Robust Convolutional Neural Networks under Adversarial Noise

By Jonghoon Jin, Aysegul Dundar, Eugenio Culurciello. 2015

80 citations recorded by the source corpus.

Recent studies have shown that Convolutional Neural Networks (CNNs) are vulnerable to a small perturbation of input called "adversarial examples". In this work, we propose a new feedforward CNN that improves robustness in the presence of adversarial noise. Our model uses stochastic additive noise added to the input image and to the CNN models. The proposed model operates in conjunction with a CNN trained with either standard or adversarial objective function. In particular, convolution, max-pooling, and ReLU layers are modified to benefit from the noise model. Our feedforward model is parameterized by only a mean and variance per pixel which simplifies computations and makes our method scalable to a deep architecture. From CIFAR-10 and ImageNet test, the proposed model outperforms other methods and the improvement is more evident for difficult classification tasks or stronger adversarial noise.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Control and Systems Engineering, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Control and Systems Engineering

In Safety, Robustness & Interpretability

Citations in the corpus

A General Framework for Uncertainty Estimation in Deep Learning (2019, background): “hat it loses precision in non-linear layers, which present mean-variance interaction. As a trade-off to this loss in precision, we will show that our framework gains robustness to adversarial attacks [17]. C. Robustness to Adversarial Attacks Our framework propagates input mean and variance through ”
ZOO: Zeroth Order Optimization Based Black-box Attacks to Deep Neural Networks without Training Substitute Models (2017, background): “Interested readers can refer to the recent works in [19, 27, 41, 44, 45] and the references therein.”
Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods (2017, background): “There has been a significant amount of work studying methods to construct adversarial examples [5, 8, 13, 26, 30, 39] and to make networks robust against adversarial examples [3, 16, 20, 21, 31, 33, 34, 41].”
Style transfer-based image synthesis as an efficient regularization technique in deep learning (2019, background): “One of the interesting approaches developed to make a CNN robust was data augmentation by adding a stochastic additive noise to an image [18].”
Lightweight Probabilistic Deep Networks (2018, methodology): “Note that while in [27] un-2 certainties are dropped at the softmax layer, we provide an alternative classiﬁcation layer that can be used in conjunction with maximum conditional likelihood learning.”
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey (2018, methodology): “[119] introduced a feedforward CNN that used additive noise to mitigate the effects of adversarial examples.”
A systematic review on overfitting control in shallow and deep neural networks (2021, background): “Also, in Jin et al. (2015), the effect of the noise on the input of models has been discussed.”
An Improved Evaluation Framework for Generative Adversarial Networks (2018, methodology): “Multi-manifold: The Gaussian assumption on the features were commonly used in the literature [36].”
Deep Convolutional Neural Networks for Image Classification: A Comprehensive Review (2017, methodology): “…(Goodfellow et al., 2015) and distillation (Papernot et al., 2016), generative preprocessing methods such as the use of denoising autoencoders (Uličný et al., 2016), and changing DCNN architecture to make it more nonlinear or to penalize unusual signals (Zhao & Griffin, 2016; Jin et al., 2016).”
Robustness to Adversarial Examples through an Ensemble of Specialists (2017, background): “Moreover, training on some type of adversaries has been demonstrating to harm the performance on clean test samples (Jin et al., 2015; Moosavi-Dezfooli et al., 2016).”
Data augmentation for improving deep learning in image classification problem (2018, methodology): “Moreover, the current research about so called adversarial attacks on CNNs showed that deep neural networks can be easily fooled into misclassification of images just by partial rotations and image translation [1], adding the noise to images [5] and even changing one, skillfully selected pixel in th”
A Theoretical Framework for Robustness of (Deep) Classifiers against Adversarial Examples (2016, background): “For instance, denoising NN architectures (Vincent et al., 2008; Gu & Rigazio, 2014; Jin et al., 2015) can discover more robust features by using a noise-corrupted version of inputs as training samples .”