Effectiveness of Random Deep Feature Selection for Securing Image Manipulation Detectors Against Adversarial Examples

Abstract

We investigate if the random feature selection approach proposed in [1] to improve the robustness of forensic detectors to targeted attacks, can be extended to detectors based on deep learning features. In particular, we study the transferability of adversarial examples targeting an original CNN image manipulation detector to other detectors (a fully connected neural network and a linear SVM) that rely on a random subset of the features extracted from the flatten layer of the original network. The results we got by considering three image manipulation detection tasks (resizing, median filtering and adaptive histogram equalization), two original network architectures and three classes of attacks, show that feature randomization helps to hinder attack transferability, even if, in some cases, simply changing the architecture of the detector, or even retraining the detector is enough to prevent the transferability of the attacks.

Multitask adversarial attack with dispersion amplification

“…In each case, transferability was low with cross-model-and-training scenario showing the lowest attack transferability. In the further work [15], Barni at al. proposed an effective method for the detection of adversarial attacks and effective protection of image forensics approaches from those attacks.…”

Defending Neural ODE Image Classifiers from Adversarial Attacks with Tolerance Randomization

“…This sprouted a huge offer of defensive methodologies against adversarial samples in this scenario, such as model enhancing via distillation [21] and adversarial sample detection via statistical methods [9] or auxiliary models [18,4]. Among them, most promising methods are based on the introduction of randomization in the prediction process [24,1]. Feinman et al [7] propose a detection scheme based on randomizing the output of the network using dropout that mostly relate with the rationale of our proposed detection method.…”

A Survey of Machine Learning Techniques in Adversarial Image Forensics

“…Randomization strategy is another method in this category that can be employed to enhance the robustness for forensic detectors on DL for general models and standard-based forensics [82,83]. Zhang et al, [82] they optimized the feature sets, which intrinsically become secure against a PK attack by considering feature selection method on adversarial samples that increase the security versus attacks at test time.…”

“…Therefore, feature randomization plays an important role in the security-related application when a small set of features are considered to overcome the complexity or even enhance the performance of classification to tackle adversarial attacks. Barni et al, [83] considered random feature selection strategy that can improve the security and robustness of forensic detectors for the general model and standard ML-based to mitigate the adversarial dangerousness attacks. The experiments prove that feature randomization strategy reducing the transferability of attacks, and increase the security of detection even in the presence of mismatch architectures.…”