Defensive dropout for hardening deep neural networks under adversarial attacks

Abstract

Deep neural networks (DNNs) are known vulnerable to adversarial attacks. That is, adversarial examples, obtained by adding delicately crafted distortions onto original legal inputs, can mislead a DNN to classify them as any target labels. This work provides a solution to hardening DNNs under adversarial attacks through defensive dropout. Besides using dropout during training for the best test accuracy, we propose to use dropout also at test time to achieve strong defense effects. We consider the problem of building robust DNNs as an attacker-defender two-player game, where the attacker and the defender know each others' strategies and try to optimize their own strategies towards an equilibrium. Based on the observations of the effect of test dropout rate on test accuracy and attack success rate, we propose a defensive dropout algorithm to determine an optimal test dropout rate given the neural network model and the attacker's strategy for generating adversarial examples. We also investigate the mechanism behind the outstanding defense effects achieved by the proposed defensive dropout. Comparing with stochastic activation pruning (SAP), another defense method through introducing randomness into the DNN model, we find that our defensive dropout achieves much larger variances of the gradients, which is the key for the improved defense effects (much lower attack success rate). For example, our defensive dropout can reduce the attack success rate from 100% to 13.89% under the currently strongest attack i.e., C&W attack on MNIST dataset. arXiv:1809.05165v1 [cs.CR]

Functionality-preserving Adversarial Machine Learning For Robust Classification In Cybersecurity And Intrusion Detection Domains: A Survey

“…Breaking the transferability of adversarial examples is a key challenge for the research community. Currently, defensive dropout [130] at test time is a promising defense. Adversarial example detection is also a useful area of research.…”

“…Functionality-preserving adversarial examples are an interesting avenue for further research. Adversarial Training [69] Distillation as defense [118] Feedback Alignment [119] Assessing Threat [120] Statistical Test [121] Detector SubNetwork [122] Artifacts [123] MagNet [124] Feature Squeezing [125] GAT [96] EAT [126] Defense-GAN [97] Assessing Threat [127] Stochastic Activation Pruning [128] DeepTest [129] DeepRoad [130] Defensive Dropout [130] Def-IDS [99] Multi-Classifier System [131] Weight Map Layers [132] Sequence Squeezing [105] Feature Removal [133] Adversarial Training [134] Adversarial Training [135] Game Theory [136] Hardening [137] Variational Auto-encoder [138] MANDA…”

“…It is particularly useful where there is limited training data and over-fitting is more likely to occur. Wang et al [130] propose hardening DNN using defensive dropout at test time. Unfortunately, there is inherently a trade-off between defensive dropout and test accuracy; however, a relatively small decrease in test accuracy can significantly reduce the success rate of attacks.…”

Generating Adversarial Examples in One Shot With Image-to-Image Translation GAN

“…Implemented under the L 0 , L 2 and L ∞ norm, the CW Attack [7] is the strongest attack in the literature [40], [44], [61]. It is based on L-BFGS [54] and can be targeted or untargeted.…”

Towards Query-Efficient Black-Box Adversary with Zeroth-Order Natural Gradient Descent

“…al. 2018;Madry et al 2017;Wang et al 2019;2018a;Xu et al 2019). This work mainly investigates the first category to build the groundwork towards developing potential defensive measures in reliable ML.…”