Defense-friendly Images in Adversarial Attacks: Dataset and Metrics for Perturbation Difficulty

Abstract

Dataset bias is a problem in adversarial machine learning, especially in the evaluation of defenses. An adversarial attack or defense algorithm may show better results on the reported dataset than can be replicated on other datasets. Even when two algorithms are compared, their relative performance can vary depending on the dataset. Deep learning offers state-of-the-art solutions for image recognition, but deep models are vulnerable even to small perturbations. Research in this area focuses primarily on adversarial attacks and defense algorithms. In this paper, we report for the first time, a class of robust images that are both resilient to attacks and that recover better than random images under adversarial attacks using simple defense techniques. Thus, a test dataset with a high proportion of robust images gives a misleading impression about the performance of an adversarial attack or defense. We propose three metrics to determine the proportion of robust images in a dataset and provide scoring to determine the dataset bias. We also provide an ImageNet-R dataset of 15000+ robust images to facilitate further research on this intriguing phenomenon of image strength under attack. Our dataset, combined with the proposed metrics, is valuable for unbiased benchmarking of adversarial attack and defense algorithms.

Physical world assistive signals for deep neural network classifiers -- neither defense nor attack

“…However, as a side-effect of making these images more 'recognizable', they also get more resilient against adversarial attacks such as FGSM and PGD. Whereas this phenomenon was first studied by Pestana et al [33] for the ImageNet dataset, our proposed method offers a simple but efficient way of creating 'Robust' datasets and can be applied to any other datasets.…”

“…There is an emerging area related to 'robust', 'easier-toclassify' and 'harder-to-perturb' datasets. As a concrete example, recently Pestana et al [33] proposed a dataset with robust natural images and showed that datasets with robust images are also harder-to-perturb and they could be used to create better adversarial attacks and perform unbiased benchmarking for defenses in the area of adversarial learning. We believe that our work nicely complements [33].…”

“…As a concrete example, recently Pestana et al [33] proposed a dataset with robust natural images and showed that datasets with robust images are also harder-to-perturb and they could be used to create better adversarial attacks and perform unbiased benchmarking for defenses in the area of adversarial learning. We believe that our work nicely complements [33]. They proposed algorithms to find natural robust images, which is an exhaustive process.…”

Similarity-based Deep Neural Network to Detect Imperceptible Adversarial Attacks

“…To evaluate the robustness of Si m-DNN to imperceptible adversarial attacks, the recently introduced ImageNet-R dataset [38] was considered. The ImageNet-R dataset is a modified version of the ImageNet dataset for the specific task of adversarial attack detection.…”

Adversarial Attacks Impact on the Neural Network Performance and Visual Perception of Data under Attack

“…Nevertheless, research in the field of adversarial attacks on such systems [16,17] proves that even the use of biometric metrics such as voice is not a guarantee of protection from adversarial attacks. Adversarial attacks can negatively affect the operation of almost any system [17][18][19][20][21], but we assume that certain characteristics of datasets may have some influence on the effectiveness of an attack [22,23].…”