Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examples

By Zihao Liu, Qi Liu, Tao Liu, Yanzhi Wang, Wujie Wen. Computer Vision and Pattern Recognition, 2018

336 citations recorded by the source corpus.

Image compression-based approaches for defending against the adversarial-example attacks, which threaten the safety use of deep neural networks (DNN), have been investigated recently. However, prior works mainly rely on directly tuning parameters like compression rate, to blindly reduce image features, thereby lacking guarantee on both defense efficiency (i.e. accuracy of polluted images) and classification accuracy of benign images, after applying defense methods. To overcome these limitations, we propose a JPEG-based defensive compression framework, namely “feature distillation”, to effectively rectify adversarial examples without impacting classification accuracy on benign data. Our framework significantly escalates the defense efficiency with marginal accuracy reduction using a twostep method: First, we maximize malicious features filtering of adversarial input perturbations by developing defensive quantization in frequency domain of JPEG compression or decompression, guided by a semi-analytical method; Second, we suppress the distortions of benign features to restore classification accuracy through a DNN-oriented quantization refine process. Our experimental results show that proposed “feature distillation” can significantly surpass the latest input-transformation based mitigations such as Quilting and TV Minimization in three aspects, including defense efficiency (improve classification accuracy from ∼ 20% to ∼ 90% on adversarial examples), accuracy of benign images after defense (≤ 1% accuracy degradation), and processing time per image (∼ 259× Speedup). Moreover, our solution also can provide the best defense efficiency (∼ 60% accuracy) against the latest BPDA attack with least accuracy reduction (∼ 1%) on benign images among all other input-transformation based defense methods.

Subfields: Artificial Intelligence, Molecular Biology

View Paper: https://www.semanticscholar.org/paper/bfc9195d186558334269bc2b7eb453f3b179a144

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Molecular Biology

Citations in the corpus

Advances in adversarial attacks and defenses in computer vision: A survey (2021, positive): “For instance, JPEG-based compression of input has been studied for removing adversarial perturbations from images [392]–[394].”
Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks (2019, methodology): “…(R&P, rank-2) (Xie et al., 2018) and the rank-3 submission (NIPS-r3), and three recently proposed defense methods (feature distillation (FD) (Liu et al., 2019), purifying perturbations via image compression model (Comdefend) (Jia et al., 2019) and randomized smoothing (RS) (Cohen et al.,…”
Adversarial Examples Are a Natural Consequence of Test Error in Noise (2019, background): “The defense strategies include bitdepth reduction (Guo et al., 2017), JPEG compression (Guo et al., 2017; Dziugaite et al., 2016; Liu et al., 2018; Aydemir et al., 2018; Das et al., 2018; 2017), Pixel Deﬂection (Prakash et al., 2018), total variance minimization (Guo et al., 2017),…”