A Real-time Defense against Website Fingerprinting Attacks

Shan, Shawn; Bhagoji, Arjun Nitin; Zheng, Haitao; Zhao, Ben Y.

doi:10.48550/arxiv.2102.04291

Cited by 2 publications

(2 citation statements)

References 66 publications

(114 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The former generates adversarial textured patches with reinforcement learning, while the latter manipulates real stickers' positions and rotation angles for physical attacks on face recognition. Adversarial patch attacks have also been proposed for other task DNN models, such as object detection [28], [39], [71], semantic segmentation [50], and network traffic analysis [53]. Shapeshifter [8] introduces a physical-world attack on Faster R-CNN object detector [47] by perturbing stop signs.…”

Section: A Adversarial Patch Attacksmentioning

confidence: 99%

DorPatch: Distributed and Occlusion-Robust Adversarial Patch to Evade Certifiable Defenses

He,

Ma,

Zhu

et al. 2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Adversarial patch attacks are among the most practical adversarial attacks. Recent efforts focus on providing a certifiable guarantee on correct predictions in the presence of white-box adversarial patch attacks. In this paper, we propose DorPatch, an effective adversarial patch attack to evade both certifiably robust defenses and empirical defenses. DorPatch employs group lasso on a patch's mask, image dropout, density regularization, and structural loss to generate a fully optimized, distributed, occlusion-robust, and inconspicuous adversarial patch that can be deployed in physical-world adversarial patch attacks. Our extensive experimental evaluation with both digitaldomain and physical-world tests indicates that DorPatch can effectively evade PatchCleanser [64], the state-of-the-art certifiable defense, and empirical defenses against adversarial patch attacks. More critically, mispredicted results of adversarially patched examples generated by DorPatch can receive certification from PatchCleanser, producing a false trust in guaranteed predictions. DorPatch achieves state-of-the-art attacking performance and perceptual quality among all adversarial patch attacks. DorPatch poses a significant threat to real-world applications of DNN models and calls for developing effective defenses to thwart the attack.

show abstract

Section: A Adversarial Patch Attacksmentioning

confidence: 99%

DorPatch: Distributed and Occlusion-Robust Adversarial Patch to Evade Certifiable Defenses

He,

Ma,

Zhu

et al. 2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

“…There have been adversarial patch attacks proposed in other domains such as object detection [39], semantic segmentation [40], and network traffic analysis [41]. In this paper, we focus on test-time attacks against image classification models.…”

Section: A Adversarial Patch Attacksmentioning

confidence: 99%

PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifier

Xiang¹,

Mahloujifar²,

Mittal³

2021

Preprint

View full text Add to dashboard Cite

The adversarial patch attack against image classification models aims to inject adversarially crafted pixels within a localized restricted image region (i.e., a patch) for inducing model misclassification. This attack can be realized in the physical world by printing and attaching the patch to the victim object and thus imposes a real-world threat to computer vision systems. To counter this threat, we propose PatchCleanser as a certifiably robust defense against adversarial patches that is compatible with any image classifier. In PatchCleanser, we perform two rounds of pixel masking on the input image to neutralize the effect of the adversarial patch. In the first round of masking, we apply a set of carefully generated masks to the input image and evaluate the model prediction on every masked image. If model predictions on all one-masked images reach a unanimous agreement, we output the agreed prediction label. Otherwise, we perform a second round of masking to settle the disagreement, in which we evaluate model predictions on two-masked images to robustly recover the correct prediction label. Notably, we can prove that our defense will always make correct predictions on certain images against any adaptive white-box attacker within our threat model, achieving certified robustness. We extensively evaluate our defense on the ImageNet, ImageNette, CIFAR-10, CIFAR-100, SVHN, and Flowers-102 datasets and demonstrate that our defense achieves similar clean accuracy as state-of-theart classification models and also significantly improves certified robustness from prior works. Notably, our defense can achieve 83.8% top-1 clean accuracy and 60.4% top-1 certified robust accuracy against a 2%-pixel square patch anywhere on the 1000class ImageNet dataset.1 Chiang et al. [3] proposed the first certifiably robust defense against adversarial patches via Interval Bound Propagation [15], [16]. This defense does not rely on small receptive fields but requires extremely expansive model training. As a result, it is only applicable to small classification models (with limited performance) and low-resolution images.

show abstract

A Real-time Defense against Website Fingerprinting Attacks

Cited by 2 publications

References 66 publications

DorPatch: Distributed and Occlusion-Robust Adversarial Patch to Evade Certifiable Defenses

DorPatch: Distributed and Occlusion-Robust Adversarial Patch to Evade Certifiable Defenses

PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifier

Contact Info

Product

Resources

About