Abstract:Adversarial attacks on deep-learning models pose a serious threat to their reliability and security. Existing defense mechanisms are narrow addressing a specific type of attack or being vulnerable to sophisticated attacks. We propose a new defense mechanism that, while being focused on image-based classifiers, is general with respect to the cited category. It is rooted on hyperspace projection. In particular, our solution provides a pseudo-random projection of the original dataset into a new dataset. The proposed defense mechanism creates a set of diverse projected datasets, where each projected dataset is used to train a specific classifier, resulting in different trained classifiers with different decision boundaries. During testing, it randomly selects a classifier to test the input. Our approach does not sacrifice accuracy over legitimate input. Other than detailing and providing a thorough characterization of our defense mechanism, we also provide a proof of concept of using four optimization-based adversarial attacks (PGD, FGSM, IGSM, and C\&W) and a generative adversarial attack testing them on the MNIST dataset. Our experimental results show that our solution increases the robustness of deep learning models against adversarial attacks and significantly reduces the attack success rate by at least 89% for optimization attacks and 78% for generative attacks. We also analyze the relationship between the number of used hyperspaces and the efficacy of the defense mechanism. As expected, the two are positively correlated, offering an easy-to-tune parameter to enforce the desired level of security. The generality and scalability of our solution and adaptability to different attack scenarios, combined with the excellent achieved results, other than providing a robust defense against adversarial attacks on deep learning networks, also lay the groundwork for future research in the field.

Exploiting vulnerabilities of deep neural networks for privacy protection

Adversarial Attacks on Convolutional Neural Networks in Facial Recognition Domain

Adversarial Attacks Neutralization via Data Set Randomization

Adversarial Robust Safeguard for Evading Deep Facial Manipulation

Adversarial Attacks Hidden in Plain Sight

A novel privacy protection approach with better human imperceptibility

Towards Robustness against Unsuspicious Adversarial Examples

Backdooring Convolutional Neural Networks via Targeted Weight Perturbations

Investigating Human-Identifiable Features Hidden in Adversarial Perturbations

Reversible Attack based on Local Visual Adversarial Perturbation

DeepDefense: Training Deep Neural Networks with Improved Robustness.

Visual Analytics of Neuron Vulnerability to Adversarial Attacks on Convolutional Neural Networks

Detecting and Mitigating Adversarial Perturbations for Robust Face Recognition

Transferable Adversarial Facial Images for Privacy Protection

SocialGuard: An adversarial example based privacy-preserving technique for social images

Designing defensive techniques to handle adversarial attack on deep learning based model

Attacking Adversarial Attacks as A Defense

Simple Transparent Adversarial Examples

Tailoring Adversarial Attacks on Deep Neural Networks for Targeted Class Manipulation Using DeepFool Algorithm

Protecting Privacy in Shared Photos Via Adversarial Examples Based Stealth

DiffProtect: Generate Adversarial Examples with Diffusion Models for Facial Privacy Protection