Detection defense against adversarial attacks with saliency map

Abstract

It is well established that neural networks are vulnerable to adversarial examples, which are almost imperceptible on human vision and can cause the deep models misbehave. Such phenomenon may lead to severely inestimable consequences in the safety and security critical applications. Existing defenses are trend to harden the robustness of models against adversarial attacks, for example, adversarial training technology. However, these are usually intractable to implement due to the high cost of retraining and the cumbersome operations of altering the model architecture or parameters. In this paper, we discuss the saliency map method from the view of enhancing model interpretability, it is similar to introducing the mechanism of the attention to the model, so as to comprehend the progress of object identification by the deep networks. We then propose a novel method combined with additional noises and utilize the inconsistency strategy to detect adversarial examples. Our experimental results of some representative adversarial attacks on common data sets including ImageNet and popular models show that our method can detect all the attacks with high detection success rate effectively. We compare it with the existing state‐of‐the‐art technique, and the experiments indicate that our method is more general.

A data‐driven adversarial examples recognition framework via adversarial feature genomes

“…Therefore, acquiring features about the classes from the differences between adversarial examples and the original images is the key to detect and correctly classify adversarial examples simultaneously. Through surveys and experiments, we observe linkage between the evolutions of the features in the CNNs and the differences of adversarial examples from original images 19,20 . Although the original images and adversarial examples are difficult to be perceived by humans, they have exhibited increasing differences in their feature maps in the feedforward process of the model.…”

“…Through surveys and experiments, we observe linkage between the evolutions of the features in the CNNs and the differences of adversarial examples from original images. 19,20 Although the original images and adversarial examples are difficult to be perceived by humans, they have exhibited increasing differences in their feature maps in the feedforward process of the model. We call it the Adversarial Feature Separability (AFS).…”

Attention‐guided black‐box adversarial attacks with large‐scale multiobjective evolutionary optimization

“…[5][6][7][8][9][10] These perturbations are imperceptible to human beings but can easily fool DNNs, which raises invisible threats to the vision-based automatic decision. [11][12][13][14][15] Consequently, the robustness of DNNs encounters great challenges in real-world applications. 16,17 For example, the existence of AEs can pose severe security threats for traffic sign recognition in autonomous driving.…”

MC‐Net: Learning mutually‐complementary features for image manipulation localization

“…However, this also increases the risk of disinformation crimes caused by manipulations with malicious intention 14–18 . For instance, fake news with maliciously manipulated image (e.g., on COVID‐19) can cause serious negative impacts on national security and social stability 19–22 …”

“…[14][15][16][17][18] For instance, fake news with maliciously manipulated image (e.g., on COVID-19) can cause serious negative impacts on national security and social stability. [19][20][21][22] To alleviate the risks of manipulated images, various manipulation detection methods are proposed to recognize the manipulated images. [23][24][25][26] Early research solve image manipulation detection as a classification task.…”