Image Super-Resolution as a Defense Against Adversarial Attacks

Abstract

Convolutional Neural Networks have achieved significant success across multiple computer vision tasks. However, they are vulnerable to carefully crafted, human-imperceptible adversarial noise patterns which constrain their deployment in critical security-sensitive systems. This paper proposes a computationally efficient image enhancement approach that provides a strong defense mechanism to effectively mitigate the effect of such adversarial perturbations. We show that deep image restoration networks learn mapping functions that can bring off-the-manifold adversarial samples onto the natural image manifold, thus restoring classification towards correct classes. A distinguishing feature of our approach is that, in addition to providing robustness against attacks, it simultaneously enhances image quality and retains models performance on clean images. Furthermore, the proposed method does not modify the classifier or requires a separate mechanism to detect adversarial images. The effectiveness of the scheme has been demonstrated through extensive experiments, where it has proven a strong defense in gray-box settings. The proposed scheme is simple and has the following advantages: (1) it does not require any model training or parameter optimization, (2) it complements other existing defense mechanisms, (3) it is agnostic to the attacked model and attack type and (4) it provides superior performance across all popular attack algorithms. Our codes are publicly available at https:// github.com/aamir-mustafa/super-resolution-adversarial-defense.

Privacy and Security Issues in Deep Learning: A Survey

“…Mustafa et al [181] hypothesized that a generated-well image super-resolution model is enough to project the off-themanifold adversarial samples into the natural image manifold. Therefore, Mustafa et al [181] proposed a defense mechanism, deep image restoration networks, to defend against a wide range of recently proposed adversarial attacks. First, the adversarial perturbation is suppressed by wavelet domain filtering [182].…”

Adversarial Dual Network Learning With Randomized Image Transform for Restoring Attacked Images

“…They introduced a feature denoising method for defending PGD white-box attacks. Reference [32] proposed an efficient approach that bring adversarial samples onto the natural image manifold, restoring classification towards correct classes. Reference [33] maximally separated the polytopes of classes by force to learn distinct and distant decision regions for each classes.…”

Evaluating Robustness of Deep Image Super-Resolution Against Adversarial Attacks

“…Recently, combining the super-resolution tasks with adversarial attacks has emerged. Mustafa et al [16] presents a method employing super-resolution to defense deep image classifiers against adversarial attacks. Yin et al [22] employ the adversarial attack on super-resolution to fool the subsequent computer vision tasks.…”