Real-Time Detectors for Digital and Physical Adversarial Inputs to Perception Systems

Kantaros, Yiannis; Carpenter, Taylor J.; Sridhar, Kaustubh; Yang, Yahan; Lee, Insup; Weimer, James

doi:10.48550/arxiv.2002.09792

Cited by 2 publications

(7 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Modifying Data the defenses that fall in this category are the ones that modify the input data at run-time to defend from AEs. Possible approaches are based on data compression and filtering [10], [21], [11] or data randomization [22].…”

Section: Defensesmentioning

confidence: 99%

“…Previous work used input transformations [22], [11], [21], [10] but, to the best of our records, none of them presented an extensive experimental evaluation to determine which transformations are the most effective in terms of detection rate. Furthermore, still to our records, no counter-measure for robust AEs has been presented before.…”

Section: This Workmentioning

confidence: 99%

“…These findings suggest that standard AEs can be detected by measuring how the network prediction changes when an input image is replaced with the same one processed with a given transformation. The two network predictions can then be compared by the Kullback-Leibler (KL) divergence [11], so that an input image is considered to be adversarial if the two predictions are "distant" from each other, and non-adversarial if the two predictions are "close" to each other. A binary classification can then be obtained by applying a threshold to the output of the KL module.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Detecting Adversarial Examples by Input Transformations, Defense Perturbations, and Voting

Nesti,

Biondi,

Buttazzo

2021

Preprint

View full text Add to dashboard Cite

Over the last few years, convolutional neural networks (CNNs) have proved to reach super-human performance in visual recognition tasks. However, CNNs can easily be fooled by adversarial examples, i.e., maliciously-crafted images that force the networks to predict an incorrect output while being extremely similar to those for which a correct output is predicted. Regular adversarial examples are not robust to input image transformations, which can then be used to detect whether an adversarial example is presented to the network. Nevertheless, it is still possible to generate adversarial examples that are robust to such transformations. This paper extensively explores the detection of adversarial examples via image transformations and proposes a novel methodology, called defense perturbation, to detect robust adversarial examples with the same input transformations the adversarial examples are robust to. Such a defense perturbation is shown to be an effective counter-measure to robust adversarial examples. Furthermore, multi-network adversarial examples are introduced. This kind of adversarial examples can be used to simultaneously fool multiple networks, which is critical in systems that use network redundancy, such as those based on architectures with majority voting over multiple CNNs. An extensive set of experiments based on state-of-the-art CNNs trained on the Imagenet dataset is finally reported.

show abstract

Section: Defensesmentioning

confidence: 99%

Section: This Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Detecting Adversarial Examples by Input Transformations, Defense Perturbations, and Voting

Nesti,

Biondi,

Buttazzo

2021

Preprint

View full text Add to dashboard Cite

show abstract

“…However, they did not specify which features should be squeezed. Kantaros et al [43] observed that adversarial examples are sensitive to lossy compression transformations. They proposed VisionGuard to real-time detect large-scale adversarial examples.…”

Section: Related Workmentioning

confidence: 99%

“…Human eyes have a poor perception in high-frequency DCT domain. Based on this property, Twodimensional DCT is widely used in lossy compression [43] and image steganography [46]. In this paper, we apply twodimensional DCT to availably filter off recessive features from the image.…”

Section: E Discrete Cosine Transformmentioning

confidence: 99%

Feature-Filter: Detecting Adversarial Examples through Filtering off Recessive Features

Liu¹,

Zhao²,

Peng³

et al. 2021

Preprint

View full text Add to dashboard Cite

Real-Time Detectors for Digital and Physical Adversarial Inputs to Perception Systems

Cited by 2 publications

References 0 publications

Detecting Adversarial Examples by Input Transformations, Defense Perturbations, and Voting

Detecting Adversarial Examples by Input Transformations, Defense Perturbations, and Voting

Feature-Filter: Detecting Adversarial Examples through Filtering off Recessive Features

Contact Info

Product

Resources

About