Integration of statistical detector and Gaussian noise injection detector for adversarial example detection in deep neural networks

Fan, Weiqi; Sun, Guangling; Su, Yuying; Li, Zhi; Lu, Xiaofeng

doi:10.1007/s11042-019-7353-6

Cited by 23 publications

(10 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We next compare the performance of the combination of the two detectors with that of the integrated detector [12] and feature squeezing detector [33]. e proposed detector achieves highest TPR on adversarial examples produced by FGSM, R-FGSM, BIM, and UAP.…”

Section: Results Of Combination Of Two Detectorsmentioning

confidence: 99%

“…Xu et al [33] introduced feature squeezing, an approach to detect adversarial examples by comparing the predictions of the targeted network on the original input and the squeezed input. Fan et al [12] proposed an integrated detection framework comprising the statistical detector and Gaussian noise injection detector to filter out adversarial examples with different characteristics of perturbations.…”

Section: Adversarial Examples Detectingmentioning

confidence: 99%

“…e minor alteration detector relies on crafting minor alterations to an input image and discovering the difference in output between the original and altered examples to distinguish adversarial example from legitimate one. is aspect differs in two respects from our previous work [12]: the first is that we extract a detection feature from three channels instead of using the average of three channels; the other is that minor geometric alterations are performed instead of Gaussian noise corruption on the input image.…”

Section: Introductionmentioning

confidence: 96%

“…Performance of the combination of the two detectors vs. the integrated detector[12] and feature squeezing detector[33] (%).…”

mentioning

confidence: 99%

See 3 more Smart Citations

Complete Defense Framework to Protect Deep Neural Networks against Adversarial Examples

Sun

Qin

et al. 2020

Mathematical Problems in Engineering

Self Cite

View full text Add to dashboard Cite

Although Deep Neural Networks (DNNs) have achieved great success on various applications, investigations have increasingly shown DNNs to be highly vulnerable when adversarial examples are used as input. Here, we present a comprehensive defense framework to protect DNNs against adversarial examples. First, we present statistical and minor alteration detectors to filter out adversarial examples contaminated by noticeable and unnoticeable perturbations, respectively. Then, we ensemble the detectors, a deep Residual Generative Network (ResGN), and an adversarially trained targeted network, to construct a complete defense framework. In this framework, the ResGN is our previously proposed network which is used to remove adversarial perturbations, and the adversarially trained targeted network is a network that is learned through adversarial training. Specifically, once the detectors determine an input example to be adversarial, it is cleaned by ResGN and then classified by the adversarially trained targeted network; otherwise, it is directly classified by this network. We empirically evaluate the proposed complete defense on ImageNet dataset. The results confirm the robustness against current representative attacking methods including fast gradient sign method, randomized fast gradient sign method, basic iterative method, universal adversarial perturbations, DeepFool method, and Carlini & Wagner method.

show abstract

Section: Results Of Combination Of Two Detectorsmentioning

confidence: 99%

Section: Adversarial Examples Detectingmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 96%

“…Performance of the combination of the two detectors vs. the integrated detector[12] and feature squeezing detector[33] (%).…”

mentioning

confidence: 99%

See 2 more Smart Citations

Complete Defense Framework to Protect Deep Neural Networks against Adversarial Examples

Sun

Qin

et al. 2020

Mathematical Problems in Engineering

Self Cite

View full text Add to dashboard Cite

show abstract

“…However, these detection methods cannot effectively resist C&W attacks. Some works elaborate the detection based on preprocessing manipulations, such as denoising filter (DF for short) via scalar quantization and smoothing spatial filter [17], feature squeezing (FS for short) [18], the Gaussian noise injection detector [19]. Inspired by the view that "the adversarial attack can be treated as a sort of accidental steganography" provide by Goodfellow et al [20], some steganalysis-based methods are proposed, such as ESRM [21], SRNet [22].…”

Section: Introductionmentioning

confidence: 99%

Detecting C&W Adversarial Images Based on Noise Addition-Then-Denoising

Deng

Peng

Dong

et al. 2021

2021 IEEE International Conference on Image Processing (ICIP)

View full text Add to dashboard Cite

In this paper, we focus on detecting adversarial images generated by the white-box adversarial attack proposed by Carlini and Wagner (C&W for short). The C&W attack is one of the most powerful attacks which has achieved nearly 100% attack success rates for fooling deep neural network (DNN) yet keeping the visual quality of adversarial image. Considering that the C&W attack optimizes a loss function based on the logit layer of DNN to find adversarial perturbations, we first add Gaussian noise to destroy the perturbations. For the high-confidence adversarial image, a strong Gaussian noise is employed. In order to reduce the impact of such strong noise on a legitimate image, a FFDNet filter is utilized to execute denoising. By comparing the prediction on a test image with that on its noise added-thendenoised version, the proposed method detects the test image as adversarial when the predictions are different. The experiments on ImageNet show that the proposed method can effectively detect targeted and un-targeted C&W adversarial images generated on famous models: Resnet-50, Inception v2, and Inception v3, achieving higher F1 scores than the-stateof-art.

show abstract