Attack as Defense: Characterizing Adversarial Examples using Robustness

2021/03/13 by Zhe Zhao, Guangke Chen, Zhao, Zhe +9 · 2 citations
Computer Science · #Advanced Malware Detection Techniques #Adversarial Robustness in Machine Learning #Adversarial system #Artificial Intelligence (cs.AI) #Artificial intelligence #Attack model #Computer science #Computer security #Cryptography and Security (cs.CR) #Deep learning #Deep neural networks #FOS: Computer and information sciences #MNIST database #Machine learning #Robustness (evolution) #Security and Verification in Computing #Software #Software Engineering (cs.SE) #cs.AI #cs.CR #cs.SE

paper · pdf · doi:10.48550/arxiv.2103.07633

published in arXiv (Cornell University) (Cornell University)

arxiv created 2021/03/13 · openalex publication_date 2021/03/13 · arxiv updated 2021/03/16 · openalex created_date 2025/10/10 · openalex updated_date 2026/08/05

Abstract

As a new programming paradigm, deep learning has expanded its application to many real-world problems. At the same time, deep learning based software are found to be vulnerable to adversarial attacks. Though various defense mechanisms have been proposed to improve robustness of deep learning software, many of them are ineffective against adaptive attacks. In this work, we propose a novel characterization to distinguish adversarial examples from benign ones based on the observation that adversarial examples are significantly less robust than benign ones. As existing robustness measurement does not scale to large networks, we propose a novel defense framework, named attack as defense (A2D), to detect adversarial examples by effectively evaluating an example's robustness. A2D uses the cost of attacking an input for robustness evaluation and identifies those less robust examples as adversarial since less robust examples are easier to attack. Extensive experiment results on MNIST, CIFAR10 and ImageNet show that A2D is more effective than recent promising approaches. We also evaluate our defence against potential adaptive attacks and show that A2D is effective in defending carefully designed adaptive attacks, e.g., the attack success rate drops to 0% on CIFAR10.

Citations

• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Detecting Adversarial Samples from Artifacts
• Countering Adversarial Images using Input Transformations
• Mitigating Adversarial Effects Through Randomization
• A Dual Approach to Scalable Verification of Deep Networks
• A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks
• Efficient Formal Safety Analysis of Neural Networks
• Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Testing Deep Learning Models for Image Analysis Using Object-Relevant Metamorphic Relations
• Learning Multiple Layers of Features from Tiny Images

Cited by

• NCCR: to Evaluate the Robustness of Neural Networks and Adversarial Examples

Related

• Adversarial Attacks and Defences: A Survey
• Defenses in Adversarial Machine Learning: A Survey
• Increasing Confidence in Adversarial Robustness Evaluations
• Adversarial Examples in Deep Learning: Characterization and Divergence
• Adversarial Attacks and Defenses in Machine Learning-Powered Networks: A Contemporary Survey