Abstract:Deep neural networks (DNNs) have transformed several artificial intelligence research areas including computer vision, speech recognition, and natural language processing. However, recent studies demonstrated that DNNs are vulnerable to adversarial manipulations at testing time. Specifically, suppose we have a testing example, whose label can be correctly predicted by a DNN classifier. An attacker can add a small carefully crafted noise to the testing example such that the DNN classifier predicts an incorrect label, where the crafted testing example is called adversarial example. Such attacks are called evasion attacks. Evasion attacks are one of the biggest challenges for deploying DNNs in safety and security critical applications such as self-driving cars. In this work, we develop new DNNs that are robust to state-of-the-art evasion attacks. Our key observation is that adversarial examples are close to the classification boundary. Therefore, we propose region-based classification to be robust to adversarial examples. Specifically, for a benign/adversarial testing example, we ensemble information in a hypercube centered at the example to predict its label. In contrast, traditional classifiers are point-based classification, i.e., given a testing example, the classifier predicts its label based on the testing example alone. Our evaluation results on MNIST and CIFAR-10 datasets demonstrate that our region-based classification can significantly mitigate evasion attacks without sacrificing classification accuracy on benign examples. Specifically, our region-based classification achieves the same classification accuracy on testing benign examples as point-based classification, but our region-based classification is significantly more robust than point-based classification to state-of-the-art evasion attacks.

Sensitivity based robust learning for stacked autoencoder against evasion attack.

Improving robustness of stacked auto-encoder against evasion attack based on weight evenness

Attack As Defense: Characterizing Adversarial Examples Using Robustness.

A Label Noise Robust Stacked Auto-Encoder Algorithm for Inaccurate Supervised Classification Problems

Sensitivity Based Robust Learning with Sampling in Adversarial Environment

Double Backpropagation for Training Autoencoders against Adversarial Attack

Mitigating Evasion Attacks to Deep Neural Networks via Region-based Classification

An Evasion Attack against Stacked Capsule Autoencoder

A Framework for Robust Deep Learning Models Against Adversarial Attacks Based on a Protection Layer Approach

Robust feature learning by stacked autoencoder with maximum correntropy criterion

Research of Stacked Denoising Sparse Autoencoder.

Stochastic Sensitivity Regularized Autoencoder for Robust Feature Learning

Dynamic Defense Approach for Adversarial Robustness in Deep Neural Networks via Stochastic Ensemble Smoothed Model

Improved Adversarial Training Through Adaptive Instance-wise Loss Smoothing

Network Intrusion Detection Method Based on Stacked Denoising Sparse Autoencoder and Extreme Learning Machine

Detecting Malicious URLs Using a Deep Learning Approach Based on Stacked Denoising Autoencoder

Mitigating Gradient-based Adversarial Attacks via Denoising and Compression

Improving Adversarial Robustness of Ensemble Classifiers by Diversified Feature Selection and Stochastic Aggregation

Towards Deep Learning Models Resistant to Adversarial Attacks

Learning Task-aware Robust Deep Learning Systems

Enhancing the Security of Deep Learning Steganography via Adversarial Examples