From Attack to Defense: Insights into Deep Learning Security Measures in Black-Box Settings

Firuz Juraev,Mohammed Abuhamad,Eric Chan-Tin,George K. Thiruvathukal,Tamer Abuhmed

2024-05-03

Abstract:Deep Learning (DL) is rapidly maturing to the point that it can be used in safety- and security-crucial applications. However, adversarial samples, which are undetectable to the human eye, pose a serious threat that can cause the model to misbehave and compromise the performance of such applications. Addressing the robustness of DL models has become crucial to understanding and defending against adversarial attacks. In this study, we perform comprehensive experiments to examine the effect of adversarial attacks and defenses on various model architectures across well-known datasets. Our research focuses on black-box attacks such as SimBA, HopSkipJump, MGAAttack, and boundary attacks, as well as preprocessor-based defensive mechanisms, including bits squeezing, median smoothing, and JPEG filter. Experimenting with various models, our results demonstrate that the level of noise needed for the attack increases as the number of layers increases. Moreover, the attack success rate decreases as the number of layers increases. This indicates that model complexity and robustness have a significant relationship. Investigating the diversity and robustness relationship, our experiments with diverse models show that having a large number of parameters does not imply higher robustness. Our experiments extend to show the effects of the training dataset on model robustness. Using various datasets such as ImageNet-1000, CIFAR-100, and CIFAR-10 are used to evaluate the black-box attacks. Considering the multiple dimensions of our analysis, e.g., model complexity and training dataset, we examined the behavior of black-box attacks when models apply defenses. Our results show that applying defense strategies can significantly reduce attack effectiveness. This research provides in-depth analysis and insight into the robustness of DL models against various attacks, and defenses.

Cryptography and Security,Artificial Intelligence,Computer Vision and Pattern Recognition,Machine Learning

What problem does this paper attempt to address?

The problem that this paper attempts to solve is the robustness of deep - learning models when facing adversarial sample attacks. Specifically, researchers are concerned with how to evaluate and improve the defense capabilities of deep - learning models in a black - box attack environment. A black - box attack is an attack method in which an attacker misleads the model to output incorrect results by inputting specific adversarial samples without understanding the internal structure of the model. This type of attack poses a serious threat to applications where security is crucial, such as self - driving vehicles, surveillance systems, drones, and robots.

To meet this challenge, the paper conducted comprehensive experiments aimed at examining the performance of different model architectures when facing multiple black - box attacks (such as SimBA, HopSkipJump, MGAAttack, and Boundary Attack), and analyzed the effectiveness of pre - processing - type defense mechanisms (such as bit - compression, median - smoothing, and JPEG filtering). In addition, the research also explored the impact of the training data set on the robustness of the model.

The main research questions include:
1. How does model complexity (number of layers and number of parameters) affect the success rate of black - box attacks?
2. Will the design choices of the model affect its robustness against adversarial attacks?
3. When implementing defense strategies, how does the model handle adversarial samples?

Through these studies, the authors hope to provide in - depth analysis and insights into the robustness of deep - learning models when facing adversarial attacks and the effectiveness of defense strategies.