A data‐driven adversarial examples recognition framework via adversarial feature genomes

Abstract

Adversarial examples pose many security threats to convolutional neural networks (CNNs). Most defense algorithms prevent these threats by finding differences between the original images and adversarial examples. However, the found differences do not contain features about the classes, so these defense algorithms can only detect adversarial examples without recovering the correct labels. In this regard, we propose the Adversarial Feature Genome (AFG), a novel type of data that contain both the differences and features about classes. This method is inspired by an observed phenomenon, namely, the Adversarial Feature Separability, where the difference between the feature maps of the original images and adversarial examples becomes larger with deeper layers. On top of that, we further develop an adversarial example recognition framework that detects adversarial examples and can recover the correct labels. In the experiments, the detection and classification of adversarial examples by AFGs has an accuracy of more than 90.01% in various attack scenarios. To the best of our knowledge, our method is the first method that focuses on both attack detecting and recovering. AFG gives a new data‐driven perspective to improve the robustness of CNNs.

Attention‐guided black‐box adversarial attacks with large‐scale multiobjective evolutionary optimization

“…[5][6][7][8][9][10] These perturbations are imperceptible to human beings but can easily fool DNNs, which raises invisible threats to the vision-based automatic decision. [11][12][13][14][15] Consequently, the robustness of DNNs encounters great challenges in real-world applications. 16,17 For example, the existence of AEs can pose severe security threats for traffic sign recognition in autonomous driving.…”

“…In the past decade, a series of studies have shown that DNNs are vulnerable to adversarial examples (AEs) by imposing some designed perturbations to original images 5–10 . These perturbations are imperceptible to human beings but can easily fool DNNs, which raises invisible threats to the vision‐based automatic decision 11–15 . Consequently, the robustness of DNNs encounters great challenges in real‐world applications 16,17 .…”