# Mitigating Evasion Attacks to Deep Neural Networks via Region-based Classification

arXiv: https://arxiv.org/abs/1709.05583 · HTML: https://mlsanity.com/paper/1709.05583/

## Key facts

- Cited by 56 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 17 Sep 2017.

## Built on by (most cited first, 30 of 56)

- [Advances in adversarial attacks and defenses in computer vision: A survey](https://mlsanity.com/paper/2108.00401/) (2021)
- [Skew Orthogonal Convolutions](https://mlsanity.com/paper/2105.11417/) (2021)
- [A Dynamical System Perspective for Lipschitz Neural Networks](https://mlsanity.com/paper/2110.12690/) (2021)
- [PointGuard: Provably Robust 3D Point Cloud Classification](https://mlsanity.com/paper/2103.03046/) (2021)
- [Improved deterministic l2 robustness on CIFAR-10 and CIFAR-100](https://mlsanity.com/paper/2108.04062/) (2021)
- [Can You Hear It? Backdoor Attacks via Ultrasonic Triggers](https://mlsanity.com/paper/2107.14569/) (2021)
- [Transferable Graph Backdoor Attack](https://mlsanity.com/paper/2207.00425/) (2022)
- [Security and Privacy for Artificial Intelligence: Opportunities and Challenges](https://mlsanity.com/paper/2102.04661/) (2021)
- [Trustworthy Distributed AI Systems: Robustness, Privacy, and Governance](https://mlsanity.com/paper/2402.01096/) (2024)
- [Sequential Randomized Smoothing for Adversarially Robust Speech Recognition](https://mlsanity.com/paper/2112.03000/) (2021)
- [RamBoAttack: A Robust Query Efficient Deep Neural Network Decision Exploit](https://mlsanity.com/paper/2112.05282/) (2021)
- [MedRDF: A Robust and Retrain-Less Diagnostic Framework for Medical Pretrained Models Against Adversarial Attack](https://mlsanity.com/paper/2111.14564/) (2021)
- [Adversarially Robust Learning with Tolerance](https://mlsanity.com/paper/2203.00849/) (2022)
- [MultiGuard: Provably Robust Multi-label Classification against Adversarial Examples](https://mlsanity.com/paper/2210.01111/) (2022)
- [Improved techniques for deterministic l2 robustness](https://mlsanity.com/paper/2211.08453/) (2022)
- [Targeted Attacks on Timeseries Forecasting](https://mlsanity.com/paper/2301.11544/) (2023)
- [Rethinking Impersonation and Dodging Attacks on Face Recognition Systems](https://mlsanity.com/paper/2401.08903/) (2024)
- [Temporal Shuffling for Defending Deep Action Recognition Models against Adversarial Attacks](https://mlsanity.com/paper/2112.07921/) (2021)
- [Certified Robustness via Randomized Smoothing over Multiplicative Parameters of Input Transformations](https://mlsanity.com/paper/2106.14432/) (2021)
- [Understanding the Security of Deepfake Detection](https://mlsanity.com/paper/2107.02045/) (2021)
- [10 Security and Privacy Problems in Large Foundation Models](https://mlsanity.com/paper/2110.15444/) (2021)
- [PointCert: Point Cloud Classification with Deterministic Certified Robustness Guarantees](https://mlsanity.com/paper/2303.01959/) (2023)
- [Certified Human Trajectory Prediction](https://mlsanity.com/paper/2403.13778/) (2024)
- [Refusing Safe Prompts for Multi-modal Large Language Models](https://mlsanity.com/paper/2407.09050/) (2024)
- [Perturbation Inactivation Based Adversarial Defense for Face Recognition](https://mlsanity.com/paper/2207.06035/) (2022)
- [Oblivious Defense in ML Models: Backdoor Removal without Detection](https://mlsanity.com/paper/2411.03279/) (2024)
- [Pre-trained Encoders in Self-Supervised Learning Improve Secure and Privacy-preserving Supervised Learning](https://mlsanity.com/paper/2212.03334/) (2022)
- [Adversarial Pretraining of Self-Supervised Deep Networks: Past, Present and Future](https://mlsanity.com/paper/2210.13463/) (2022)
- [REaaS: Enabling Adversarially Robust Downstream Classifiers via Robust Encoder as a Service](https://mlsanity.com/paper/2301.02905/) (2023)
- [Poisoning Network Flow Classifiers](https://mlsanity.com/paper/2306.01655/) (2023)

## Abstract (arXiv)

Deep neural networks (DNNs) have transformed several artificial intelligence research areas including computer vision, speech recognition, and natural language processing. However, recent studies demonstrated that DNNs are vulnerable to adversarial manipulations at testing time. Specifically, suppose we have a testing example, whose label can be correctly predicted by a DNN classifier. An attacker can add a small carefully crafted noise to the testing example such that the DNN classifier predicts an incorrect label, where the crafted testing example is called adversarial example. Such attacks are called evasion attacks. Evasion attacks are one of the biggest challenges for deploying DNNs in safety and security critical applications such as self-driving cars. In this work, we develop new methods to defend against evasion attacks. Our key observation is that adversarial examples are close to the classification boundary. Therefore, we propose region-based classification to be robust to adversarial examples. For a benign/adversarial testing example, we ensemble information in a hypercube centered at the example to predict its label. In contrast, traditional classifiers are point-based classification, i.e., given a testing example, the classifier predicts its label based on the testing example alone. Our evaluation results on MNIST and CIFAR-10 datasets demonstrate that our region-based classification can significantly mitigate evasion attacks without sacrificing classification accuracy on benign examples. Specifically, our region-based classification achieves the same classification accuracy on testing benign examples as point-based classification, but our region-based classification is significantly more robust than point-based classification to various evasion attacks.