Similarity-based Deep Neural Network to Detect Imperceptible Adversarial Attacks

Abstract

Deep neural networks (DNN's) have become essential for solving diverse complex problems and have achieved considerable success in tackling computer vision tasks. However, DNN's are vulnerable to human-imperceptible adversarial distortion/noise patterns that can detrimentally impact safetycritical applications such as autonomous driving. In this paper, we introduce a novel robust-by-design deep learning approach, Si m-DNN, that is able to detect adversarial attacks through its inner defense mechanism that considers the degree of similarity between new data samples and autonomously chosen prototypes. The approach benefits from the abrupt drop of the similarity score to detect concept changes caused by distorted/noise data when comparing their similarities against the set of prototypes. Due to the feed-forward prototypebased architecture of Si m-DNN, no re-training or adversarial training is required. In order to evaluate the robustness of the proposed method, we considered the recently introduced ImageNet-R dataset and different adversarial attack methods such as FGSM, PGD, and DDN. Different DNN's methods were also considered in the analysis. Results have shown that the proposed Si m-DNN is able to detect adversarial attacks with better performance than its mainstream competitors. Moreover, as no adversarial training is required by Si m-DNN, its performance on clean and robust images is more stable than its competitors which require an external defense mechanism to improve their robustness.

Domain Generalization and Feature Fusion for Cross-domain Imperceptible Adversarial Attack Detection

“…After extracting feature maps from attacked and clean images, we aim to efficiently recover lost information from the highlevel representations with a simple network. Conventional feature fusion methods commonly focus on fusing with different resolutions [11], [21]. However, we observe that the attack detection performance is still limited, which will be further confirmed in Section IV.C.…”

“…3) Sim-DNN: As one of the deep learning-based detection techniques, Soares et al propose a similarity-based deep neural network (sim-DNN) to detect adversarial attacks [21]. The degree of similarity between training samples and their prototypes is considered.…”

“…2. Different from conventional attack detection methods [16], [21], in the data pre-processing stage, each image sample are attacked with random error rates and individually fed to each layer. Then, feature maps are extracted from the attacked and clean images.…”

“…The adversarial samples from these datasets are constructed with FGSM, PGD, and SSAH attacks. We select these attacks because they are robust to novel adversarial attack detection and defense techniques [15], [21]. Each one is The error rate In the experiment, the detection rate (DR) [21] is used as the performance measure.…”

Soft Body Pose-Invariant Evasion Attacks against Deep Learning Human Detection

“…We believe defence strategies [23] should be considered in future research to improve transportation engineering's safety in this new area. Potential future work direction include using Topological Data Analysis [24] to identify evasion features, adversarial training, and detection strategies [25].…”