# Defense Methods Against Adversarial Examples for Recurrent Neural Networks

arXiv: https://arxiv.org/abs/1901.09963 · HTML: https://mlsanity.com/paper/1901.09963/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 28 Jan 2019.

## Built on by (most cited first, 8 of 8)

- [Spatially Focused Attack against Spatiotemporal Graph Neural Networks](https://mlsanity.com/paper/2109.04608/) (2021)
- [Single-Shot Black-Box Adversarial Attacks Against Malware Detectors: A Causal Language Model Approach](https://mlsanity.com/paper/2112.01724/) (2021)
- [Deterministic versus stochastic dynamical classifiers: opposing random adversarial attacks with noise](https://mlsanity.com/paper/2409.13470/) (2024)
- [Evading Deep Learning-Based Malware Detectors via Obfuscation: A Deep Reinforcement Learning Approach](https://mlsanity.com/paper/2402.02600/) (2024)
- [Bio-Inspired Adversarial Attack Against Deep Neural Networks](https://mlsanity.com/paper/2107.02895/) (2021)
- [Repairing Adversarial Texts through Perturbation](https://mlsanity.com/paper/2201.02504/) (2021)
- [Multi-view Representation Learning from Malware to Defend Against Adversarial Variants](https://mlsanity.com/paper/2210.15429/) (2022)
- [DODEM: DOuble DEfense Mechanism Against Adversarial Attacks Towards Secure Industrial Internet of Things Analytics](https://mlsanity.com/paper/2301.09740/) (2023)

## Abstract (arXiv)

Adversarial examples are known to mislead deep learning models to incorrectly classify them, even in domains where such models achieve state-of-the-art performance. Until recently, research on both attack and defense methods focused on image recognition, primarily using convolutional neural networks (CNNs). In recent years, adversarial example generation methods for recurrent neural networks (RNNs) have been published, demonstrating that RNN classifiers are also vulnerable to such attacks. In this paper, we present a novel defense method, termed sequence squeezing, to make RNN classifiers more robust against such attacks. Our method differs from previous defense methods which were designed only for non-sequence based models. We also implement four additional RNN defense methods inspired by recently published CNN defense methods. We evaluate our methods against state-of-the-art attacks in the cyber security domain where real adversaries (malware developers) exist, but our methods can be applied against other discrete sequence based adversarial attacks, e.g., in the NLP domain. Using our methods we were able to decrease the effectiveness of such attack from 99.9% to 15%.