Defense against adversarial attacks on deep convolutional neural networks through nonlocal denoising

Abstract

<p><span lang="EN-US">Despite substantial advances in network architecture performance, the susceptibility of adversarial attacks makes deep learning challenging to implement in safety-critical applications. This paper proposes a data-centric approach to addressing this problem. A nonlocal denoising method with different luminance values has been used to generate adversarial examples from the Modified National Institute of Standards and Technology database (MNIST) and Canadian Institute for Advanced Research (CIFAR-10) data sets. Under perturbation, the method provided absolute accuracy improvements of up to 9.3% in the MNIST data set and 13% in the CIFAR-10 data set. Training using transformed images with higher luminance values increases the robustness of the classifier. We have shown that transfer learning is disadvantageous for adversarial machine learning. The results indicate that simple adversarial examples can improve resilience and make deep learning easier to apply in various applications.</span></p>

RoFace: A robust face representation approach for accurate classification

“…The specific case of contradictory examples challenges us, because generating patches which when placed in strategic places of the classifier's field of vision produces a targeted class [ 28 ] leading it to predict an erroneous class with a high degree of confidence. This ability to fool the system is made possible with the introduction of almost imperceptible noise.…”

When Measures are Unreliable: Imperceptible Adversarial Perturbations toward Top-k Multi-Label Learning

“…For each component of 𝐹 , 𝑓 𝑖 (𝒙) ∈ [0, 1] denotes the prediction score of 𝑖-th class. In ranking values, we define 𝑓 [𝑖 ] (𝒙) as the 𝑖-th largest element of 𝐹 (𝒙), that is, 𝑓 [1] (𝒙) ≥ 𝑓 [2] (𝒙) ≥ • • • ≥ 𝑓 [𝑐 ] (𝒙). In the following content, we uniformly assume that the ties between any two prediction scores are completely broken, i.e., 𝑓 [1]…”

“…When 𝑖 = 1, Δ [1] is the largest difference since 𝑓 [𝑐 ] (𝒙 + 𝝐) is the smallest value among 𝑐 scores. It could be known that as 𝑖 increases, the value of 𝑓 [𝑐 −𝑖+1] (𝒙 +𝝐) increases consistently and the difference Δ [𝑖 ] reduces.…”

“…So far, researchers have developed numerous multi-class adversarial perturbation algorithms to protect systems. Most of these effective approaches have been widely adopted in real-world classification scenarios [1,22,43]. In recent years, more attention has shifted to exploring potential threats in multi-label learning [34,42].…”

Enhancing the robustness of vision transformer defense against adversarial attacks based on squeeze-and-excitation module

“…In order to defend against the threats posed by adversarial attacks to artificial intelligence security applications, researchers have investigated multiple network models for adversarial attack defense methods, which at this stage are mainly divided into three categories: (1) data preprocessing for adversarial examples; (2) enhancing the robustness of deep neural networks; and (3) detecting adversarial examples. Data preprocessing methods such as denoising ( Aneja et al, 2022 ; Xu et al, 2022 ) and data compression ( Chang et al, 2022 ; Zhang, Yi & Sang, 2022 ). The advantages of these methods are faster computation and no need to modify the network structure, the disadvantages are that denoising and data compression can cause loss of information in the image, the neural network cannot extract features adequately, which makes the neural network make wrong judgments.…”