Encryption Inspired Adversarial Defense for Visual Classification

AprilPyone, MaungMaung; Kiya, Hitoshi

doi:10.48550/arxiv.2005.07998

Cited by 1 publication

(2 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In experiments, the proposed defense is confirmed to outperform state-of-the-art adversarial defenses. A part of this work (Pixel Shuffling) was introduced in [28]. We not only evaluate Pixel Shuffling under both black-box and white-box attacks with different metrics, and adaptive attacks with key estimation approaches but also introduce other novel algorithms in this paper.…”

Section: Clean Imagementioning

confidence: 99%

“…In the case of FFX Encryption, there is an additional parameter, password P , for format-preserving encryption. Although one of the three algorithms (Pixel Shuffling) was discussed in our previous work [28], we extend the evaluation of Pixel Shuffling with various white-box and black-box attacks under different metrics and adaptive attacks with key estimation in this paper.…”

Section: Three Proposed Block-wise Transformationsmentioning

confidence: 99%

See 1 more Smart Citation

Block-wise Image Transformation with Secret Key for Adversarially Robust Defense

AprilPyone¹,

Kiya²

2020

Preprint

Self Cite

View full text Add to dashboard Cite

In this paper, we propose a novel defensive transformation that enables us to maintain a high classification accuracy under the use of both clean images and adversarial examples for adversarially robust defense. The proposed transformation is a block-wise preprocessing technique with a secret key to input images. We developed three algorithms to realize the proposed transformation: Pixel Shuffling, Bit Flipping, and FFX Encryption. Experiments were carried out on the CIFAR-10 and ImageNet datasets by using both black-box and white-box attacks with various metrics including adaptive ones. The results show that the proposed defense achieves high accuracy close to that of using clean images even under adaptive attacks for the first time. In the best-case scenario, a model trained by using images transformed by FFX Encryption (block size of 4) yielded an accuracy of 92.30 % on clean images and 91.48 % under PGD attack with a noise distance of 8/255, which is close to the non-robust accuracy (95.45 %) for the CIFAR-10 dataset, and it yielded an accuracy of 72.18 % on clean images and 71.43 % under the same attack, which is also close to the standard accuracy (73.70 %) for the ImageNet dataset. Overall, all three proposed algorithms are demonstrated to outperform state-ofthe-art defenses including adversarial training whether or not a model is under attack.

show abstract

Section: Clean Imagementioning

confidence: 99%

Section: Three Proposed Block-wise Transformationsmentioning

confidence: 99%