Closer Look at the Transferability of Adversarial Examples: How They Fool Different Models Differently

Waseda, Futa; Nishikawa, Sosuke; Le, Trung-Nghia; Nguyen, Huy H.; Echizen, Isao

doi:10.1109/wacv56688.2023.00141

Cited by 18 publications

(1 citation statement)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We find out that the accuracy of the targeted model is almost similar to un-targeted DNN models. Researchers in [29] addressed the same issue, naming it "transferability" of adversarial examples, meaning that the generated samples from adversarial attacks on one targeted DNN model may work on different un-targeted DNN models. Therefore, a model from a different approach is interesting to be studied, and we selected Random Forest (RF) [30] decision tree-based classifier model for our study, considering all the challenges of using this limited model for image classification.…”

Section: Motivation and Threat Modelmentioning

confidence: 99%

Adversarial-Aware Deep Learning System Based on a Secondary Classical Machine Learning Verification Approach

Alkhowaiter

Kholidy

Alyami

et al. 2023

Sensors

View full text Add to dashboard Cite

Deep learning models have been used in creating various effective image classification applications. However, they are vulnerable to adversarial attacks that seek to misguide the models into predicting incorrect classes. Our study of major adversarial attack models shows that they all specifically target and exploit the neural networking structures in their designs. This understanding led us to develop a hypothesis that most classical machine learning models, such as random forest (RF), are immune to adversarial attack models because they do not rely on neural network design at all. Our experimental study of classical machine learning models against popular adversarial attacks supports this hypothesis. Based on this hypothesis, we propose a new adversarial-aware deep learning system by using a classical machine learning model as the secondary verification system to complement the primary deep learning model in image classification. Although the secondary classical machine learning model has less accurate output, it is only used for verification purposes, which does not impact the output accuracy of the primary deep learning model, and, at the same time, can effectively detect an adversarial attack when a clear mismatch occurs. Our experiments based on the CIFAR-100 dataset show that our proposed approach outperforms current state-of-the-art adversarial defense systems.

show abstract

Section: Motivation and Threat Modelmentioning

confidence: 99%