Abstract:Some recent studies have demonstrated that the deep neural network (DNN) is vulnerable to adversarial examples, which contain some subtle and human-imperceptible perturbations. Although numerous countermeasures have been proposed and play a significant role, most of them all have some flaws and are only effective for certain types of adversarial examples. In the paper, we present a novel and universal countermeasure to recover multiple types of adversarial examples to benign examples before they are fed into the deep neural network. The idea is to model the mapping between adversarial examples and benign examples using a generative adversarial network (GAN). Its GAN architecture consists of a generator based on UNET, a discriminator based on ACGAN, and a newly added third-party classifier. The UNET can enhance the capacity of the generator to recover adversarial examples to benign examples. The loss function makes full use of the advantages of ACGAN and WGAN-GP to ensure the stability of the training process and accelerate its convergence. Besides, a classification loss and a perceptual loss, all from the third-party classifier, are employed to improve further the generator's capacity to eliminate adversarial perturbations. Experiments are conducted on the MNIST, CIFAR10, and IMAGENET datasets. First, we perform ablation experiments to prove the proposed countermeasure's validity. Then, we defend against seven types of state-of-the-art adversarial examples on four deep neural networks and compare them with six existing countermeasures. Finally, the experimental results demonstrate that the proposed countermeasure is universal and has a more excellent performance than other countermeasures. The experimental code is available at https://github.com/Afreadyang/IAED-GAN.

Synthesizing Unrestricted False Positive Adversarial Objects Using Generative Models

A low-frequency adversarial attack method for object detection using generative model

Transferable Adversarial Attacks for Image and Video Object Detection

AT-GAN: An Adversarial Generator Model for Non-constrained Adversarial Examples

Fine-grained Synthesis of Unrestricted Adversarial Examples

Generating Natural Language Adversarial Examples on a Large Scale with Generative Models

Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models

A General Framework for Adversarial Examples with Objectives

Unrestricted Black-box Adversarial Attack Using GAN with Limited Queries

Any Target Can be Offense: Adversarial Example Generation via Generalized Latent Infection

Generating Adversarial Examples with Adversarial Networks

Counterfactual Image Generation for adversarially robust and interpretable Classifiers

Adversarial Attack Against Images Classification based on Generative Adversarial Networks

Discriminator-free Generative Adversarial Attack

A novel and universal GAN-based countermeasure to recover adversarial examples to benign examples

Adversarial Transformation Network with Adaptive Perturbations for Generating Adversarial Examples.

Adversarial Attack for Object Detectors under Complex Conditions.

Generative Adversarial Trainer: Defense to Adversarial Perturbations with GAN

Synthesizing Robust Adversarial Examples

Generate More Imperceptible Adversarial Examples for Object Detection

GRIP-GAN: an Attack-Free Defense Through General Robust Inverse Perturbation