Robustness to Adversarial Examples through an Ensemble of Specialists

By Mahdieh Abbasi, Christian Gagné. 2017

112 citations recorded by the source corpus.

We are proposing to use an ensemble of diverse specialists, where speciality is defined according to the confusion matrix. Indeed, we observed that for adversarial instances originating from a given class, labeling tend to be done into a small subset of (incorrect) classes. Therefore, we argue that an ensemble of specialists should be better able to identify and reject fooling instances, with a high entropy (i.e., disagreement) over the decisions in the presence of adversaries. Experimental results obtained confirm that interpretation, opening a way to make the system more robust to adversarial examples through a rejection mechanism, rather than trying to classify them properly at any cost.

Subfields: Artificial Intelligence

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

Citations in the corpus

Adversarial Example Defenses: Ensembles of Weak Defenses are not Strong (2017, methodology): “While Ab-basi and Gagn´e also propose the defense for CIFAR-10, the architecture described in their experiments have low accuracy, resulting in low conﬁdence even in benign images.”
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey (2018, methodology): “[76] also combined feature squeezing with the ensemble method proposed in [173] to show that strength of defenses does not”
A Survey on Security Threats and Defensive Techniques of Machine Learning: A Data Driven View (2018, background): “Furthermore, many researchers proposed some ensemble methods to improve the security and the robustness of learning algorithms [97]–[99].”
Adversarial Examples on Object Recognition (2020, background): “Abbasi and Gagné [1] developed an ensemble of detectors based on the confusion matrix of each classifier.”
With Great Training Comes Great Vulnerability: Practical Attacks against Transfer Learning (2018, background): “This idea has been explored before in related contexts [13].”
Hardware Trojan Attacks on Neural Networks (2018, background): “Some other more advanced yet complex techniques, such as the ensemble methods that generate multiple versions of a classiﬁer with differing network architectures [23], [39], are cost-prohibitive to implement on hardware.”
Adversarial Spheres (2018, methodology): “C V ] 9 J an 2 01 adversarial examples using a second statistical model (Feinman et al., 2017; Abbasi & Gagné, 2017; Grosse et al., 2017; Metzen et al., 2017).”