Improving adversarial robustness of deep neural networks by using semantic information

Wang, Lina; Chen, Xingshu; Tang, Rui; Yue, Yawei; Zhu, Yi; Zeng, Xuemei; Wang, Wei

doi:10.1016/j.knosys.2021.107141

Cited by 14 publications

(7 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Since the discovery that neural networks are vulnerable to artificial perturbations, a series of attack methods have emerged to evaluate the robustness of networks [3,6,17,18,25,26,29,34]. These attack models design small perturbations to clean samples to generate various adversarial examples.…”

Section: Attack Models and Defense Methodsmentioning

confidence: 99%

“…With the development of attack models, corresponding defense mechanisms have been continuously strengthened; see, e.g., adversarial training [18,34,39], certified robustness [5,10] and detection methods [9]. Among them, adversarial training [18], which minimizes the worst-case loss in the perturbation region, is considered to be one of the most powerful defenses.…”

Section: Attack Models and Defense Methodsmentioning

confidence: 99%

“…Neural networks have achieved impressive performance in many challenging computer vision tasks [13,15,16,32]. But it was soon realized that they are vulnerable to artificial adversarial perturbations [8,26,34,37]. Imposing human imperceptible perturbations on clean data could deceive the networks and cause incorrect classification.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

An Orthogonal Classifier for Improving the Adversarial Robustness of Neural Networks

Xu¹,

Li²,

Yang³

2021

Preprint

View full text Add to dashboard Cite

Neural networks are susceptible to artificially designed adversarial perturbations. Recent efforts have shown that imposing certain modifications on classification layer can improve the robustness of the neural networks. In this paper, we explicitly construct a dense orthogonal weight matrix whose entries have the same magnitude, thereby leading to a novel robust classifier. The proposed classifier avoids the undesired structural redundancy issue in previous work. Applying this classifier in standard training on clean data is sufficient to ensure the high accuracy and good robustness of the model. Moreover, when extra adversarial samples are used, better robustness can be further obtained with the help of a special worst-case loss. Experimental results show that our method is efficient and competitive to many state-of-the-art defensive approaches. Our code is available at https://github.com/MTandHJ/roboc.

show abstract

Section: Attack Models and Defense Methodsmentioning

confidence: 99%

Section: Attack Models and Defense Methodsmentioning

confidence: 99%

See 1 more Smart Citation

An Orthogonal Classifier for Improving the Adversarial Robustness of Neural Networks

Xu¹,

Li²,

Yang³

2021

Preprint

View full text Add to dashboard Cite

show abstract

“…Moosavi-Dezfooli et al [20] also created another method to compute the image-agnostic 'universal adversarial perturbations' based on DeepFool. Lina Wang et al [21] proposed TUP method to compute targeted universal adversarial perturbations that can extract semantic information that is missing by the classifiers, and they also found that adversarial training based on TUP greatly improves robustness of deep neural networks. Baluja and Fischer [22] used a feed-forward neural network named Adversarial Transformation Networks (ATNs) to generate adversarial examples.…”

Section: Related Workmentioning

confidence: 99%

Analyzing Adversarial Robustness of Deep Neural Networks in Pixel Space: a Semantic Perspective

Wang¹,

Chen²,

Wang³

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

The vulnerability of deep neural networks to adversarial examples, which are crafted maliciously by modifying the inputs with imperceptible perturbations to misled the network produce incorrect outputs, reveals the lack of robustness and poses security concerns. Previous works study the adversarial robustness of image classifiers on image level and use all the pixel information in an image indiscriminately, lacking of exploration of regions with different semantic meanings in the pixel space of an image. In this work, we fill this gap and explore the pixel space of the adversarial image by proposing an algorithm to looking for possible perturbations pixel by pixel in different regions of the segmented image. The extensive experimental results on CIFAR-10 and ImageNet verify that searching for the modified pixel in only some pixels of an image can successfully launch the onepixel adversarial attacks without requiring all the pixels of the entire image, and there exist multiple vulnerable points scattered in different regions of an image. We also demonstrate that the adversarial robustness of different regions on the image varies with the amount of semantic information contained.

show abstract

“…The theoretical foundations behind the development of negative models are examined, including concepts such as the loss function and gradient optimization [3]. Additionally, three popular algorithms used to generate adversarial examples are discussed: the fast gradient sign method (FGSM), the projected gradient downward (PGD), and the Carlini-Wagner (CW) method [4][5][6][7]. The FGSM algorithm is one of the simplest and most widely used methods for generating adversarial examples.…”

Section: Introductionmentioning

confidence: 99%

Evaluating the Robustness of Deep Learning Models against Adversarial Attacks: An Analysis with FGSM, PGD and CW

Villegas-Ch,

Jaramillo-Alcázar,

Luján-Mora

2024

BDCC

View full text Add to dashboard Cite

This study evaluated the generation of adversarial examples and the subsequent robustness of an image classification model. The attacks were performed using the Fast Gradient Sign method, the Projected Gradient Descent method, and the Carlini and Wagner attack to perturb the original images and analyze their impact on the model’s classification accuracy. Additionally, image manipulation techniques were investigated as defensive measures against adversarial attacks. The results highlighted the model’s vulnerability to conflicting examples: the Fast Gradient Signed Method effectively altered the original classifications, while the Carlini and Wagner method proved less effective. Promising approaches such as noise reduction, image compression, and Gaussian blurring were presented as effective countermeasures. These findings underscore the importance of addressing the vulnerability of machine learning models and the need to develop robust defenses against adversarial examples. This article emphasizes the urgency of addressing the threat posed by harmful standards in machine learning models, highlighting the relevance of implementing effective countermeasures and image manipulation techniques to mitigate the effects of adversarial attacks. These efforts are crucial to safeguarding model integrity and trust in an environment marked by constantly evolving hostile threats. An average 25% decrease in accuracy was observed for the VGG16 model when exposed to the Fast Gradient Signed Method and Projected Gradient Descent attacks, and an even more significant 35% decrease with the Carlini and Wagner method.

show abstract

Improving adversarial robustness of deep neural networks by using semantic information

Cited by 14 publications

References 19 publications

An Orthogonal Classifier for Improving the Adversarial Robustness of Neural Networks

An Orthogonal Classifier for Improving the Adversarial Robustness of Neural Networks

Analyzing Adversarial Robustness of Deep Neural Networks in Pixel Space: a Semantic Perspective

Evaluating the Robustness of Deep Learning Models against Adversarial Attacks: An Analysis with FGSM, PGD and CW

Contact Info

Product

Resources

About