Fight Perturbations with Perturbations: Defending Adversarial Attacks via Neuron Influence
Fuente:
arXiv
Guardado en:
| Autores principales: | , , , , |
|---|---|
| Formato: | Preprint |
| Publicado: |
2021
|
| Materias: | |
| Acceso en línea: | |
| Etiquetas: |
Agregar Etiqueta
Sin Etiquetas, Sea el primero en etiquetar este registro!
|
| _version_ | 1866914916870389760 |
|---|---|
| author | Chen, Ruoxi Jin, Haibo Zheng, Haibin Chen, Jinyin Liu, Zhenguang |
| author_facet | Chen, Ruoxi Jin, Haibo Zheng, Haibin Chen, Jinyin Liu, Zhenguang |
| contents | The vulnerabilities of deep learning models towards adversarial attacks have attracted increasing attention, especially when models are deployed in security-critical domains. Numerous defense methods, including reactive and proactive ones, have been proposed for model robustness improvement. Reactive defenses, such as conducting transformations to remove perturbations, usually fail to handle large perturbations. The proactive defenses that involve retraining, suffer from the attack dependency and high computation cost. In this paper, we consider defense methods from the general effect of adversarial attacks that take on neurons inside the model. We introduce the concept of neuron influence, which can quantitatively measure neurons' contribution to correct classification. Then, we observe that almost all attacks fool the model by suppressing neurons with larger influence and enhancing those with smaller influence. Based on this, we propose \emph{Neuron-level Inverse Perturbation} (NIP), a novel defense against general adversarial attacks. It calculates neuron influence from benign examples and then modifies input examples by generating inverse perturbations that can in turn strengthen neurons with larger influence and weaken those with smaller influence. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2112_13060 |
| institution | arXiv |
| publishDate | 2021 |
| record_format | arxiv |
| spellingShingle | Fight Perturbations with Perturbations: Defending Adversarial Attacks via Neuron Influence Chen, Ruoxi Jin, Haibo Zheng, Haibin Chen, Jinyin Liu, Zhenguang Computer Vision and Pattern Recognition Artificial Intelligence Cryptography and Security The vulnerabilities of deep learning models towards adversarial attacks have attracted increasing attention, especially when models are deployed in security-critical domains. Numerous defense methods, including reactive and proactive ones, have been proposed for model robustness improvement. Reactive defenses, such as conducting transformations to remove perturbations, usually fail to handle large perturbations. The proactive defenses that involve retraining, suffer from the attack dependency and high computation cost. In this paper, we consider defense methods from the general effect of adversarial attacks that take on neurons inside the model. We introduce the concept of neuron influence, which can quantitatively measure neurons' contribution to correct classification. Then, we observe that almost all attacks fool the model by suppressing neurons with larger influence and enhancing those with smaller influence. Based on this, we propose \emph{Neuron-level Inverse Perturbation} (NIP), a novel defense against general adversarial attacks. It calculates neuron influence from benign examples and then modifies input examples by generating inverse perturbations that can in turn strengthen neurons with larger influence and weaken those with smaller influence. |
| title | Fight Perturbations with Perturbations: Defending Adversarial Attacks via Neuron Influence |
| topic | Computer Vision and Pattern Recognition Artificial Intelligence Cryptography and Security |
| url | https://arxiv.org/abs/2112.13060 |