You Can’t Fool All the Models: Detect Adversarial Samples via Pruning Models

Abstract

Many adversarial attack methods have investigated the security issue of deep learning models. Previous works on detecting adversarial samples show superior in accuracy but consume too much memory and computing resources. In this paper, we propose an adversarial sample detection method based on pruned models and evaluate four different pruning methods. We find that pruned neural network models are sensitive to adversarial samples, i.e., the pruned models tend to output labels different from the original model when given adversarial samples. Moreover, the pruned model has an extremely small model size and computational cost. Based on the detection result, we further propose a simple but effective defense approach to identify the true label of the adversarial sample. Experiments show that, on average, four different pruning methods outperform the SOTA multi-model based detection method (64.15% and 73.70%) by 28.65% and 18.73% on CIFAR10 and SVHN, respectively, with significantly fewer models used. The FLOPs of our structured pruned model are only 49.41% and 25.62% of the original model. Our defense approach achieves 68.60% and 72.03% average classification accuracy on CIFAR10 and SVHN, exceeding other advanced defense methods.

Reconstruction-Based Adversarial Attack Detection in Vision-Based Autonomous Driving Systems

“…Lee et al [70] also proposed a framework for detecting adversarial examples that can be used to detect adversaries in any pre-trained Softmax neural classifier. The authors of [71] presented model-pruning-based adversarial attack detection methods, while, on the other hand, Chen et al [72] presented a method to detect adversarial attacks based on activation clustering methods. In contrast to adversarial detection, the adversarial transformation methods apply transformation techniques to mitigate the effect of adversarial attacks and obtain a clean image.…”

A Full Dive into Realizing the Edge-enabled Metaverse: Visions, Enabling Technologies,and Challenges

“…13 shows the visual illustration of an Intel SGX-compatible system. The Metaverse platform owner can Trusted Execution Environment Encrypt a portion of CPU memory to isolate specific application in memory [212] Trusted Execution Environment Evaluate the feasibility of deploying TEE on edge device with different CPU [213] Trusted Execution Environment Following [211], the data are encrypted in the TEE before they are offloaded to other edge servers [214] Federated Learning Integrated differential privacy into FL to improve the protection level [215] Federated Learning Following [214], randomized mechanism are added together with DP to hide users' contributions during training [216] Adversarial Machine Learning Distance between data points and distribution-estimation based outlier detection algorithms are used to defence against poisoning attack [217] Adversarial Machine Learning Propose to use multiple models to form a model family so that it is more robust in white-box attack scenario [218] Adversarial Machine Learning Propose to use label change rate to protect the pruned neural network against adversarial sample set up a list of requirements to prevent the users from using edge devices that are not using SGX-enabled Intel CPU. With the help of SGX, edge devices can trust the data running on a platform with the latest security updates.…”

“…In addition, the edge device user does not want a single application to consume too much power. The authors in [218] detect the adversarial samples via pruning models. The framework is mainly tested with four pruning methods, i.e., random channel pruning, 𝐿 1 norm pruning, lottery ticket hypothesis pruning, and subnetwork extraction.…”