Countering Adversarial Images using Input Transformations

By Chuan Guo, Mayank Rana, Moustapha Cissé, L. V. D. van der Maaten. 2018

1,638 citations recorded by the source corpus.

This paper investigates strategies that defend against adversarial-example attacks on image-classification systems by transforming the inputs before feeding them to the system. Specifically, we study applying image transformations such as bit-depth reduction, JPEG compression, total variance minimization, and image quilting before feeding the image to a convolutional network classifier. Our experiments on ImageNet show that total variance minimization and image quilting are very effective defenses in practice, in particular, when the network is trained on transformed images. The strength of those defenses lies in their non-differentiable nature and their inherent randomness, which makes it difficult for an adversary to circumvent the defenses. Our best defense eliminates 60% of strong gray-box and 90% of strong black-box attacks by a variety of major attack methods

Subfields: Artificial Intelligence, Molecular Biology, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Molecular Biology

In Safety, Robustness & Interpretability

Citations in the corpus

Adversarial Example Games (2020, methodology): “On the other hand obfuscation methods rely on masking the input gradient needed by an attacker to construct adversarial examples [60, 10, 32, 18].”
Feature Purification: How Adversarial Training Performs Robust Deep Learning (2020, background): “Since the original discovery of “adversarial examples”, a large body of works have been done emphasizing how to improve the robustness of the deep learning models against such perturbations [44, 63, 64, 83, 89].”
Certified Robustness to Adversarial Examples with Differential Privacy (2018, methodology): “These defenses include model distialltion [44], automated detection of adversarial examples [22], [41], [40], application of different input transformations [27], [10], randomization [21], [11], and application of generative models [49], [25], [60].”
Adversarial Training for Free! (2019, background): “To put things further in perspective, Uesato et al. [2018] broke three defenses for (cid:15) = 2 non-targeted attacks on ImageNet [Guo et al., 2017, Liao et al., 2018, Xie et al., 2017], degrading their performance below 1%.”
Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples (2018, background): “The authors do not succeed in white-box attacks, crediting lack of access to test-time randomness as “particularly crucial in developing strong defenses” (Guo et al., 2018).”
Theoretical evidence for adversarial robustness through randomization: the case of the Exponential family (2019, background): “Since the seminal work of [42] exhibiting this intriguing phenomenon in the context of deep learning, a wealth of results have been published on designing attacks [18, 34, 32, 23, 6, 31] and defenses [18, 35, 20, 29, 39, 27]), or on trying to understand the very nature of this phenomenon [17, 40, 15”
Towards Robust Neural Networks via Random Self-ensemble (2017, background): “ model that is robust to the rst order attacks, but this approach does not work very well on more dicult datasets such as CIFAR-10. It is worth mentioning that there are many defense algorithms (r.f.[3,19,13,8,36,27,25]) against white box attacks in literature. Unfortunately, as [2,1] pointed out, t”
Towards the first adversarially robust neural network model on MNIST (2018, background): “• Preprocessing: Inputs or hidden activations are quantized, projected into a different representation or are otherwise preprocessed (Buckman et al., 2018; Guo et al., 2018; Kabilan et al., 2018).”
Lipschitz-Margin Training: Scalable Certification of Perturbation Invariance for Deep Neural Networks (2018, background): “Input transformations and detections [32, 11] are some other defense strategies, although we can bypass them [5].”
A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks (2018, methodology): “We used the library from FaceBook [11] for generating adversarial samples.”
Motivating the Rules of the Game for Adversarial Example Research (2018, background): “Because many perturbation defense papers we reviewed apply defenses that increase error on the test set [4, 7, 9, 14, 20, 23, 36, 42, 45, 104, 105], these methods are actually more vulnerable to the test set attack than an undefended model.”
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey (2018, background): “[82] for mitigating the effectiveness of adversarial images.”
ConvNets and ImageNet Beyond Accuracy: Explanations, Bias Detection, Adversarial Examples and Model Criticism (2017, background): “Several studies have subsequently analyzed the phenomenon [11, 40, 12, 12] and various approaches have been proposed to improve the robustness of neural networks [34, 8, 44, 46, 19].”
Adversarial Risk and the Dangers of Evaluating Against Weak Attacks (2018, methodology): “Original evaluation : Guo et al. (2017) argue that non-differentiability combined with stochasticity can provide a useful defense against adversarial examples.”
Are adversarial examples inevitable? (2018, methodology): “…et al., 2018), detection using local intrinsic dimensionality (Ma et al., 2018), input transformations such as compression and image quilting (Guo et al., 2017), stochastic activation pruning (Dhillon et al., 2018), adding randomization at inference time (Xie et al., 2017), enhancing the…”
Adversarial Examples Are a Natural Consequence of Test Error in Noise (2019, background): “The defense strategies include bitdepth reduction (Guo et al., 2017), JPEG compression (Guo et al., 2017; Dziugaite et al., 2016; Liu et al., 2018; Aydemir et al., 2018; Das et al., 2018; 2017), Pixel Deﬂection (Prakash et al., 2018), total variance minimization (Guo et al., 2017),…”
Semantic Adversarial Examples (2018, methodology): “This property is used by several defense methods to make deep learning models robust against small perturbations [7, 8] or to map the perturbed image back into the space of natural images by applying preprocessing ﬁlters [9,10].”
Fast is better than free: Revisiting adversarial training (2020, methodology): “Adversarial defenses span a wide range of methods, such as preprocessing techniques (Guo et al., 2017; Buckman et al., 2018; Song et al., 2017), detection algorithms (Metzen et al., 2017; Feinman et al., 2017; Carlini & Wagner, 2017a), veriﬁcation and provable defenses (Katz et al., 2017; Sinha et…”