Abstract:Convolutional neural networks (CNNs) have been extensively used in numerous remote sensing image detection tasks owing to their exceptional performance. Nevertheless, CNNs are often vulnerable to adversarial examples, limiting the uses in different safety-critical scenarios. Recently, how to efficiently detect adversarial examples and improve the robustness of CNNs has drawn considerable focus. The existing adversarial example detection methods require modifying CNNs, which not only affects the model performance but also greatly enhances training cost. With the purpose of solving these problems, this study proposes a detection algorithm for adversarial examples that does not need modification of the CNN models and can simultaneously retain the classification accuracy of normal examples. Specifically, we design a method to detect adversarial examples using frequency domain reconstruction. After converting the input adversarial examples into the frequency domain by Fourier transform, the adversarial disturbance from adversarial attacks can be eliminated by modifying the frequency of the example. The inverse Fourier transform is then used to maximize the recovery of the original example. Firstly, we train a CNN to reconstruct input examples. Then, we insert Fourier transform, convolution operation, and inverse Fourier transform into the features of the input examples to automatically filter out adversarial frequencies. We refer to our proposed method as FDR (frequency domain reconstruction), which removes adversarial interference by converting input samples into frequency and reconstructing them back into the spatial domain to restore the image. In addition, we also introduce gradient masking into the proposed FDR method to enhance the detection accuracy of the model for complex adversarial examples. We conduct extensive experiments on five mainstream adversarial attacks on three benchmark datasets, and the experimental results show that FDR can outperform state-of-the-art solutions in detecting adversarial examples. Additionally, FDR does not require any modifications to the detector and can be integrated with other adversarial example detection methods to be installed in sensing devices to ensure detection safety.

Detecting Adversarial Examples Via Reconstruction-based Semantic Inconsistency

Attack As Detection: Using Adversarial Attack Methods to Detect Abnormal Examples.

Defense Against Adversarial Attacks by Reconstructing Images

A Universal Defense Strategy Against Adversarial Attacks Based on Attention-Guided

A Novel Adversarial Example Detection Method Based on Frequency Domain Reconstruction for Image Sensors

A Divide-and-conquer Reconstruction Method for Defending Against Adversarial Example Attacks

Model-agnostic Adversarial Example Detection via High-Frequency Amplification

Constrained Concealment Attacks against Reconstruction-based Anomaly Detectors in Industrial Control Systems

New Adversarial Image Detection Based on Sentiment Analysis

Adversarial Examples Detection Beyond Image Space.

Adversarial Detection from Derived Models

Adversarial example detection using semantic graph matching

Towards Black-box Adversarial Example Detection: A Data Reconstruction-based Method

SemanticAdv: Generating Adversarial Examples via Attribute-conditional Image Editing

Detection defense against adversarial attacks with saliency map

Adversarial Detection with a Dynamically Stable System

Detecting Adversarial Samples for Deep Learning Models: A Comparative Study

SCA: Highly Efficient Semantic-Consistent Unrestricted Adversarial Attack

Adversarial example defense based on image reconstruction

Attention‐guided transformation‐invariant attack for black‐box adversarial examples