2018

Defense Against Adversarial Attacks with Saak Transform

Song, Sibo, Chen, Yueru, Cheung, Ngai-Man et al.

Understand

Deep neural networks (DNNs) are known to be vulnerable to adversarial perturbations, which imposes a serious threat to DNN-based decision systems.

In this paper, we propose to apply the lossy Saak transform to adversarially perturbed images as a preprocessing tool to defend against adversarial attacks.
Saak transform is a recently-proposed state-of-the-art for computing the spatial-spectral representations of input images.
Empirically, we observe that outputs of the Saak transform are very discriminative in differentiating adversarial examples from clean ones.

Built on

A. Krizhevsky and G. Hinton, “Learning multiple layers of features from tiny images,” 2009
2009
Earlier work this paper cites.
J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “Imagenet: A large-scale hierarchical image database,” in Computer Vision and Pattern Recognition, 2009. CVPR 2009. IEEE Conference on . IEEE, 2009, pp. 248–255
2009
Earlier work this paper cites.
C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” arXiv preprint arXiv:1312.6199 , 2013
Original
2013
Earlier work this paper cites.
W. Li, R. Zhao, T. Xiao, and X. Wang, “Deepreid: Deep filter pairing neural network for person re-identification,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , 2014, pp. 152–159
2014
Earlier work this paper cites.
S. Gu and L. Rigazio, “Towards deep neural network architectures robust to adversarial examples,” arXiv preprint arXiv:1412.5068 , 2014
Original
2014
Earlier work this paper cites.
F. Schroff, D. Kalenichenko, and J. Philbin, “Facenet: A unified embedding for face recognition and clustering,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2015, pp. 815–823
2015
Earlier work this paper cites.
C. Lyu, K. Huang, and H.-N. Liang, “A unified gradient regularization family for adversarial examples,” in Data Mining (ICDM), 2015 IEEE International Conference on . IEEE, 2015, pp. 301–309
2015
Earlier work this paper cites.
I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” Proceedings of the International Conference on Learning Representations (ICLR) , 2015
2015
Earlier work this paper cites.
H. Xu, Y. Gao, F. Yu, and T. Darrell, “End-to-end learning of driving models from large-scale video datasets,” arXiv preprint , 2016
2016
Earlier work this paper cites.
A. Kurakin, I. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” arXiv preprint arXiv:1607.02533 , 2016
Original
2016
Earlier work this paper cites.
——, “Adversarial machine learning at scale,” arXiv preprint arXiv:1611.01236 , 2016
Original
2016
Earlier work this paper cites.
Y. Liu, X. Chen, C. Liu, and D. Song, “Delving into transferable adversarial examples and black-box attacks,” arXiv preprint arXiv:1611.02770 , 2016
Original
2016
Earlier work this paper cites.

Similar

N. Papernot, P. McDaniel, X. Wu, S. Jha, and A. Swami, “Distillation as a defense to adversarial perturbations against deep neural networks,” in Security and Privacy (SP), 2016 IEEE Symposium on . IEEE, 2016, pp. 582–597
2016
Cited alongside, same era.
N. Papernot, P. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, and A. Swami, “The limitations of deep learning in adversarial settings,” in Security and Privacy (EuroS&P), 2016 IEEE European Symposium on . IEEE, 2016, pp. 372–387
2016
Cited alongside, same era.
S. M. Moosavi Dezfooli, A. Fawzi, and P. Frossard, “Deepfool: a simple and accurate method to fool deep neural networks,” in Proceedings of 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , no. EPFL-CONF-218057, 2016
2016
Cited alongside, same era.
X. Li and F. Li, “Adversarial examples detection in deep networks with convolutional filter statistics,” CoRR, abs/1612.07767 , vol. 7, 2016
Original
2016
Cited alongside, same era.
G. K. Dziugaite, Z. Ghahramani, and D. M. Roy, “A study of the effect of jpg compression on adversarial images,” arXiv preprint arXiv:1608.00853 , 2016
Original
2016
Cited alongside, same era.
G. Karolina Dziugaite, Z. Ghahramani, and D. M. Roy, “A study of the effect of jpg compression on adversarial images,” arXiv preprint arXiv:1608.00853 , 2016
Original
2016
Cited alongside, same era.
A. S. Ross and F. Doshi-Velez, “Improving the adversarial robustness and interpretability of deep neural networks by regularizing their input gradients,” arXiv preprint arXiv:1711.09404 , 2017
Original
2017
Cited alongside, same era.
C. Guo, M. Rana, M. Cissé, and L. van der Maaten, “Countering adversarial images using input transformations,” Proceedings of the International Conference on Learning Representations (ICLR) , 2017
2017
Cited alongside, same era.
W. Xu, D. Evans, and Y. Qi, “Feature squeezing: Detecting adversarial examples in deep neural networks,” The Network and Distributed System Security Symposium , 2017
2017
Cited alongside, same era.
N. Das, M. Shanbhogue, S.-T. Chen, F. Hohman, L. Chen, M. E. Kounavis, and D. H. Chau, “Keeping the bad guys out: Protecting and vaccinating deep learning with jpeg compression,” arXiv preprint arXiv:1705.02900 , 2017
Original
2017
Cited alongside, same era.
S.-M. Moosavi-Dezfooli, A. Fawzi, O. Fawzi, and P. Frossard, “Universal adversarial perturbations,” in Computer Vision and Pattern Recognition (CVPR), 2017 IEEE Conference on . IEEE, 2017, pp. 86–94
2017
Cited alongside, same era.

Then

N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in Security and Privacy (SP), 2017 IEEE Symposium on . IEEE, 2017, pp. 39–57
2017
Later among the works it cites.
P.-Y. Chen, Y. Sharma, H. Zhang, J. Yi, and C.-J. Hsieh, “Ead: elastic-net attacks to deep neural networks via adversarial examples,” arXiv preprint arXiv:1709.04114 , 2017
Original
2017
Later among the works it cites.
J. Su, D. V. Vargas, and S. Kouichi, “One pixel attack for fooling deep neural networks,” arXiv preprint arXiv:1710.08864 , 2017
Original
2017
Later among the works it cites.
F. Tramèr, A. Kurakin, N. Papernot, D. Boneh, and P. McDaniel, “Ensemble adversarial training: Attacks and defenses,” arXiv preprint arXiv:1705.07204 , 2017
Original
2017
Later among the works it cites.
G. Huang, Z. Liu, K. Q. Weinberger, and L. van der Maaten, “Densely connected convolutional networks,” in Proceedings of the IEEE conference on computer vision and pattern recognition , vol. 1, no. 2, 2017, p. 3
2017
Later among the works it cites.
A. G. Howard, M. Zhu, B. Chen, D. Kalenichenko, W. Wang, T. Weyand, M. Andreetto, and H. Adam, “Mobilenets: Efficient convolutional neural networks for mobile vision applications,” arXiv preprint arXiv:1704.04861 , 2017
Original
2017
Later among the works it cites.
Z. Liu, Q. Liu, T. Liu, Y. Wang, and W. Wen, “Feature distillation: Dnn-oriented jpeg compression against adversarial examples,” Proceedings of the 27th International Joint Conference on Artificial Intelligence (IJCAI) , 2018
2018
Closest in time.
C.-C. J. Kuo and Y. Chen, “On data-driven saak transform,” Journal of Visual Communication and Image Representation , vol. 50, pp. 237–246, 2018
2018
Closest in time.
Y. Dong, F. Liao, T. Pang, H. Su, X. Hu, J. Li, and J. Zhu, “Boosting adversarial attacks with momentum,” Proceedings of 2018 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , 2018
2018
Closest in time.
C. Xiao, J.-Y. Zhu, B. Li, W. He, M. Liu, and D. Song, “Spatially transformed adversarial examples,” Proceedings of the International Conference on Learning Representations (ICLR) , 2018
2018
Closest in time.
N. Akhtar, J. Liu, and A. Mian, “Defense against universal adversarial perturbations,” Proceedings of 2018 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , 2018
2018
Closest in time.

Beyond the bibliography

alphaXiv searches the wider corpus for related work and actual follow-ups.

Open on alphaXiv

alphaXiv is searching for related work…

Reading the bibliography…