2020/02/18 by Yao Qin, Nicholas Frosst, Qin, Yao +9 · 15 citations
Biochemistry, Genetics and Molecular Biology · Computer Science · Mathematics · #Advanced Malware Detection Techniques #Adversarial Robustness in Machine Learning #Adversarial system #Artificial intelligence #Bacillus and Francisella bacterial research #Computer Vision and Pattern Recognition (cs.CV) #Computer science #Computer security #FOS: Computer and information sciences #Machine Learning (cs.LG) #Machine Learning (stat.ML) #cs.CV #cs.LG #stat.ML
paper · pdf · doi:10.48550/arxiv.2002.07405
published in arXiv (Cornell University) (Cornell University)
arxiv created 2020/02/18 · openalex publication_date 2020/02/18 · arxiv updated 2020/02/19 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
There has been an ongoing cycle where stronger defenses against adversarial attacks are subsequently broken by a more advanced defense-aware attack. We present a new approach towards ending this cycle where we "deflect'' adversarial attacks by causing the attacker to produce an input that semantically resembles the attack's target class. To this end, we first propose a stronger defense based on Capsule Networks that combines three detection mechanisms to achieve state-of-the-art detection performance on both standard and defense-aware attacks. We then show that undetected attacks against our defense often perceptually resemble the adversarial target class by performing a human study where participants are asked to label images produced by the attack. These attack images can no longer be called "adversarial'' because our network classifies them the same way as humans do.