Adversarial Dual Network Learning With Randomized Image Transform for Restoring Attacked Images

Abstract

We develop a new method for defending deep neural networks against attacks using adversarial dual network learning with randomized nonlinear image transform. We introduce a randomized nonlinear transform to disturb and partially destroy the sophisticated pattern of attack noise. We then design a generative cleaning network to recover the original image content damaged by this nonlinear transform and remove residual attack noise. We also construct a detector network which serves as the dual network for the target classifier to be defended, being able to detect patterns of attack noise. The generative cleaning network and detector network are jointly trained using adversarial learning, fighting against each other to minimize both perceptual loss and adversarial loss. Our extensive experimental results demonstrate that our approach improves the state-of-art by large margins in both white-box and black-box attacks. It significantly improves the classification accuracy for white-box attacks upon the second best method by more than 30% on the SVHN dataset and more than 14% on the challenging CIFAR-10 dataset. INDEX TERMS Adversarial attack, adversarial defense, deep neural network.

Hierarchical Adversarial Attacks Against Graph-Neural-Network-Based IoT Network Intrusion Detection System

“…Takahashi [26] investigated indirect adversarial attacks in graph convolutional neural networks and discussed a detection method to find one new attack which could poison node features and lead to the misclassification. Yuan and He [27] presented an adversarial dual network learning model for DNN-based defense. They formulated this problem using a generative adversarial network and developed a detector with a generative cleaning network to clean up the attack noise following a randomized nonlinear image transform.…”

A Hybrid Defense Method against Adversarial Attacks on Traffic Sign Classifiers in Autonomous Vehicles

“…Our DNN-based hybrid adversarial defense approach, which includes random filtering, ensembling and local feature mapping, is the first of its kind, and no previous work has attempted such a hybrid method for defense against adversarial attacks to the sign recognition of the AV perception module. Moreover, this is the first formal defense method specific to adversarial attacks on traffic sign classifiers, as previous models have been tested on generic datasets [12], [15], [16]. Previous literature has presented deterministic defense methods that are not resilient to new attack types beyond the attacks considered in the research [14].…”

“…Generative adversarial networks (GAN) are also popular defense methods [17]. For example, Yuan and He developed an adversarial dual network learning method supported by random image transform as a defense method [16]. At first, the input image is transformed to override the noise of an adversarial attack.…”

“…Overall, from the literature review, we have found several gaps for resiliency against adversarial attacks which we address in this study. At first, existing defense methods have been tested for benchmark datasets such as MNIST (contains images of hand-written digits), Fashion-MNIST (contains images of fashion accessories and clothes), and CIFAR-10 (contains images of airplane, automobile, bird, cat, deer, dog, frog, horse, ship, and trucks) [12], [15], [16].…”

Progressive Defense Against Adversarial Attacks for Deep Learning as a Service in Internet of Things

“…Dual-defense[33] have provided results for FSM and PGD attack on the cifar-10 dataset. The target classifier and detector network are based on the ResNet network.…”