Abstract:Most cloud providers offer Deep Learning as a Service (DLaaS) for different business, science and engineering domains. However, it is known that deep neural networks (DNNs) are vulnerable to adversarial examples, which can cause well-trained DNN models to misbehave by injecting human-imperceptible perturbations to the query input data. Securing deep learning as a service becomes a critical challenge in mitigating such adversarial input perturbations, and enhancing the robustness of DNNs. In this article, we report two important facts: First, most adversarial perturbations are high frequency signals or are added to high frequency signals. Second, due to Frequency Principle that neural networks overly pay attention to fit the low frequency signals during training, the models could be easily misled by the high frequency signals of adversarial examples. These facts consequently contribute to the vulnerability of DNNs service in the Cloud. We conjecture that the more robust the neural networks are in learning from high frequency signals, the more resilient these neural networks are against adversarial perturbed examples. We propose a novel method for generating high-frequency-enhanced adversarial examples, which is achieved by a high-pass filter in the frequency domain via Fourier Transform. This method enhances the learning ability for high frequency signals and ameliorates to over-fit useless low frequency signals. In order to improve the robustness of DNNs service under such signal frequency attacks, we propose a multi-modal collaborative adversarial training framework, named as MMCAT, which uses the multi-modal information of the input images for cross-modal collaborative training, delivering excellent extension for effectively learning of multi-modal image information. Extensive experiments show that under strong adaptive frequency attacks, the DNNs service trained with the proposed MMCAT method achieve superior performance and robustness over the state-of-the-art adversarial training approaches.

A Hamiltonian Monte Carlo Method for Probabilistic Adversarial Attack and Learning

An Adversarial Attack Via Feature Contributive Regions

Adversarial Training using Contrastive Divergence

CAMA: Class Activation Mapping Disruptive Attack for Deep Neural Networks

Adversarial Image Generation and Training for Deep Convolutional Neural Networks.

Multi-convolution and Adaptive-Stride Based Transferable Adversarial Attacks

Adaptive momentum variance for attention-guided sparse adversarial attacks

Securing Deep Learning As a Service Against Adaptive High Frequency Attacks with MMCAT

Markov Chain Based Efficient Defense Against Adversarial Examples in Computer Vision.

Stronger Adversarial Attack: Using Mini-batch Gradient

Detecting Adversarial Examples on Deep Neural Networks with Mutual Information Neural Estimation

A Novel Multi-Sample Generation Method for Adversarial Attacks

CAMH: Advancing Model Hijacking Attack in Machine Learning

Efficient Adversarial Attack Based on Moment Estimation and Lookahead Gradient

Adaptive Multi-scale Degradation-Based Attack for Boosting the Adversarial Transferability

On-manifold Adversarial Attack Based on Latent Space Substitute Model

A CMA-ES-Based Adversarial Attack on Black-Box Deep Neural Networks

Probabilistic Categorical Adversarial Attack & Adversarial Training

ADSAttack: an Adversarial Attack Algorithm Via Searching Adversarial Distribution in Latent Space

Discovering Adversarial Examples with Momentum.

Are Adversarial Perturbations a Showstopper for ML-Based CAD? A Case Study on CNN-Based Lithographic Hotspot Detection