MixDefense: A Defense-in-Depth Framework for Adversarial Example Detection Based on Statistical and Semantic Analysis
Not on the map. Why?
Abstract (arXiv)
Machine learning with deep neural networks (DNNs) has become one of the foundation techniques in many safety-critical systems, such as autonomous vehicles and medical diagnosis systems. DNN-based systems, however, are known to be vulnerable to adversarial examples (AEs) that are maliciously perturbed variants of legitimate inputs. While there has been a vast body of research to defend against AE attacks in the literature, the performances of existing defense techniques are still far from satisfactory, especially for adaptive attacks, wherein attackers are knowledgeable about the defense mechanisms and craft AEs accordingly. In this work, we propose a multilayer defense-in-depth framework for AE detection, namely MixDefense. For the first layer, we focus on those AEs with large perturbations. We propose to leverage the `noise' features extracted from the inputs to discover the statistical difference between natural images and tampered ones for AE detection. For AEs with small perturbations, the inference result of such inputs would largely deviate from their semantic information. Consequently, we propose a novel learning-based solution to model such contradictions for AE detection. Both layers are resilient to adaptive attacks because there do not exist gradient propagation paths for AE generation. Experimental results with various AE attack methods on image classification datasets show that the proposed MixDefense solution outperforms the existing AE detection techniques by a considerable margin.
Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 49 of its 68 references that are in the map. First posted on arXiv 20 Apr 2021.
Builds on
49 of 68 references.
References · 49
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2013Intriguing properties of neural networkscited by 5,114
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
- 2015FaceNet: A Unified Embedding for Face Recognition and Clusteringcited by 2,833
- 2016Adversarial examples in the physical worldcited by 1,762
- 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
- 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
- 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
- 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
- 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 675
- 2017Countering Adversarial Images using Input Transformationscited by 517
37 more
- 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 484
- 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
- 2019On Evaluating Adversarial Robustnesscited by 442
- 2014Deep metric learning using Triplet networkcited by 421
- 2021Pervasive Label Errors in Test Sets Destabilize Machine Learning Benchmarkscited by 388
- 2017Mitigating Adversarial Effects Through Randomizationcited by 382
- 2018Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Modelscited by 362
- 2018Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionalitycited by 280
- 2017MagNet: a Two-Pronged Defense against Adversarial Examplescited by 268
- 2018cGANs with Projection Discriminatorcited by 253
- 2017Detecting Adversarial Samples from Artifactscited by 244
- 2017PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examplescited by 243
- 2017On Detecting Adversarial Perturbationscited by 232
- 2018Adversarial Logit Pairingcited by 224
- 2019Improving Adversarial Robustness via Promoting Ensemble Diversitycited by 213
- 2016A study of the effect of JPG compression on adversarial imagescited by 196
- 2018Spatially Transformed Adversarial Examplescited by 195
- 2017On the (Statistical) Detection of Adversarial Examplescited by 180
- 2017Towards Robust Neural Networks via Random Self-ensemblecited by 158
- 2020Understanding and Mitigating the Tradeoff Between Robustness and Accuracycited by 148
- 2016Technical Report on the CleverHans v2.1.0 Adversarial Examples Librarycited by 123
- 2019Adversarial Examples Are a Natural Consequence of Test Error in Noisecited by 114
- 2018Shield: Fast, Practical Defense and Vaccination for Deep Learning using JPEG Compressioncited by 74
- 2020Opportunities and Challenges in Deep Learning Adversarial Robustness: A Surveycited by 71
- 2017Adversarial Transformation Networks: Learning to Generate Adversarial Examplescited by 60
- 2017Adversarial examples for generative modelscited by 58
- 2020PyTorch Metric Learningcited by 57
- 2020Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbationscited by 55
- 2017Detecting Adversarial Image Examples in Deep Networks with Adaptive Noise Reductioncited by 49
- 2018Adversarial Sample Detection for Deep Neural Network through Model Mutation Testingcited by 48
- 2018Deep Defense: Training DNNs with Improved Adversarial Robustnesscited by 41
- 2019Gotta Catch 'Em All: Using Honeypots to Catch Adversarial Attacks on Neural Networkscited by 40
- 2018Detection based Defense against Adversarial Examples from the Steganalysis Point of Viewcited by 32
- 2019Defending against Whitebox Adversarial Attacks via Randomized Discretizationcited by 29
- 2018Adversarial Attacks on Variational Autoencoderscited by 19
- 2019Detecting Adversarial Examples and Other Misclassifications in Neural Networks by Introspectioncited by 16
- 2017When Not to Classify: Anomaly Detection of Attacks (ADA) on DNN Classifiers at Test Timecited by 9
Built on by
Not cited yet.