Abstract:Some recent studies have demonstrated that the deep neural network (DNN) is vulnerable to adversarial examples, which contain some subtle and human-imperceptible perturbations. Although numerous countermeasures have been proposed and play a significant role, most of them all have some flaws and are only effective for certain types of adversarial examples. In the paper, we present a novel and universal countermeasure to recover multiple types of adversarial examples to benign examples before they are fed into the deep neural network. The idea is to model the mapping between adversarial examples and benign examples using a generative adversarial network (GAN). Its GAN architecture consists of a generator based on UNET, a discriminator based on ACGAN, and a newly added third-party classifier. The UNET can enhance the capacity of the generator to recover adversarial examples to benign examples. The loss function makes full use of the advantages of ACGAN and WGAN-GP to ensure the stability of the training process and accelerate its convergence. Besides, a classification loss and a perceptual loss, all from the third-party classifier, are employed to improve further the generator's capacity to eliminate adversarial perturbations. Experiments are conducted on the MNIST, CIFAR10, and IMAGENET datasets. First, we perform ablation experiments to prove the proposed countermeasure's validity. Then, we defend against seven types of state-of-the-art adversarial examples on four deep neural networks and compare them with six existing countermeasures. Finally, the experimental results demonstrate that the proposed countermeasure is universal and has a more excellent performance than other countermeasures. The experimental code is available at https://github.com/Afreadyang/IAED-GAN.

GAN-based Classifier Protection Against Adversarial Attacks

Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models

A GAN-Based Defense Framework Against Model Inversion Attacks.

GanDef: A GAN based Adversarial Training Defense for Neural Network Classifier

An Adversarial Sample Defense Method Based on Multi-Scale GAN

Classifiers Protected Against Attacks by Fusion of Multi-Branch Perturbed GAN

An adversarial defense algorithm based on robust U-net

A Direct Approach to Robust Deep Learning Using Adversarial Networks

Defense Against Adversarial Attacks Using Image Label and Pixel Guided Sparse Denoiser

A Universal Defense Strategy Against Adversarial Attacks Based on Attention-Guided

HAD-GAN: A Human-perception Auxiliary Defense GAN to Defend Adversarial Examples

Detecting Adversarial Image Examples in Deep Neural Networks with Adaptive Noise Reduction

APE-GAN: Adversarial Perturbation Elimination with GAN.

LD-GAN: Learning perturbations for adversarial defense based on GAN structure

GRIP-GAN: an Attack-Free Defense Through General Robust Inverse Perturbation

Tensor-Based GAN to Defense Adversarial Attacks for Cyber-Physical-Social System

Enhanced DNNs for malware classification with GAN-based adversarial training

A novel and universal GAN-based countermeasure to recover adversarial examples to benign examples

Defense Against Adversarial Attacks Using High-Level Representation Guided Denoiser

GAN Generate Adversarial Examples to Fool Deep Networks.

Designing defensive techniques to handle adversarial attack on deep learning based model