Abstract:Recent advances in deep neural network (DNN) techniques have increased the importance of security and robustness of algorithms where DNNs are applied. However, several studies have demonstrated that neural networks are vulnerable to adversarial examples, which are generated by adding crafted adversarial noises to the input images. Because the adversarial noises are typically imperceptible to the human eye, it is difficult to defend DNNs. One method of defense is the detection of adversarial examples by analyzing characteristics of input images. Recent studies have used the hidden layer outputs of the target classifier to improve the robustness but need to access the target classifier. Moreover, there is no post-processing step for the detected adversarial examples. They simply discard the detected adversarial images. To resolve this problem, we propose a novel detection-based method, which predicts the adversarial noise and detects the adversarial example based on the predicted noise without any target classification information. We first generated adversarial examples and adversarial noises, which can be obtained from the residual between the original and adversarial example images. Subsequently, we trained the proposed adversarial noise predictor to estimate the adversarial noise image and trained the adversarial detector using the input images and the predicted noises. The proposed framework has the advantage that it is agnostic to the input image modality. Moreover, the predicted noises can be used to reconstruct the detected adversarial examples as the non-adversarial images instead of discarding the detected adversarial examples. We tested our proposed method against the fast gradient sign method (FGSM), basic iterative method (BIM), projected gradient descent (PGD), Deepfool, and Carlini & Wagner adversarial attack methods on the CIFAR-10 and CIFAR-100 datasets provided by the Canadian Institute for Advanced Research (CIFAR). Our method demonstrated significant improvements in detection accuracy when compared to the state-of-the-art methods and resolved the wastage problem of the detected adversarial examples. The proposed method agnostic to the input image modality demonstrated that the noise predictor successfully captured noise in the Fourier domain and improved the performance of the detection task. Moreover, we resolved the post-processing problem of the detected adversarial examples with the reconstruction process using the predicted noise.

Toward Universal Detection of Adversarial Examples Via Pseudorandom Classifiers

Attack As Detection: Using Adversarial Attack Methods to Detect Abnormal Examples.

Towards Robust Detection of Adversarial Examples

A Universal Defense Strategy Against Adversarial Attacks Based on Attention-Guided

Adversarial Example Games

Intriguing Properties of Adversarial Examples

Neural Fingerprints for Adversarial Attack Detection

Adversarial example detection by predicting adversarial noise in the frequency domain

Detecting Adversarial Examples

Perception-in-the-Loop Adversarial Examples

Are You Confident That You Have Successfully Generated Adversarial Examples?

On the (Statistical) Detection of Adversarial Examples

Detection of Backdoors in Trained Classifiers Without Access to the Training Set

Beating Attackers At Their Own Games: Adversarial Example Detection Using Adversarial Gradient Directions

ADS-detector: An attention-based dual stream adversarial example detection method

Luring of transferable adversarial perturbations in the black-box paradigm

Attack Selectivity Of Adversarial Examples In Remote Sensing Image Scene Classification

Adversarial examples in the physical world

Model-agnostic Adversarial Example Detection via High-Frequency Amplification

PPD: Permutation Phase Defense Against Adversarial Examples in Deep Learning

Adversarial Examples Detection Beyond Image Space.