LanCe: A Comprehensive and Lightweight CNN Defense Methodology against Physical Adversarial Attacks on Embedded Multimedia Applications

Zirui Xu,Fuxun Yu,Xiang Chen

DOI: https://doi.org/10.48550/arXiv.1910.08536

2019-10-18

Abstract:Recently, adversarial attacks can be applied to the physical world, causing practical issues to various Convolutional Neural Networks (CNNs) powered applications. Most existing physical adversarial attack defense works only focus on eliminating explicit perturbation patterns from inputs, ignoring interpretation to CNN's intrinsic vulnerability. Therefore, they lack the expected versatility to different attacks and thereby depend on considerable data processing costs. In this paper, we propose LanCe -- a comprehensive and lightweight CNN defense methodology against different physical adversarial attacks. By interpreting CNN's vulnerability, we find that non-semantic adversarial perturbations can activate CNN with significantly abnormal activations and even overwhelm other semantic input patterns' activations. We improve the CNN recognition process by adding a self-verification stage to detect the potential adversarial input with only one CNN inference cost. Based on the detection result, we further propose a data recovery methodology to defend the physical adversarial attacks. We apply such defense methodology into both image and audio CNN recognition scenarios and analyze the computational complexity for each scenario, respectively. Experiments show that our methodology can achieve an average 91% successful rate for attack detection and 89% accuracy recovery. Moreover, it is at most 3x faster compared with the state-of-the-art defense methods, making it feasible to resource-constrained embedded systems, such as mobile devices.

Computer Vision and Pattern Recognition

What problem does this paper attempt to address?

The problem that this paper attempts to solve is how to defend against the influence of adversarial attacks in the physical world on convolutional neural networks (CNNs) in embedded multimedia applications. Specifically, the paper points out that most of the existing physical adversarial attack defense methods only focus on eliminating the explicit perturbation patterns in the input data, while ignoring the explanation of the inherent vulnerability of CNNs. This results in the lack of generality of these methods in dealing with different attacks and their dependence on a large amount of data processing costs. Therefore, the paper proposes a comprehensive and lightweight CNN defense method - LanCe - to combat different physical adversarial attacks. By explaining the vulnerability of CNNs, the author finds that non - semantic adversarial perturbations can significantly activate CNNs and even overwhelm the activation of other semantic input patterns. Based on this finding, LanCe detects potential adversarial inputs by adding a self - verification stage during the CNN recognition process, and at the same time proposes a data recovery method to defend against physical adversarial attacks. This method can not only effectively detect attacks, but also recover the attacked data, while maintaining a low computational complexity, and is suitable for resource - constrained embedded systems, such as mobile devices.