Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks

By Weilin Xu, David E. Evans, Yanjun Qi. 2017

1,705 citations recorded by the source corpus.

Although deep neural networks (DNNs) have achieved great success in many tasks, they can often be fooled by \emph{adversarial examples} that are generated by adding small but purposeful distortions to natural examples. Previous studies to defend against adversarial examples mostly focused on refining the DNN models, but have either shown limited success or required expensive computation. We propose a new strategy, \emph{feature squeezing}, that can be used to harden DNN models by detecting adversarial examples. Feature squeezing reduces the search space available to an adversary by coalescing samples that correspond to many different feature vectors in the original space into a single sample. By comparing a DNN model's prediction on the original input with that on squeezed inputs, feature squeezing detects adversarial examples with high accuracy and few false positives. This paper explores two feature squeezing methods: reducing the color bit depth of each pixel and spatial smoothing. These simple strategies are inexpensive and complementary to other defenses, and can be combined in a joint detection framework to achieve high detection rates against state-of-the-art attacks.

Subfields: Artificial Intelligence, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Safety, Robustness & Interpretability

Citations in the corpus

Local Model Poisoning Attacks to Byzantine-Robust Federated Learning (2019, neutral): “, [10,25,26,38,41,48,64]) were explored to mitigate them.”
Adversarial Training for Free! (2019, neutral): “Alternatively, robustness may be achieved by detecting and rejecting adversarial examples [Ma et al., 2018, Meng and Chen, 2017, Xu et al., 2017].”
Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks (2019, background): “A number of defenses have been proposed [43], [44], [45], [46], [47], yet many have shown to be less effective against an adaptive adversary [48], [49], [50], [51].”
A Rotation and a Translation Suffice: Fooling CNNs with Simple Transformations (2017, background): “There is now a long line of work on developing defenses against adversarial examples [16, 20, 7, 19, 10].”
ZOO: Zeroth Order Optimization Based Black-box Attacks to Deep Neural Networks without Training Substitute Models (2017, background): “readers can refer to recent works in [10, 13, 18, 28, 42, 43] and references therein for details.”
When Does Machine Learning FAIL? Generalized Transferability for Evasion and Poisoning Attacks (2018, neutral): “For example, the feature squeezing defense [49] constrains the adversary along the A and F dimensions by modify-”
Evaluating the Robustness of Neural Networks: An Extreme Value Theory Approach (2018, methodology): “In addition, detection methods such as feature squeezing (Xu et al., 2017) and example reforming (Meng & Chen, 2017) can also be used to identify adversarial examples.”
Spatially Transformed Adversarial Examples (2018, neutral): “Defensive Methods Following the emergence of adversarial examples, various defense methods have been studied, including adversarial training (Goodfellow et al., 2015), distillation (Papernot et al., 2016c), gradient masking (Gu & Rigazio, 2014) and feature squeezing (Xu et al., 2017).”
Towards Robust Neural Networks via Random Self-ensemble (2017, methodology): “In addition to changing the network structure, there are other methods [26, 15, 6, 8] “detecting” the adversarial examples, which are not in the scope of our paper.”
PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples (2017, background): “Feature squeezing Feature squeezing (Xu et al., 2017a) is both attack-agnostic and model-agnostic.”
DeepXplore: Automated Whitebox Testing of Deep Learning Systems (2017, background): “This observation has inspired several researchers to try to improve the robustness and reliability of DNNs [9, 13, 17, 30, 32, 46, 51, 53, 62, 84, 89, 90].”
Countering Adversarial Images using Input Transformations (2018, methodology): “We ﬁrst introduce three simple image transformations: image cropping-rescaling, bit-depth reduction (Xu et al., 2017), and JPEG compression and decompression (Dziugaite et al., 2016).”
Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep Learning (2018, background): “Progress has been made by discretizing the input space [71], training on adversarial examples [72], [18] or attempting to remove the adversarial perturbation [73], [74].”
Evolving Robust Neural Architectures to Defend from Adversarial Attacks (2019, background): “We also attacked some state-of-artdefences such as Adversarial Training (AT) [Madry et al., 2018] and Feature Squeezing (FS) [Xu et al., 2017] defending ResNet.”
Opportunities and obstacles for deep learning in biology and medicine (2017, background): “It may be impossible to guarantee that a model is not susceptible to adversarial examples, but work in this area is continuing [427,428].”
Lipschitz-Margin Training: Scalable Certification of Perturbation Invariance for Deep Neural Networks (2018, background): “Input transformations and detections [32, 11] are some other defense strategies, although we can bypass them [5].”
Adversarially Robust Generalization Requires More Data (2018, background): “[57] Weilin Xu, David Evans, and Yanjun Qi.”
One Pixel Attack for Fooling Deep Neural Networks (2017, background): “[41] showed that squeezing color bits and local/nonlocal spatial smoothing can simultaneously detect L0, L2, and L∞ attacks.”
Adversarial Logit Pairing (2018, methodology): “Multiple methods to defend against adversarial examples have been proposed (Buckman et al., 2018; Goodfellow et al., 2014; Kolter & Wong, 2017; Madry et al., 2017; Papernot et al., 2016; Szegedy et al., 2013; Tram`er et al., 2018; Xu et al., 2017).”