A Self-supervised Approach for Adversarial Robustness

Naseer, Muzammal; Khan, Salman; Hayat, Munawar; Khan, Fahad Shahbaz; Porikli, Fatih

doi:10.1109/cvpr42600.2020.00034

Cited by 160 publications

(134 citation statements)

References 17 publications

Supporting

Mentioning

126

Contrasting

Order By: Relevance

“…Naseer et al [342] proposed self-supervised adversarial training, whereas adversarial training is independently analyzed for self-supervision by incorporating it in pretraining in [343]. Similarly, [344] [345], which uses perturbations in the image space as well as latent space of StyleGAN to make training more effective.…”

Section: A Model Alteration For Defensementioning

confidence: 99%

Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

2018

View full text Add to dashboard Cite

Deep learning is at the heart of the current rise of artificial intelligence. In the field of Computer Vision, it has become the workhorse for applications ranging from self-driving cars to surveillance and security. Whereas deep neural networks have demonstrated phenomenal success (often beyond human capabilities) in solving complex problems, recent studies show that they are vulnerable to adversarial attacks in the form of subtle perturbations to inputs that lead a model to predict incorrect outputs. For images, such perturbations are often too small to be perceptible, yet they completely fool the deep learning models. Adversarial attacks pose a serious threat to the success of deep learning in practice. This fact has recently lead to a large influx of contributions in this direction. This article presents the first comprehensive survey on adversarial attacks on deep learning in Computer Vision. We review the works that design adversarial attacks, analyze the existence of such attacks and propose defenses against them. To emphasize that adversarial attacks are possible in practical conditions, we separately review the contributions that evaluate adversarial attacks in the real-world scenarios. Finally, drawing on the reviewed literature, we provide a broader outlook of this research direction.

show abstract

Section: A Model Alteration For Defensementioning

confidence: 99%

Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

2018

View full text Add to dashboard Cite

show abstract

“…In addition to the previous pixel-space objective, I g should lie close to I c in the feature space of a neural network feature extractor so that I g is semantically similar to I c . Inspired by the work of [26], we employ the feature space of the third convolutional block of an ImageNet-trained VGG16 network [35] F and L 2 distance to minimize the feature distortion between I g and I c . Subsequently, our feature reconstruction objective encourages G to minimize the following loss function:…”

Section: Feature Reconstructionmentioning

confidence: 99%

Identification of Attack-Specific Signatures in Adversarial Examples

Souri,

Khorramshahi,

Lau

et al. 2021

Preprint

View full text Add to dashboard Cite

The adversarial attack literature contains a myriad of algorithms for crafting perturbations which yield pathological behavior in neural networks. In many cases, multiple algorithms target the same tasks and even enforce the same constraints. In this work, we show that different attack algorithms produce adversarial examples which are distinct not only in their effectiveness but also in how they qualitatively affect their victims. We begin by demonstrating that one can determine the attack algorithm that crafted an adversarial example. Then, we leverage recent advances in parameter-space saliency maps to show, both visually and quantitatively, that adversarial attack algorithms differ in which parts of the network and image they target. Our findings suggest that prospective adversarial attacks should be compared not only via their success rates at fooling models but also via deeper downstream effects they have on victims.

show abstract

“…Because of the uncertainty and randomness, they show limitations on handling larger perturbations(e.g., when l 2 -norm perturbation size is larger than 0.6). Besides, some solutions are put forward from the perspective of feature space [24], [25], [26], [27]. By pushing adversarial examples to approximate benign ones via mapping and projection in latent feature space, they achieve further defensive improvement.…”

Section: Introductionmentioning

confidence: 99%

NIP: Neuron-level Inverse Perturbation Against Adversarial Attacks

Chen¹,

Jin²,

Chen³

et al. 2021

Preprint

View full text Add to dashboard Cite

Although deep learning models have achieved unprecedented success, their vulnerabilities towards adversarial attacks have attracted increasing attention, especially when deployed in security-critical domains. To address the challenge, numerous defense strategies, including reactive and proactive ones, have been proposed for robustness improvement. From the perspective of image feature space, some of them cannot reach satisfying results due to the shift of features. Besides, features learned by models are not directly related to classification results. Different from them, We consider defense method essentially from model inside and investigated the neuron behaviors before and after attacks. We observed that attacks mislead the model by dramatically changing the neurons that contribute most and least to the correct label. Motivated by it, we introduce the concept of neuron influence and further divide neurons into front, middle and tail part. Based on it, we propose neuron-level inverse perturbation(NIP), the first neuron-level reactive defense method against adversarial attacks. By strengthening front neurons and weakening those in the tail part, NIP can eliminate nearly all adversarial perturbations while still maintaining high benign accuracy. Besides, it can cope with different sizes of perturbations via adaptivity, especially larger ones. Comprehensive experiments conducted on three datasets and six models show that NIP outperforms the state-of-the-art baselines against eleven adversarial attacks. We further provide interpretable proofs via neuron activation and visualization for better understanding.

show abstract

A Self-supervised Approach for Adversarial Robustness

Cited by 160 publications

References 17 publications

Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

Identification of Attack-Specific Signatures in Adversarial Examples

NIP: Neuron-level Inverse Perturbation Against Adversarial Attacks

Contact Info

Product

Resources

About