Combatting Adversarial Attacks through Denoising and Dimensionality Reduction: A Cascaded Autoencoder Approach

Abstract

Machine Learning models are vulnerable to adversarial attacks that rely on perturbing the input data. This work proposes a novel strategy using Autoencoder Deep Neural Networks to defend a machine learning model against two gradient-based attacks: The Fast Gradient Sign attack and Fast Gradient attack. First we use an autoencoder to denoise the test data, which is trained with both clean and corrupted data. Then, we reduce the dimension of the denoised data using the hidden layer representation of another autoencoder. We perform this experiment for multiple values of the bound of adversarial perturbations, and consider different numbers of reduced dimensions. When the test data is preprocessed using this cascaded pipeline, the tested deep neural network classifier yields a much higher accuracy, thus mitigating the effect of the adversarial perturbation.

A Generative Model based Adversarial Security of Deep Learning and Linear Classifier Models

“…These autoencoders are specifically designed to compress data effectively and reduce dimensions. Hence, it may not be wholly generalized, and training with corrupted data requires a lot of adjustments to get better test results [33]. Their model provide that when test data is preprocessed using this cascading, the tested deep neural network classifier provides much higher accuracy, thus mitigating the effect of the adversarial perturbation.…”

“…Combatting Adversarial Attacks through Denoising and Dimensionality Reduction: A Cascaded Autoencoder Approach [33] They have used an autoencoder to denoise the test data which is trained with both corrupted and normal data. Then they reduce the dimension of the denoised data.…”

Frequency Centric Defense Mechanisms against Adversarial Examples

“…One such use of convolutional auto-encoders to purify AEs has been described in [8]. As shown by [16] dimensionality reduction using an autoencoder is also an effective defense against adversarial attacks. The method uses autoencoder to perform denoising of FGSM attack on MNIST dataset.…”

Ensemble Noise Simulation to Handle Uncertainty about Gradient-based Adversarial Attacks

“…Often, these methods are, without modification, employed to mitigate attacks generated using a disparate classifier's gradient with less success than in the case where the attack is based on the victim classifier's gradient [2]. For example, defenses based on Principal Components Analysis (PCA) [3], autoencoder-based dimensionality reduction [4], [5], and denoising autoencoders [5] suffer a severe degradation of performance in architecture mismatch settings. Recent work has proposed training multiple DAEs (for filtering instead of dimensionality reduction) and randomly selecting one as a defense at test time [6].…”