Abstract:Deep neural networks (DNNs) have shown phenomenal success in many real-world applications. However, a concerning weakness of DNNs is their vulnerability to adversarial attacks. Although there exist some methods to detect adversarial attacks, they often suffer from high computational cost and constraints on certain types of attacks, and ignore external features that could aid during attack detection. In this article, we propose fast confidence detection method (FCDM), an innovative method for fast confidence detection of adversarial attacks based on measuring the integrity of sensor pattern noise fingerprinting embedded in input examples. We note that the existing adversarial detectors are often designed as a binary classifier to differentiate clean or adversarial examples. However, the detection of adversarial examples can be much more complicated than such a scenario. Our key insight is that the confidence level of detecting an input sample as an adversarial example is a more useful info for the system to properly take an action to resist potential attacks. The experimental results show that FCDM is capable to give a confidence distribution model of the most popular adversarial attacks. And, using the confidence distribution model, FCDM can quickly determine the confidence level of the input sample. Based on different properties of the confidence distribution models associated with these adversarial attacks, FCDM can provide early attack warning including even the possible attack types of the adversarial attack examples. FCDM also has the following advantages: 1) it is effective for both a white-box attack and black-box attack; 2) it do not depend on the class of adversarial attacks and can be used as both known attack defense and unknown attack defense; and 3) it does not need to know the details of the DNN model and does not affect the functionality of the DNN. Since fast confidence detection method (FCDM) is a computationally heavy task, we propose an FPGA-based accelerator based on a series of optimization techniques, such as the quantization, data reuse and operation replacement, etc. We implement our method on an FPGA platform and achieve a system clock frequency of 279 MHz with a power consumption of the only 0.7626 W. Moreover, in the real system performance test, we obtain a high efficiency of 29.740 IPS/W and a low latency of just 44.1 ms with very marginal accuracy loss.

FLDATN: Black‐Box Attack for Face Liveness Detection Based on Adversarial Transformation Network

Attack As Detection: Using Adversarial Attack Methods to Detect Abnormal Examples.

CAAD 2018: Powerful None-Access Black-Box Attack Based on Adversarial Transformation Network

ReFace: Real-time Adversarial Attacks on Face Recognition Systems

Efficient Decision-Based Black-Box Adversarial Attacks on Face Recognition

Towards Transferable Adversarial Attack Against Deep Face Recognition

Black-box Attacks on Face Recognition Via Affine-Invariant Training

Restricted Black-Box Adversarial Attack Against DeepFake Face Swapping

NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks

Towards Lightweight Black-Box Attacks against Deep Neural Networks

AFLOW: Developing Adversarial Examples under Extremely Noise-limited Settings

Learning to Attack: Adversarial Transformation Networks

Local Adaptive Gradient Variance Attack for Deep Fake Fingerprint Detection

FCDM: A Methodology Based on Sensor Pattern Noise Fingerprinting for Fast Confidence Detection to Adversarial Attacks

ApaNet: adversarial perturbations alleviation network for face verification

FLDNet: Light Dense CNN for Fingerprint Liveness Detection

Effective and Robust Physical-World Attacks on Deep Learning Face Recognition Systems

ALA: Naturalness-aware Adversarial Lightness Attack

Invisible Adversarial Attacks on Deep Learning-Based Face Recognition Models.

Detection Tolerant Black-Box Adversarial Attack Against Automatic Modulation Classification With Deep Learning

Trans-IFFT-FGSM: a novel fast gradient sign method for adversarial attacks