Defending Against Adversarial Attacks Using Random Forests

2019/06/16 by Yifan Ding, Liqiang Wang, Ding, Yifan +9
Computer Science · #Advanced Malware Detection Techniques #Adversarial Robustness in Machine Learning #Anomaly Detection Techniques and Applications #Computer Vision and Pattern Recognition (cs.CV) #Cryptography and Security (cs.CR) #FOS: Computer and information sciences

paper · pdf · doi:10.48550/arxiv.1906.06765

openalex publication_date 2019/06/16 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

As deep neural networks (DNNs) have become increasingly important and popular, the robustness of DNNs is the key to the safety of both the Internet and the physical world. Unfortunately, some recent studies show that adversarial examples, which are hard to be distinguished from real examples, can easily fool DNNs and manipulate their predictions. Upon observing that adversarial examples are mostly generated by gradient-based methods, in this paper, we first propose to use a simple yet very effective non-differentiable hybrid model that combines DNNs and random forests, rather than hide gradients from attackers, to defend against the attacks. Our experiments show that our model can successfully and completely defend the white-box attacks, has a lower transferability, and is quite resistant to three representative types of black-box attacks; while at the same time, our model achieves similar classification accuracy as the original DNNs. Finally, we investigate and suggest a criterion to define where to grow random forests in DNNs.

Citations

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Gradient-based learning applied to document recognition
• DeCAF: A Deep Convolutional Activation Feature for Generic Visual\n Recognition
• ImageNet classification with deep convolutional neural networks
• Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression
• Countering Adversarial Images using Input Transformations
• Exploring the Space of Black-box Attacks on Deep Neural Networks
• Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Learning Multiple Layers of Features from Tiny Images

Related

• An Empirical Investigation of Randomized Defenses against Adversarial Attacks
• Simple Post-Training Robustness Using Test Time Augmentations and Random Forest
• Efficient Defenses Against Adversarial Attacks
• Resisting Deep Learning Models Against Adversarial Attack Transferability via Feature Randomization
• NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks