Abstract:Deep neural networks (DNNs) are widely used to handle many difficult tasks, such as image classification and malware detection, and achieve outstanding performance. However, recent studies on adversarial examples, which have maliciously undetectable perturbations added to their original samples that are indistinguishable by human eyes but mislead the machine learning approaches, show that machine learning models are vulnerable to security attacks. Though various adversarial retraining techniques have been developed in the past few years, none of them is scalable. In this paper, we propose a new iterative adversarial retraining approach to robustify the model and to reduce the effectiveness of adversarial inputs on DNN models. The proposed method retrains the model with both Gaussian noise augmentation and adversarial generation techniques for better generalization. Furthermore, the ensemble model is utilized during the testing phase in order to increase the robust test accuracy. The results from our extensive experiments demonstrate that the proposed approach increases the robustness of the DNN model against various adversarial attacks, specifically, fast gradient sign attack, Carlini and Wagner (C&W) attack, Projected Gradient Descent (PGD) attack, and DeepFool attack. To be precise, the robust classifier obtained by our proposed approach can maintain a performance accuracy of 99% on average on the standard test set. Moreover, we empirically evaluate the runtime of two of the most effective adversarial attacks, i.e., C&W attack and BIM attack, to find that the C&W attack can utilize GPU for faster adversarial example generation than the BIM attack can. For this reason, we further develop a parallel implementation of the proposed approach. This parallel implementation makes the proposed approach scalable for large datasets and complex models.

EEJE: Two-Step Input Transformation for Robust DNN Against Adversarial Examples

Attack As Defense: Characterizing Adversarial Examples Using Robustness.

Towards Robust DNNs: an Taylor Expansion-Based Method for Generating Powerful Adversarial Examples.

Dynamic and Diverse Transformations for Defending Against Adversarial Examples

Learning Defense Transformations for Counterattacking Adversarial Examples

A Universal Defense Strategy Against Adversarial Attacks Based on Attention-Guided

Efficient Two-Step Adversarial Defense for Deep Neural Networks

An adversarial defense algorithm based on robust U-net

EagleEye: Attack-Agnostic Defense against Adversarial Inputs (Technical Report)

Learning Defense Transformers for Counterattacking Adversarial Examples

Mitigating Adversarial Attacks for Deep Neural Networks by Input Deformation and Augmentation

Complete Defense Framework to Protect Deep Neural Networks Against Adversarial Examples

Image Transformation can make Neural Networks more robust against Adversarial Examples

Admix: Enhancing the Transferability of Adversarial Attacks

Detecting Adversarial Examples Through Image Transformation

Secure Machine Learning Against Adversarial Samples at Test Time

DeepDefense: Training Deep Neural Networks with Improved Robustness.

Improving robustness of deep neural networks via large-difference transformation

EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examples

Adversarial Examples: Opportunities and Challenges

Towards Understanding and Harnessing the Effect of Image Transformation in Adversarial Detection