Detecting adversarial examples by positive and negative representations

New Adversarial Image Detection Based on Sentiment Analysis

“…• LID [5] • PNDetector [10] assumes the misclassification space is randomly distributed in the ideal feature space of a pre-trained classifier. PNDetector is a positive-negative classifier trained by original examples (positive representations) and their negative representations that share the same structural and semantic features.…”

“…A recent and effective approach to detecting adversarial attacks takes the feature maps produced by the hidden layers of a DNN (e.g., a DNN-based image classifier) as input, and detects adversarial input examples by measuring the difference between benign and adversarial feature maps [5]- [10]. For instance, a detection method named Local Intrinsic Dimensionality (LID) [5] uses the difference of dimension between the subspaces surrounding adversarial examples and Y. Wang and T. Li are with the State Key Laboratory of Networking and Switching Technology, School of Computer Science (National Pilot Software Engineering School), Beijing University of Posts and Telecommunications, Beijing 100876, China (e-mail: {wyl, tianxiangtx}@bupt.edu.cn).…”

“…It uses the hidden-layer representations provided by self-supervised learning (SSL) and the DNN's predicted label to examine the relation between adversarial examples and their augmented versions. Moreover, Positive-Negative Detector (PNDetector) [10] trains a positive-negative classifier against both benign examples (positive representations) and their negative representations that complement the benign examples in each pixel to identify adversarial examples. The above existing adversarial example detectors [5]- [10] depend primarily on machine learning techniques or handcrafted measures.…”

“…Moreover, Positive-Negative Detector (PNDetector) [10] trains a positive-negative classifier against both benign examples (positive representations) and their negative representations that complement the benign examples in each pixel to identify adversarial examples. The above existing adversarial example detectors [5]- [10] depend primarily on machine learning techniques or handcrafted measures. Despite performing reasonably well against some mild types of attacks (e.g., FGSM [11] and Jacobianbased salience map attack (JSMA) [12]), the existing adversarial example detectors are less effective in detecting mighty attacks, such as DeepFool [13] and Elastic-Net Attacks on DNNs (EAD) [14].…”

“…• New sentiment analysis-based interpretation of adversarial example detection and meticulous selection of TextCNN for sentiment analysis, through rigorous experimental comparisons with other candidate neural network structures; • New modular design of an embedding layer, which reshapes and embeds the differently-sized, 3D hidden-layer feature maps of a DNN to word vectors with equal length (and assembles sentences for sentiment analysis) using the minimum number of trainable parameters; • Extensive experiments that corroborate the superior effectiveness and generalization ability of the proposed adversarial example detector under the latest adversarial example attacks compared to the state-of-the-art adversarial example detectors. The experiments demonstrate that the new adversarial example detector consistently outperforms the state-of-the-art detection algorithms, such as LID [5], DkNN [6], NNIF [7], BE-YOND [9], PNDetector [10] and Mahalanobis algorithm [8], in identifying the latest attacks, including AutoAttack [15], DeepFool [13] and EAD [14], on the CIFAR-10, CIFAR-100, and SVHN datasets. We use Bhattacharyya distance [16], hidden layer visualization, and ablation study to shed insight on the gain of the new detector.…”