Deflecting Adversarial Attacks with Pixel Deflection

By Aaditya (Adi) Prakash, Nick Moran, Solomon Garber, Antonella DiLillo, James A. Storer. 2018

334 citations recorded by the source corpus.

CNNs are poised to become integral parts of many critical systems. Despite their robustness to natural variations, image pixel values can be manipulated, via small, carefully crafted, imperceptible perturbations, to cause a model to misclassify images. We present an algorithm to process an image so that classification accuracy is significantly preserved in the presence of such adversarial manipulations. Image classifiers tend to be robust to natural noise, and adversarial attacks tend to be agnostic to object location. These observations motivate our strategy, which leverages model robustness to defend against adversarial perturbations by forcing the image to match natural image statistics. Our algorithm locally corrupts the image by redistributing pixel values via a process we term pixel deflection. A subsequent wavelet-based denoising operation softens this corruption, as well as some of the adversarial changes. We demonstrate experimentally that the combination of these techniques enables the effective recovery of the true class, against a variety of robust attacks. Our results compare favorably with current state-of-the-art defenses, without requiring retraining or modifying the CNN.

Subfields: Artificial Intelligence, Molecular Biology

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Molecular Biology

Citations in the corpus

Towards the first adversarially robust neural network model on MNIST (2018, background): “• Stochasticity: Certain inputs or hidden activations are shuffled or randomized (Prakash et al., 2018; Dhillon et al., 2018; Xie et al., 2018).”
On the Robustness of the CVPR 2018 White-Box Adversarial Example Defenses (2018, background): “Two defenses that appear at CVPR 2018 attempt to address this problem: “Deflecting Adversarial Attacks with Pixel Deflection” [6] and “Defense against Adversarial Attacks Using High-Level Representation Guided Denoiser” [4].”
Adversarial Examples Are a Natural Consequence of Test Error in Noise (2019, background): “…2017), JPEG compression (Guo et al., 2017; Dziugaite et al., 2016; Liu et al., 2018; Aydemir et al., 2018; Das et al., 2018; 2017), Pixel Deﬂection (Prakash et al., 2018), total variance minimization (Guo et al., 2017), respresentation-guided denoising (Liao et al., 2018), and random resizing and…”
Bit-Flip Attack: Crushing Neural Network With Progressive Bit Search (2019, background): “Both attack and defense of adversarial example on the input end of DNN has been heavily investigated in the past couple of years [26, 11, 36] and still be in progress [16, 29, 22].”
Towards Adversarially Robust Object Detection (2019, background): “Many efforts have been devoted to improving the robustness of classifiers [35, 34, 56, 17, 25, 44, 46, 38, 30].”
Robust Perception through Analysis by Synthesis (2018, background): “• Stochasticity: Certain inputs or hidden activations are shufﬂed or randomized [Prakash et al., 2018, Dhillon et al., 2018, Xie et al., 2018].”
NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks (2019, background): “T RANS ) (Guo et al., 2018), pixel deﬂection (Prakash et al., 2018), and guided denoiser (Liao et al., 2018).”
Defense Against Adversarial Attacks Using Feature Scattering-based Adversarial Training (2019, background): “In the mean time, many efforts have been devoted to defending against adversarial examples [38, 37, 63, 25, 33, 50, 53, 46, 35].”
Smooth Adversarial Training (2020, methodology): “Many efforts have been devoted to improving network resilience against adversarial attacks [13, 28, 4, 46, 22, 29, 26].”
Adversarially Robust Distillation (2019, methodology): “Still other methods, such as JPEG compression, pixel deflection, and image superresolution, are modelagnostic and minimize the effects of adversarial examples by transforming inputs (Dziugaite, Ghahramani, and Roy 2016; Prakash et al. 2018; Mustafa et al. 2019).”
A Survey of Black-Box Adversarial Attacks on Computer Vision Models (2019, background): “[56] show that adversarial attacks tend to add perturbations in the entire plane of the image, disregarding the location of the object.”
Improving Transferability of Adversarial Examples With Input Diversity (2018, background): “[26] proposed a framework which combines pixel deflection with soft wavelet denoising to defend against adversarial examples.”
Generative Adversarial Perturbations (2017, background): “While our focus is on efficient attacks, we refer the reader to [33, 57, 19, 47, 32, 50, 48, 54, 3, 13, 44, 16, 55, 45, 42, 56] for recent works on defense.”
On the Robustness of Semantic Segmentation Models to Adversarial Attacks (2017, background): “Other adversarial defenses based on detecting the perturbation in the input [64, 39, 34, 88, 81] or pre-processing the input [41, 56, 86, 76] have also all been subverted [5, 4, 17, 44, 16, 85].”
On Adaptive Attacks to Adversarial Example Defenses (2020, background): “There have been a number of defenses proposed with a similar randomized pre-processing step (Prakash et al., 2018; Guo et al., 2018) which have been broken by adaptive attacks (Athalye et al.”
Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses (2019, background): “To mitigate this, large efforts have been devoted to adversarial defense [7, 13, 36, 43, 44, 49, 52], via adversarial training [32, 37, 56, 62], input transformation [11, 21] or randomization [34, 61].”