On the (Statistical) Detection of Adversarial Examples

Abstract

Machine Learning (ML) models are applied in a variety of tasks such as network intrusion detection or malware classification. Yet, these models are vulnerable to a class of malicious inputs known as adversarial examples. These are slightly perturbed inputs that are classified incorrectly by the ML model. The mitigation of these adversarial inputs remains an open problem.As a step towards understanding adversarial examples, we show that they are not drawn from the same distribution than the original data, and can thus be detected using statistical tests. Using this knowledge, we introduce a complimentary approach to identify specific inputs that are adversarial. Specifically, we augment our ML model with an additional output, in which the model is trained to classify all adversarial inputs.We evaluate our approach 1 on multiple adversarial example crafting methods (including the fast gradient sign and saliency map methods) with several datasets. The statistical test flags sample sets containing adversarial inputs confidently at sample sizes between 10 and 100 data points. Furthermore, our augmented model either detects adversarial examples as outliers with high accuracy (> 80%) or increases the adversary's cost-the perturbation added-by more than 150%. In this way, we show that statistical properties of adversarial examples are essential to their detection. 2

Detect & Reject for Transferability of Black-box Adversarial Attacks Against Network Intrusion Detection Systems

“…Szegedy et al [18] was the first work to report the vulnerability of DNN to adversarial samples where they introduced imperceptible adversarial perturbations to handwritten digits images and succeeded to fool the DNN model with high confidence. This discovery has prompted a number of studies in the computer vision community, where several attacks and defenses have been proposed [9,12,10]. There are some works [14,22,11] dealing with the transferability of adversarial attacks.…”

“…The second defense we consider is the Detect & Reject method [10], which involves training our IDSs to detect not only "abnormal" and "normal" traffic, but also a third class called "adversarial". Thus, whenever the IDS decides that a network traffic record is adversarial, it is rejected.…”

A Fast and Effective Large-Scale Two-Sample Test Based on Kernels

“…Two-sample hypothesis testing plays a significant role in a variety of scientific applications, such as bioinformatics, social sciences, and image analysis (Fox and Dimmic, 2006;Osborne et al, 2013;Kohout and Pevnỳ, 2017). As we entering the big data era, high-dimensional and large-scale data is becoming prevalent, particulalry in machine learning and deep learning applications, and the attention to the two-sample testing method for large-scale data is also naturally increasing (Sutherland et al, 2016;Grosse et al, 2017;Carlini and Wagner, 2017;Gao et al, 2020).…”

Consistent Semantic Attacks on Optical Flow

“…To achieve this goal, the defender can, for example, use some AA detection method to discard suspicious inputs. One approach to detect AAs [15,44], is to examine the input to the attacked model. Another approach, which we consider in this paper, is to examine the output of the attacked model.…”