Sample Efficient Detection and Classification of Adversarial Attacks via Self-Supervised Embeddings

Moayeri, Mazda; Feizi, Soheil

doi:10.1109/iccv48922.2021.00758

Cited by 17 publications

(3 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Ross et al [18] trained the model while regularizing input gradients. Network distillation [33], region-based classifier [34], generative model [35,36], and self-supervised learning [65] are also adopted to improve the robustness of the models. Rakin et al [37] proposed a trainable randomness method to improve the robustness by adversarial training.…”

Section: Related Workmentioning

confidence: 99%

Perturbation Inactivation Based Adversarial Defense for Face Recognition

Ren

Zhu

Wang

et al. 2022

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

Deep learning-based face recognition models are vulnerable to adversarial attacks. To curb these attacks, most defense methods aim to improve the robustness of recognition models against adversarial perturbations. However, the generalization capacities of these methods are quite limited. In practice, they are still vulnerable to unseen adversarial attacks. Deep learning models are fairly robust to general perturbations, such as Gaussian noises. A straightforward approach is to inactivate the adversarial perturbations so that they can be easily handled as general perturbations. In this paper, a plug-and-play adversarial defense method, named perturbation inactivation (PIN), is proposed to inactivate adversarial perturbations for adversarial defense. We discover that the perturbations in different subspaces have different influences on the recognition model. There should be a subspace, called the immune space, in which the perturbations have fewer adverse impacts on the recognition model than in other subspaces. Hence, our method estimates the immune space and inactivates the adversarial perturbations by restricting them to this subspace. The proposed method can be generalized to unseen adversarial perturbations since it does not rely on a specific kind of adversarial attack method. This approach not only outperforms several state-of-the-art adversarial defense methods but also demonstrates a superior generalization capacity through exhaustive experiments. Moreover, the proposed method can be successfully applied to four commercial APIs without additional training, indicating that it can be easily generalized to existing face recognition systems. The source code is available at https://github.com/RenMin1991/Perturbation-Inactivate.

show abstract

Section: Related Workmentioning

confidence: 99%

Perturbation Inactivation Based Adversarial Defense for Face Recognition

Ren

Zhu

Wang

et al. 2022

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

show abstract

“…Since adversarial examples were first observed in deep models [62,18], the phenomenon has been extensively studied. New attacks [8,34,42,15] and defenses [35,43,40,37] 1 High RCS for ∞ AT models is due to reduced scale of contextual bias in Salient ImageNet since the data diversity weakens background correlations. In 1 and 2 adversarial training, models rely on spurious features regardless of their scale.…”

Section: Review Of Literaturementioning

confidence: 99%

Explicit Tradeoffs between Adversarial and Natural Distributional Robustness

Moayeri¹,

Banihashem²,

Feizi³

2022

Preprint

Self Cite

View full text Add to dashboard Cite

Several existing works study either adversarial or natural distributional robustness of deep neural networks separately. In practice, however, models need to enjoy both types of robustness to ensure reliability. In this work, we bridge this gap and show that in fact, explicit tradeoffs exist between adversarial and natural distributional robustness. We first consider a simple linear regression setting on Gaussian data with disjoint sets of core and spurious features. In this setting, through theoretical and empirical analysis, we show that (i) adversarial training with 1 and 2 norms increases the model reliance on spurious features; (ii) For ∞ adversarial training, spurious reliance only occurs when the scale of the spurious features is larger than that of the core features; (iii) adversarial training can have an unintended consequence in reducing distributional robustness, specifically when spurious correlations are changed in the new test domain. Next, we present extensive empirical evidence, using a test suite of twenty adversarially trained models evaluated on five benchmark datasets (ObjectNet, RIVAL10, Salient ImageNet-1M, ImageNet-9, Waterbirds), that adversarially trained classifiers rely on backgrounds more than their standardly trained counterparts, validating our theoretical results. We also show that spurious correlations in training data (when preserved in the test domain) can improve adversarial robustness, revealing that previous claims that adversarial vulnerability is rooted in spurious correlations are incomplete.

show abstract

“…This is particularly important in forensics applications. However, this area of research is still in the nascent stage, with few published works in image and text classification [13,14].…”

Section: Introductionmentioning

confidence: 99%

AdvEst: Adversarial Perturbation Estimation to Classify and Detect Adversarial Attacks against Speaker Identification

Joshi¹,

Kataria²,

Villalba³

et al. 2022

Preprint

View full text Add to dashboard Cite

Adversarial attacks pose a severe security threat to the state-ofthe-art speaker identification systems, thereby making it vital to propose countermeasures against them. Building on our previous work that used representation learning to classify and detect adversarial attacks, we propose an improvement to it using Ad-vEst, a method to estimate adversarial perturbation. First, we prove our claim that training the representation learning network using adversarial perturbations as opposed to adversarial examples (consisting of the combination of clean signal and adversarial perturbation) is beneficial because it eliminates nuisance information. At inference time, we use a time-domain denoiser to estimate the adversarial perturbations from adversarial examples. Using our improved representation learning approach to obtain attack embeddings (signatures), we evaluate their performance for three applications: known attack classification, attack verification, and unknown attack detection. We show that common attacks in the literature (Fast Gradient Sign Method (FGSM), Projected Gradient Descent (PGD), Carlini-Wagner (CW) with different Lp threat models) can be classified with an accuracy of ∼ 96%. We also detect unknown attacks with an equal error rate (EER) of ∼9%, which is absolute improvement of ∼12% from our previous work.

show abstract

Sample Efficient Detection and Classification of Adversarial Attacks via Self-Supervised Embeddings

Cited by 17 publications

References 6 publications

Perturbation Inactivation Based Adversarial Defense for Face Recognition

Perturbation Inactivation Based Adversarial Defense for Face Recognition

Explicit Tradeoffs between Adversarial and Natural Distributional Robustness

AdvEst: Adversarial Perturbation Estimation to Classify and Detect Adversarial Attacks against Speaker Identification

Contact Info

Product

Resources

About