Abstract:Deep neural networks (DNNs) are widely used to handle many difficult tasks, such as image classification and malware detection, and achieve outstanding performance. However, recent studies on adversarial examples, which have maliciously undetectable perturbations added to their original samples that are indistinguishable by human eyes but mislead the machine learning approaches, show that machine learning models are vulnerable to security attacks. Though various adversarial retraining techniques have been developed in the past few years, none of them is scalable. In this paper, we propose a new iterative adversarial retraining approach to robustify the model and to reduce the effectiveness of adversarial inputs on DNN models. The proposed method retrains the model with both Gaussian noise augmentation and adversarial generation techniques for better generalization. Furthermore, the ensemble model is utilized during the testing phase in order to increase the robust test accuracy. The results from our extensive experiments demonstrate that the proposed approach increases the robustness of the DNN model against various adversarial attacks, specifically, fast gradient sign attack, Carlini and Wagner (C&W) attack, Projected Gradient Descent (PGD) attack, and DeepFool attack. To be precise, the robust classifier obtained by our proposed approach can maintain a performance accuracy of 99% on average on the standard test set. Moreover, we empirically evaluate the runtime of two of the most effective adversarial attacks, i.e., C&W attack and BIM attack, to find that the C&W attack can utilize GPU for faster adversarial example generation than the BIM attack can. For this reason, we further develop a parallel implementation of the proposed approach. This parallel implementation makes the proposed approach scalable for large datasets and complex models.

Dropout in Testing Phase Makes Adversarial Samples Generation Difficult

Defensive Dropout for Hardening Deep Neural Networks under Adversarial Attacks

AdvDrop: Adversarial Attack to DNNs by Dropping Information

Minimizing Adversarial Training Samples for Robust Image Classifiers: Analysis and Adversarial Example Generator Design

Are You Confident That You Have Successfully Generated Adversarial Examples?

Adv-BDPM: Adversarial Attack Based on Boundary Diffusion Probability Model.

Exploiting epistemic uncertainty of the deep learning models to generate adversarial samples

Adversarial Sample Detection for Deep Neural Network through Model Mutation Testing

Secure Machine Learning Against Adversarial Samples at Test Time

Improving Model Robustness Against Adversarial Examples with Redundant Fully Connected Layer.

Rethinking the Usage of Batch Normalization and Dropout in the Training of Deep Neural Networks

Data Dropout: Optimizing Training Data for Convolutional Neural Networks

Adaptive Sparse Dropout: Learning the Certainty and Uncertainty in Deep Neural Networks

Single-step Adversarial training with Dropout Scheduling

NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks

Continuous Dropout

Dropping Pixels for Adversarial Robustness

Block-term Dropout for Robust Adversarial Defense

ROBUSTNESS OF DEEP NEURAL NETWORKS TO ADVERSARIAL EXAMPLES

Robust Machine Learning Against Adversarial Samples at Test Time