Efficient Defenses Against Adversarial Attacks

By Valentina Zantedeschi, Maria-Irina Nicolae, Ambrish Rawat. 2017

315 citations recorded by the source corpus.

Following the recent adoption of deep neural networks (DNN) accross a wide range of applications, adversarial attacks against these models have proven to be an indisputable threat. Adversarial samples are crafted with a deliberate intention of undermining a system. In the case of DNNs, the lack of better understanding of their working has prevented the development of efficient defenses. In this paper, we propose a new defense method based on practical observations which is easy to integrate into models and performs better than state-of-the-art defenses. Our proposed solution is meant to reinforce the structure of a DNN, making its prediction more stable and less likely to be fooled by adversarial samples. We conduct an extensive experimental study proving the efficiency of our method against multiple attacks, comparing it to numerous defenses, both in white-box and black-box setups. Additionally, the implementation of our method brings almost no overhead to the training procedure, while maintaining the prediction performance of the original model on clean samples.

Subfields: Artificial Intelligence, Safety, Robustness & Interpretability, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Safety, Robustness & Interpretability

In Signal Processing

Citations in the corpus

Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning (2017, background): “, training neural networks with bounded activation functions and training data augmentation to improve stability to input changes [112, 113].”
Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples (2018, background): “To the best of our knowledge, all defenses against adversarial examples published in peer-reviewed venues to date (Papernot et al., 2016; Hendrik Metzen et al., 2017; Hendrycks & Gimpel, 2017; Meng & Chen, 2017; Zantedeschi et al., 2017) are vulnerable to powerful optimization-based attacks (Carlini”
ZOO: Zeroth Order Optimization Based Black-box Attacks to Deep Neural Networks without Training Substitute Models (2017, methodology): “Different data augmentation methods have been proposed to improve the robustness of DNNs. Interested readers can refer to the recent works in [18, 26, 40, 43, 44] and the references therein.”
Certified Adversarial Robustness via Randomized Smoothing (2019, background): “, 2019), and have suggested that Gaussian data augmentation could supplement or replace adversarial training (Zantedeschi et al., 2017; Kannan et al., 2018).”
Evaluating the Robustness of Neural Networks: An Extreme Value Theory Approach (2018, methodology): “, 2016) (DD) and bounded ReLU (Zantedeschi et al., 2017) (BReLU) defense techniques employed.”
Towards Robust Neural Networks via Random Self-ensemble (2017, methodology): “We do not compare the results on MNIST since it is a much easier dataset and existing defense methods such as [16, 27, 12, 11] can effectively increase image distortion under adversarial attacks.”
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey (2018, background): “Gaussian data augmentation [46]) also helps in improving robustness of neural networks to adversarial”
MagNet and "Efficient Defenses Against Adversarial Attacks" are Not Robust to Adversarial Examples (2017, methodology): “Efficient Defenses Against Adversarial Attacks [12] works by making two modifications to standard neural networks.”
Are adversarial examples inevitable? (2018, background): “, 2016b) and specialized activation functions (Zantedeschi et al., 2017) were also toppled by strong attacks (Papernot et al.”
Adversarial Examples Are a Natural Consequence of Test Error in Noise (2019, background): “Gaussian data augmenation has been proposed as an adversarial defense in prior work (Zantedeschi et al., 2017).”
Disentangling Adversarial Robustness and Generalization (2018, methodology): “Defenses: Proposed defenses include detection and rejection methods [31, 25, 54, 60, 3, 63], pre-processing, quantization and dimensionality reduction methods [12, 73, 7], manifold-projection methods [39, 72, 82, 86], methods based on stochasticity/regularization or adapted architectures [109, 7, 68”
PassGAN: A Deep Learning Approach for Password Guessing (2017, unknown): “Several countermeasures have been proposed [53], [77].”
MixTrain: Scalable Training of Formally Robust Neural Networks (2018, unknown): “Various defensive system are given [39], [9], [10], [40], [41], [42], [43], [44], [45], [46].”
Machine Learning in Python: Main developments and technology trends in data science, machine learning, and artificial intelligence (2020, unknown): “[178] yes no no no no ZOO [179] no no yes no no Virtual adversarial method [180] yes yes yes no no Adversarial patch [181] no no yes no no Spatial transformation attack [182] no yes yes no no Decision tree attack [183] no no yes no no FGSM [184] yes yes yes yes yes R+FGSM [185] no no no yes no R+LLC”
A Roadmap Toward the Resilient Internet of Things for Cyber-Physical Systems (2018, background): “, watermarking [193], [194], input transformation [195] and adversarial learning [196], [197].”