Dimensionality Reduction as a Defense against Evasion Attacks on Machine Learning Classifiers

By Arjun Nitin Bhagoji, Daniel Cullina, Prateek Mittal. 2017

164 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods (2017, methodology): “Three use PCA to detect statistical properties of the images or network paramaters [4, 19, 24].”
Adversarial Examples: Attacks and Defenses for Deep Learning (2017, background): “A lot of research projects tried to detect adversarial examples in the testing stage [34], [107], [122]–[127], [129].”
Motivating the Rules of the Game for Adversarial Example Research (2018, background): “Because many perturbation defense papers we reviewed apply defenses that increase error on the test set [4, 7, 9, 14, 20, 23, 36, 42, 45, 104, 105], these methods are actually more vulnerable to the test set attack than an undefended model.”
Hessian-based Analysis of Large Batch Training and Robustness to Adversaries (2018, background): “Various defenses have been proposed to resist adversarial attacks [24, 14, 17, 2, 11].”
Disentangling Adversarial Robustness and Generalization (2018, methodology): “Defenses: Proposed defenses include detection and rejection methods [31, 25, 54, 60, 3, 63], pre-processing, quantization and dimensionality reduction methods [12, 73, 7], manifold-projection methods [39, 72, 82, 86], methods based on stochasticity/regularization or adapted architectures [109, 7, 68”
All You Need Is Low (Rank): Defending Against Adversarial Attacks on Graphs (2020, methodology): “[5], proposed a defense mechanism that utilizes Principal Component Analysis (PCA) for dimensionality reduction.”
LEMNA: Explaining Deep Learning based Security Applications (2018, unknown): “In particular, researchers recently proposed various methods [8, 67, 70] to obfuscate input features to increase the difficulty of running adversarial attacks.”
Detecting Adversarial Attacks on Neural Network Policies with Visual Foresight (2017, background): “The second category focuses on detecting and rejecting adversarial perturbations [2, 8, 11, 13, 20, 21, 26, 42].”
Evaluation and Design of Robust Neural Network Defenses (2018, background): “[10] show that adversarial images require use of more PCA dimensions than natural images.”
Adversarial Machine Learning for Network Intrusion Detection Systems: A Comprehensive Survey (2023, methodology): “[138] use PCA to reduce the dimensionality of the input sample and train a classifier on the smaller input, which forces the attacker to modify only the first few principal components.”
Better the Devil you Know: An Analysis of Evasion Attacks using Out-of-Distribution Adversarial Examples (2019, background): “The second approach adds additional pre-processing steps at the input in order to detect or defend against adversarial examples [11, 50, 86, 105, 111, 126, 128].”
Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examples (2018, methodology): “The model-agnostic approaches such as input dimensionality reduction [5, 26] or direct JPEG compression [9, 7, 11] attempt to remove adversarial perturbations from the inputs, before feeding them into DNN classiﬁers.”
A survey of safety and trustworthiness of deep neural networks: Verification, testing, adversarial attack and defence, and interpretability (2018, methodology): “For example, [Bhagoji et al., 2017] use Principal Component Analysis and data ‘anti-whitening’ reduces the high dimensional inputs for improving the resilience of various machine learning models including deep neural networks.”
Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression (2017, methodology): “[1] apply principal component analysis on images to reduce dimension and discard noise.”