Abstract:Typical Deep Neural Networks (DNN) are susceptible to adversarial attacks that add malicious perturbations to input to mislead the DNN model. Most of the state-of-theart countermeasures concentrate on the defensive distillation or parameter re-training, which require prior knowledge of the target DNN and/or the attacking methods and hence greatly limit their generality and usability. In this paper, we propose to defend against adversarial attacks by utilizing the input deformation and augmentation techniques that are currently widely utilized to enlarge the dataset during DNN's training phase. This is based on the observation that certain input deformation and augmentation methods will have little or no impact on DNN model's accuracy, but the adversarial attacks will fail when the maliciously induced perturbations are randomly deformed. We also use the ensemble of decisions to further improve DNN model's accuracy and the effectiveness of defending various attacks. Our proposed mitigation method is model independent (i.e. it does not require additional training, parameter finetuning, or any structure modifications of the target DNN model) and attack independent (i.e., it does not require any knowledge of the adversarial attacks). So it has excellent generality and usability. We conduct experiments on standard CIFAR-10 dataset and three representative adversarial attacks: Fast Gradient Sign Method, Carlini and Wagner, and Jacobian-based Saliency Map Attack. Results show that the average success rate of the attacks can be reduced from 96.5% to 28.7% while the DNN model accuracy is improved by about 2%.

Evolving Hyperparameters For Training Deep Neural Networks Against Adversarial Attacks

Evolution Attack On Neural Networks

Towards Deep Learning Models Resistant to Adversarial Attacks

Improving Model Robustness Against Adversarial Examples with Redundant Fully Connected Layer.

Mitigating Adversarial Attacks for Deep Neural Networks by Input Deformation and Augmentation

Learning More Robust Features with Adversarial Training

Attack As Defense: Characterizing Adversarial Examples Using Robustness.

DeepDefense: Training Deep Neural Networks with Improved Robustness.

Towards Robust Training of Neural Networks by Regularizing Adversarial Gradients

Evolving Robust Neural Architectures to Defend from Adversarial Attacks

Training Robust Deep Neural Networks via Adversarial Noise Propagation

MetaAdvDet: Towards Robust Detection of Evolving Adversarial Attacks

An efficient adversarial example generation algorithm based on an accelerated gradient iterative fast gradient

Deep Defense: Training DNNs with Improved Adversarial Robustness

Art-Attack: Black-Box Adversarial Attack via Evolutionary Art

Minimizing Adversarial Training Samples for Robust Image Classifiers: Analysis and Adversarial Example Generator Design

A Direct Approach to Robust Deep Learning Using Adversarial Networks

Efficient Two-Step Adversarial Defense for Deep Neural Networks

Designing defensive techniques to handle adversarial attack on deep learning based model

Generating Minimalist Adversarial Perturbations to Test Object-Detection Models: An Adaptive Multi-Metric Evolutionary Search Approach