Abstract:Deep neural networks (DNNs) are widely used to handle many difficult tasks, such as image classification and malware detection, and achieve outstanding performance. However, recent studies on adversarial examples, which have maliciously undetectable perturbations added to their original samples that are indistinguishable by human eyes but mislead the machine learning approaches, show that machine learning models are vulnerable to security attacks. Though various adversarial retraining techniques have been developed in the past few years, none of them is scalable. In this paper, we propose a new iterative adversarial retraining approach to robustify the model and to reduce the effectiveness of adversarial inputs on DNN models. The proposed method retrains the model with both Gaussian noise augmentation and adversarial generation techniques for better generalization. Furthermore, the ensemble model is utilized during the testing phase in order to increase the robust test accuracy. The results from our extensive experiments demonstrate that the proposed approach increases the robustness of the DNN model against various adversarial attacks, specifically, fast gradient sign attack, Carlini and Wagner (C&W) attack, Projected Gradient Descent (PGD) attack, and DeepFool attack. To be precise, the robust classifier obtained by our proposed approach can maintain a performance accuracy of 99% on average on the standard test set. Moreover, we empirically evaluate the runtime of two of the most effective adversarial attacks, i.e., C&W attack and BIM attack, to find that the C&W attack can utilize GPU for faster adversarial example generation than the BIM attack can. For this reason, we further develop a parallel implementation of the proposed approach. This parallel implementation makes the proposed approach scalable for large datasets and complex models.

CAMA: Class Activation Mapping Disruptive Attack for Deep Neural Networks

A CMA-ES-Based Adversarial Attack on Black-Box Deep Neural Networks

Saliency Map-Based Local White-Box Adversarial Attack Against Deep Neural Networks

A Universal Defense Strategy Against Adversarial Attacks Based on Attention-Guided

Sample-analysis Based Adversarial Attack with Saliency Map

CamoNet: A Target Camouflage Network for Remote Sensing Images Based on Adversarial Attack

CDTA: A Cross-Domain Transfer-Based Attack with Contrastive Learning.

Practical Black-Box Attacks against Deep Learning Systems using Adversarial Examples

Learning Coated Adversarial Camouflages for Object Detectors

A CMA‐ES‐Based Adversarial Attack Against Black‐Box Object Detectors

Adaptive Image Adversarial Example Detection Based on Class Activation Mapping.

CAMH: Advancing Model Hijacking Attack in Machine Learning

GGCAD: A Novel Method of Adversarial Detection by Guided Grad-CAM

A Universal Targeted Attack Method against Image Classification

Detecting Adversarial Examples on Deep Neural Networks with Mutual Information Neural Estimation

Mitigating Adversarial Attacks for Deep Neural Networks by Input Deformation and Augmentation

Adversarial Camouflage: Hiding Physical-World Attacks with Natural Styles

WiCAM: Imperceptible Adversarial Attack on Deep Learning Based WiFi Sensing.

Secure Machine Learning Against Adversarial Samples at Test Time

Enhance Stealthiness and Transferability of Adversarial Attacks with Class Activation Mapping Ensemble Attack

Undetectable Attack to Deep Neural Networks Without Using Model Parameters.