supplementary materials. Code is available at https://github.com/cure-lab/ContraNet.git

References in corpus (37)

• Adam: A Method for Stochastic Optimization
• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• Large Scale GAN Training for High Fidelity Natural Image Synthesis
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Tutorial on Variational Autoencoders
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Theoretically Principled Trade-off between Robustness and Accuracy
• A Learned Representation For Artistic Style
• Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks
• On Evaluating Adversarial Robustness
• cGANs with Projection Discriminator
• Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods
• Modulating early visual processing by language
• Is feature selection secure against training data poisoning?
• Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
• MagNet: a Two-Pronged Defense against Adversarial Examples
• Improving Adversarial Robustness via Promoting Ensemble Diversity
• CINIC-10 is not ImageNet or CIFAR-10
• Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples
• RobustBench: a standardized adversarial robustness benchmark
• Fixing Data Augmentation to Improve Adversarial Robustness
• The Unusual Effectiveness of Averaging in GAN Training
• Differentiable Augmentation for Data-Efficient GAN Training
• Image Synthesis with a Single (Robust) Classifier
• Adversarial Example Defenses: Ensembles of Weak Defenses are not Strong
• Sigmoid-Weighted Linear Units for Neural Network Function Approximation in Reinforcement Learning
• Gotta Catch 'Em All: Using Honeypots to Catch Adversarial Attacks on Neural Networks
• EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examples
• Adversarial Robustness: From Self-Supervised Pre-Training to Fine-Tuning
• Geometry-aware Instance-reweighted Adversarial Training
• HYDRA: Pruning Adversarially Robust Neural Networks
• Improving the Robustness of Deep Neural Networks via Adversarial Training with Triplet Loss
• Detection based Defense against Adversarial Examples from the Steganalysis Point of View
• Detecting Adversarial Examples from Sensitivity Inconsistency of Spatial-Transform Domain
• Evading Adversarial Example Detection Defenses with Orthogonal Projected Gradient Descent

Cited by in corpus (1)

• Towards Robust Domain Generation Algorithm Classification