Abstract:Some recent studies have demonstrated that the deep neural network (DNN) is vulnerable to adversarial examples, which contain some subtle and human-imperceptible perturbations. Although numerous countermeasures have been proposed and play a significant role, most of them all have some flaws and are only effective for certain types of adversarial examples. In the paper, we present a novel and universal countermeasure to recover multiple types of adversarial examples to benign examples before they are fed into the deep neural network. The idea is to model the mapping between adversarial examples and benign examples using a generative adversarial network (GAN). Its GAN architecture consists of a generator based on UNET, a discriminator based on ACGAN, and a newly added third-party classifier. The UNET can enhance the capacity of the generator to recover adversarial examples to benign examples. The loss function makes full use of the advantages of ACGAN and WGAN-GP to ensure the stability of the training process and accelerate its convergence. Besides, a classification loss and a perceptual loss, all from the third-party classifier, are employed to improve further the generator's capacity to eliminate adversarial perturbations. Experiments are conducted on the MNIST, CIFAR10, and IMAGENET datasets. First, we perform ablation experiments to prove the proposed countermeasure's validity. Then, we defend against seven types of state-of-the-art adversarial examples on four deep neural networks and compare them with six existing countermeasures. Finally, the experimental results demonstrate that the proposed countermeasure is universal and has a more excellent performance than other countermeasures. The experimental code is available at https://github.com/Afreadyang/IAED-GAN.

APE-GAN: Adversarial Perturbation Elimination with GAN.

NetGuard: Protecting Commercial Web APIs from Model Inversion Attacks Using GAN-generated Fake Samples

A GAN-Based Defense Framework Against Model Inversion Attacks.

No One Can Escape: A General Approach to Detect Tampered and Generated Image

GRIP-GAN: an Attack-Free Defense Through General Robust Inverse Perturbation

GanDef: A GAN based Adversarial Training Defense for Neural Network Classifier

LD-GAN: Learning perturbations for adversarial defense based on GAN structure

A novel and universal GAN-based countermeasure to recover adversarial examples to benign examples

Generating Adversarial Examples with Adversarial Networks

HAD-GAN: A Human-perception Auxiliary Defense GAN to Defend Adversarial Examples

An Adversarial Sample Defense Method Based on Multi-Scale GAN

Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models

Direct Adversarial Training for GANs

GAN-based Classifier Protection Against Adversarial Attacks

Generative Adversarial Trainer: Defense to Adversarial Perturbations with GAN

AT-GAN: An Adversarial Generator Model for Non-constrained Adversarial Examples

GAN Generate Adversarial Examples to Fool Deep Networks.

A Direct Approach to Robust Deep Learning Using Adversarial Networks

Evaluation of GAN-Based Model for Adversarial Training

Rob-GAN: Generator, Discriminator, and Adversarial Attacker

Classifiers Protected Against Attacks by Fusion of Multi-Branch Perturbed GAN