Defending Against Adversarial Attacks by Leveraging an Entire GAN
By G. Santhanam, Paulina Grnarova. 2018
40 citations recorded by the source corpus.
Recent work has shown that state-of-the-art models are highly vulnerable to adversarial perturbations of the input. We propose cowboy, an approach to detecting and defending against adversarial attacks by using both the discriminator and generator of a GAN trained on the same dataset. We show that the discriminator consistently scores the adversarial samples lower than the real samples across multiple attacks and datasets. We provide empirical evidence that adversarial samples lie outside of the data manifold learned by the GAN. Based on this, we propose a cleaning method which uses both the discriminator and generator of the GAN to project the samples back onto the data manifold. This cleaning procedure is independent of the classifier and type of attack and thus can be deployed in existing systems.
Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition
How researchers see this paper
The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.
In Artificial Intelligence
- Ala Al-Fuqaha
- Junaid Qadir
- Muhammad Bilal
- Jayaraman J. Thiagarajan
- Bhavya Kailkhura
- Timo Bremer
- Adnan Siraj Rakin
- Rushil Anirudh
In Computer Vision and Pattern Recognition
- Muhammad Bilal
- Ala Al-Fuqaha
- Junaid Qadir
- Jayaraman J. Thiagarajan
- Bhavya Kailkhura
- Timo Bremer
- Adnan Siraj Rakin
- Rushil Anirudh
Citations in the corpus
- Parametric Noise Injection: Trainable Randomness to Improve Deep Neural Network Robustness Against Adversarial Attack (2018, methodology): “For further improving the performance of DNN under attack, there are works attempt to introducing randomness into DNN for adversarial defense, such as randomly pruning some activation during the inference [37], randomizing the input layer [42], inserting a noise-layer right before the convolution la”
- MimicGAN: Robust Projection onto Image Manifolds with Corruption Mimicking (2019, methodology): “A similar approach proposes to use the discriminator in addition to the generator to detect adversarial examples [50], and we show in our experiments that, in comparison, the MimicGANdefense is significantly more robust.”
- Secure and Robust Machine Learning for Healthcare: A Survey (2020, methodology): “In [163], adversarial examples are cleaned using GAN that was trained on the same dataset.”