Essential Features: Content-Adaptive Pixel Discretization to Improve Model Robustness to Adaptive Adversarial Attacks

Feng, Ryan; Feng, Wu-chi; Prakash, Atul

doi:10.48550/arxiv.2012.01699

Cited by 2 publications

(3 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Preprocessing techniques have been popular due to their relative simplicity [6,8,10,15,30]. The idea is that such functions may remove the effects of adversarial perturbations before handing inputs to the model, which could increase robustness.…”

Section: Related Workmentioning

confidence: 99%

“…Recent work by Feng et al [10] has proposed a technique called Essential Features that improves the robustness in higher resolution datasets while constraining the attack space. While we use a different approach, we also try to constrain the attack space.…”

Section: Related Workmentioning

confidence: 99%

“…Preprocessing techniques are one popular type of defense approach [6,8,10,15,30] with varying degrees of success. Such approaches apply transformations such as JPEG [6,8,15], blurring [30], and color bit reduction [15,30] to remove the effects of adversarial noise.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Constraining the Attack Space of Machine Learning Models with Distribution Clamping Preprocessing

Feng¹,

Jha²,

Prakash³

2022

Preprint

Self Cite

View full text Add to dashboard Cite

Preprocessing and outlier detection techniques have both been applied to neural networks to increase robustness with varying degrees of success. In this paper, we formalize the ideal preprocessor function as one that would take any input and set it to the nearest in-distribution input. In other words, we detect any anomalous pixels and set them such that the new input is in-distribution. We then illustrate a relaxed solution to this problem in the context of patch attacks. Specifically, we demonstrate that we can model constraints on the patch attack that specify regions as out of distribution. With these constraints, we are able to preprocess inputs successfully, increasing robustness on CARLA object detection.

show abstract