Defense Methods Against Adversarial Examples for Recurrent Neural Networks

Abstract

Adversarial examples are known to mislead deep learning models to incorrectly classify them, even in domains where such models achieve state-of-the-art performance. Until recently, research on both attack and defense methods focused on image recognition, primarily using convolutional neural networks (CNNs). In recent years, adversarial example generation methods for recurrent neural networks (RNNs) have been published, demonstrating that RNN classifiers are also vulnerable to such attacks. In this paper, we present a novel defense method, termed sequence squeezing, to make RNN classifiers more robust against such attacks. Our method differs from previous defense methods which were designed only for non-sequence based models. We also implement four additional RNN defense methods inspired by recently published CNN defense methods. We evaluate our methods against state-of-the-art attacks in the cyber security domain where real adversaries (malware developers) exist, but our methods can be applied against other discrete sequence based adversarial attacks, e.g., in the NLP domain. Using our methods we were able to decrease the effectiveness of such attack from 99.9% to 15%.

Repairing Adversarial Texts through Perturbation

“…The topic is relatively less studied in the text domain [29]. Other than detection using a spell-checker, to the best of our knowledge, the only approach is the one mentioned in [34], which focuses on re-training for improving robustness rather than detecting adversarial texts. In our work, we propose a detection method which is inspired by differential testing [49].…”

“…To the best of our knowledge, there are no existing methods or tools which are available for detecting adversarial texts. Note that the tool mentioned in [34] is not available.…”

“…Existing detection methods for adversarial perturbation mainly focuses on the image domain [27], [28], [29], [30]. Recently, Rosenberg et al devised a method to detect adversarial texts for Recurrent Neural Networks [34]. The idea is to compare the confidence scores of the original input and its squeezed variant.…”

“…This work is related to work on defending adversarial perturbation, which mainly focus on the image domain, e.g., adversarial training [11], [69] and robust optimization [19]. Rosenberg et al [34] presented several defense methods for adversarial texts, like adversarial training in the text domain or training ensemble models. Pruthi et al [65] proposed to place an auxiliary model before the classifier.…”

“…Rejection is however not always feasible or ideal. First, existing detection algorithms often generate a nonnegligible amount of false alarms [29], [30], particularly so for the simple detection algorithms proposed for adversarial texts [34]. Second, rejection may not be an option for certain applications.…”