Connecting the Dots: Detecting Adversarial Perturbations Using Context Inconsistency

Li, Shasha; Zhu, Shitong; Paul, Sudipta; Roy-Chowdhury, Amit K.; Song, Chengyu; Krishnamurthy, Srikanth V.; Swami, Ananthram; Chan, Kevin

doi:10.1007/978-3-030-58592-1_24

Cited by 19 publications

(35 citation statements)

References 35 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Since then, an arms race between the generation of adversarial example attacks and defenses to thwart them, has taken off. Researchers have proposed attacks and defenses in image and video classification [20,11,12,24,28,8,25,10], and object detection [3,21,30,13].…”

Section: Introductionmentioning

confidence: 99%

“…Among existing defense mechanisms, checking intrinsic context consistencies within the input data has recently been showcased to be very effective, in various tasks. For example, spatial consistency has been used to detect adversarial attacks against semantic segmentation [26]; temporal consistency has been used to detect adversarial attacks against video classification [8,25]; object-object context along with other kinds of context has been used to detect adversarial examples against objection detection [13]; audiovisual correlation has been used to detect adversarial examples against audio-visual speech recognition [15].…”

Section: Introductionmentioning

confidence: 99%

“…In this work, we conduct the first study on composing adaptive attacks against context-consistency-based defenses. Using the very recent context-aware object detector proposed in [13] as an exemplar of defense, we demonstrate the feasibility of attacking context-consistency based models. We analyze two types of attack scenarios that are as follows.…”

Section: Introductionmentioning

confidence: 99%

“…In a white-box attack scenario, we assume attackers have full knowledge of the consistency check modules. Only the stop sign is perturbed and detected as a speed limit; however, a context-aware adversarial defense like [13] is able to easily detect that a speed limit sign does not occur at an intersection, and thus the attack fails. (c) Our goal is to not only perturb the stop sign into a speed limit sign, but also perturb other parts of the image so that it is contextually consistent, e.g., the intersection to objects that co-occur with the speed limit sign like other cars.…”

Section: Introductionmentioning

confidence: 99%

“…(c) Our goal is to not only perturb the stop sign into a speed limit sign, but also perturb other parts of the image so that it is contextually consistent, e.g., the intersection to objects that co-occur with the speed limit sign like other cars. Such an attack would be difficult to detect using methods like [13]. While we do not explicitly perturb the other objects, the proposed method will add perturbations such that the detections in the overall image become contextually consistent.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

ADC: Adversarial attacks against object Detection that evade Context consistency checks

Yin¹,

Li²,

Song³

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

Deep Neural Networks (DNNs) have been shown to be vulnerable to adversarial examples, which are slightly perturbed input images which lead DNNs to make wrong predictions. To protect from such examples, various defense strategies have been proposed. A very recent defense strategy for detecting adversarial examples, that has been shown to be robust to current attacks, is to check for intrinsic context consistencies in the input data, where context refers to various relationships (e.g., object-to-object co-occurrence relationships) in images. In this paper, we show that even context consistency checks can be brittle to properly crafted adversarial examples and to the best of our knowledge, we are the first to do so. Specifically, we propose an adaptive framework to generate examples that subvert such defenses, namely, Adversarial attacks against object Detection that evade Context consistency checks (ADC). In ADC, we formulate a joint optimization problem which has two attack goals, viz., (i) fooling the object detector and (ii) evading the context consistency check system, at the same time. Experiments on both PASCAL VOC and MS COCO datasets show that examples generated with ADC fool the object detector with a success rate of over 85% in most cases, and at the same time evade the recently proposed context consistency checks, with a "bypassing" rate of over 80% in most cases. Our results suggest that "how to robustly model context and check its consistency," is still an open problem.

show abstract

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

ADC: Adversarial attacks against object Detection that evade Context consistency checks

Yin¹,

Li²,

Song³

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

show abstract

Explainable artificial intelligence for digital forensics

Hall

Sakzad

Choo

2021

WIREs Forensic Science

View full text Add to dashboard Cite

EXplainable artificial intelligence (XAI) is an emerging research area relating to the creation of machine learning algorithms from which explanations for outputs are provided. In many fields, such as law enforcement, it is necessary that decisions made by and with the assistance of artificial intelligence (AI)based tools can be justified and explained to a human. We seek to explore the potential of XAI to further enhance triage and analysis of digital forensic evidence, using examples of the current state of the art as a starting point. This opinion letter will discuss both practical and novel ideas as well as controversial points for leveraging XAI to improve the efficacy of digital forensic (DF) analysis and extract forensically sound pieces of evidence (also known as artifacts) that could be used to assist investigations and potentially in a court of law.

show abstract