Hindering Adversarial Attacks with Implicit Neural Representations
Not on the map. Why?
Abstract (arXiv)
We introduce the Lossy Implicit Network Activation Coding (LINAC) defence, an input transformation which successfully hinders several common adversarial attacks on CIFAR-10 classifiers for perturbations up to ε = 8/255 in L_∞ norm and ε = 0.5 in L2 norm. Implicit neural representations are used to approximately encode pixel colour intensities in 2D images such that classifiers trained on transformed data appear to have robustness to small perturbations without adversarial training or large drops in performance. The seed of the random number generator used to initialise and train the implicit neural representation turns out to be necessary information for stronger generic attacks, suggesting its role as a private key. We devise a Parametric Bypass Approximation (PBA) attack strategy for key-based defences, which successfully invalidates an existing method in this category. Interestingly, our LINAC defence also hinders some transfer and adaptive attacks, including our novel PBA strategy. Our results emphasise the importance of a broad range of customised attacks despite apparent robustness according to standard evaluations. LINAC source code and parameters of defended classifier evaluated throughout this submission are available: https://github.com/deepmind/linac
Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Builds on 45 of its 57 references that are in the map. First posted on arXiv 22 Oct 2022.
Builds on
45 of 57 references.
References · 45
- 2014Adam: A Method for Stochastic Optimizationcited by 36,960
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2013Intriguing properties of neural networkscited by 5,114
- 2016Wide Residual Networkscited by 3,057
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
- 2019CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Featurescited by 2,875
- 2020Implicit Neural Representations with Periodic Activation Functionscited by 2,214
- 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
- 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
- 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
- 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
33 more
- 2016Practical Black-Box Attacks against Machine Learningcited by 893
- 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
- 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
- 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
- 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 542
- 2017Countering Adversarial Images using Input Transformationscited by 517
- 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
- 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
- 2018Adversarially Robust Generalization Requires More Datacited by 318
- 2018Certified Defenses against Adversarial Examplescited by 305
- 2020Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examplescited by 275
- 2017PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examplescited by 243
- 2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 201
- 2020Bag of Tricks for Adversarial Trainingcited by 199
- 2016A study of the effect of JPG compression on adversarial imagescited by 196
- 2017Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulationcited by 182
- 2018Stochastic Activation Pruning for Robust Adversarial Defensecited by 171
- 2020Adversarial Generation of Continuous Imagescited by 135
- 2018Towards the first adversarially robust neural network model on MNISTcited by 104
- 2018Adversarial Attacks and Defences Competitioncited by 96
- 2017Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compressioncited by 86
- 2018Shield: Fast, Practical Defense and Vaccination for Deep Learning using JPEG Compressioncited by 74
- 2018Excessive Invariance Causes Adversarial Vulnerabilitycited by 66
- 2019ME-Net: Towards Effective Adversarial Robustness with Matrix Estimationcited by 65
- 2019An Alternative Surrogate Loss for PGD-based Adversarial Testingcited by 45
- 2017Adversarial Example Defenses: Ensembles of Weak Defenses are not Strongcited by 32
- 2020Block-wise Image Transformation with Secret Key for Adversarially Robust Defensecited by 30
- 2021A Protection Method of Trained CNN Model with Secret Key from Unauthorized Accesscited by 15
- 2019Adversarially Robust Learning Could Leverage Computational Hardnesscited by 13
- 2018Defending against Adversarial Images using Basis Functions Transformationscited by 11
- 2020On the Limitations of Denoising Strategies as Adversarial Defensescited by 9
- 2018Defense Against Adversarial Attacks with Saak Transformcited by 2
- 2021Transfer Learning-Based Model Protection With Secret Keycited by 1
Built on by
Citing papers per year: 2022: 1; 2023: 2.
3 papers.