Part-Based Feature Squeezing To Detect Adversarial Examples in Person Re-Identification Networks

Zheng, Yu; Velipasalar, Senem

doi:10.1109/icip42928.2021.9506511

Cited by 6 publications

(1 citation statement)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Zheng et al. [ 26 ] proposed a part-based feature squeezing, which is specialized in person re-identification (ReID) field, by extending Feature Squeezing. Different from the Feature Squeezing, which uses a squeezer to the entire image, Zheng et al.’s method divides the image into several parts and uses a squeezer to each part.…”

Section: Preliminaries and Related Workmentioning

confidence: 99%

Clustering Approach for Detecting Multiple Types of Adversarial Examples

Choi

Bahk

Ahn

et al. 2022

Sensors

View full text Add to dashboard Cite

With intentional feature perturbations to a deep learning model, the adversary generates an adversarial example to deceive the deep learning model. As an adversarial example has recently been considered in the most severe problem of deep learning technology, its defense methods have been actively studied. Such effective defense methods against adversarial examples are categorized into one of the three architectures: (1) model retraining architecture; (2) input transformation architecture; and (3) adversarial example detection architecture. Especially, defense methods using adversarial example detection architecture have been actively studied. This is because defense methods using adversarial example detection architecture do not make wrong decisions for the legitimate input data while others do. In this paper, we note that current defense methods using adversarial example detection architecture can classify the input data into only either a legitimate one or an adversarial one. That is, the current defense methods using adversarial example detection architecture can only detect the adversarial examples and cannot classify the input data into multiple classes of data, i.e., legitimate input data and various types of adversarial examples. To classify the input data into multiple classes of data while increasing the accuracy of the clustering model, we propose an advanced defense method using adversarial example detection architecture, which extracts the key features from the input data and feeds the extracted features into a clustering model. From the experimental results under various application datasets, we show that the proposed method can detect the adversarial examples while classifying the types of adversarial examples. We also show that the accuracy of the proposed method outperforms the accuracy of recent defense methods using adversarial example detection architecture.

show abstract

Section: Preliminaries and Related Workmentioning

confidence: 99%

Clustering Approach for Detecting Multiple Types of Adversarial Examples

Choi

Bahk

Ahn

et al. 2022

Sensors

View full text Add to dashboard Cite

show abstract

Robust Person Re-identification with Adversarial Examples Detection and Perturbation Extraction

Chen

2022

Pattern Recognition and Computer Vision

View full text Add to dashboard Cite

2N labeling defense method against adversarial attacks by filtering and extended class label set

Szücs

Kiss

2022

Multimed Tools Appl

View full text Add to dashboard Cite

The fast improvement of deep learning methods resulted in breakthroughs in image classification, however, these models are sensitive to adversarial perturbations, which can cause serious problems. Adversarial attacks try to change the model output by adding noise to the input, in our research we propose a combined defense method against it. Two defense approaches have been evolved in the literature, one robustizes the attacked model for higher accuracy, and the other approach detects the adversarial examples. Only very few papers discuss both approaches, thus our aim was to combine them to obtain a more robust model and to examine the combination, in particular the filtering capability of the detector. Our contribution was that the filtering based on the decision of the detector is able to enhance the accuracy, which was theoretically proved. Besides that, we developed a novel defense method called 2N labeling, where we extended the idea of the NULL labeling method. While the NULL labeling suggests only one new class for the adversarial examples, the 2N labeling method suggests twice as much. The novelty of our idea is that a new extended class is assigned to each original class, as the adversarial version of it, thus it assists the detector and robust classifier as well. The 2N labeling method was compared to competitor methods on two test datasets. The results presented that our method surpassed the others, and it can operate with a constant classification performance regardless of the presence or amplitude of adversarial attacks.

show abstract

Part-Based Feature Squeezing To Detect Adversarial Examples in Person Re-Identification Networks

Cited by 6 publications

References 19 publications

Clustering Approach for Detecting Multiple Types of Adversarial Examples

Clustering Approach for Detecting Multiple Types of Adversarial Examples

Robust Person Re-identification with Adversarial Examples Detection and Perturbation Extraction

2N labeling defense method against adversarial attacks by filtering and extended class label set

Contact Info

Product

Resources

About