Moving Target Defense for Deep Visual Sensing against Adversarial Examples

2019/05/11 by Qun Song, Zhenyu Yan, Song, Qun +3
Computer Science · #Advanced Malware Detection Techniques #Adversarial Robustness in Machine Learning #Anomaly Detection Techniques and Applications #Artificial Intelligence (cs.AI) #Computer Vision and Pattern Recognition (cs.CV) #FOS: Computer and information sciences #cs.AI #cs.CV

paper · pdf · doi:10.48550/arxiv.1905.13148

arxiv created 2019/05/11 · openalex publication_date 2019/05/11 · arxiv updated 2019/05/31 · openalex created_date 2019/06/07 · openalex updated_date 2026/07/28

Abstract

Deep learning based visual sensing has achieved attractive accuracy but is shown vulnerable to adversarial example attacks. Specifically, once the attackers obtain the deep model, they can construct adversarial examples to mislead the model to yield wrong classification results. Deployable adversarial examples such as small stickers pasted on the road signs and lanes have been shown effective in misleading advanced driver-assistance systems. Many existing countermeasures against adversarial examples build their security on the attackers' ignorance of the defense mechanisms. Thus, they fall short of following Kerckhoffs's principle and can be subverted once the attackers know the details of the defense. This paper applies the strategy of moving target defense (MTD) to generate multiple new deep models after system deployment, that will collaboratively detect and thwart adversarial examples. Our MTD design is based on the adversarial examples' minor transferability to models differing from the one (e.g., the factory-designed model) used for attack construction. The post-deployment quasi-secret deep models significantly increase the bar for the attackers to construct effective adversarial examples. We also apply the technique of serial data fusion with early stopping to reduce the inference time by a factor of up to 5 while maintaining the sensing and defense performance. Extensive evaluation based on three datasets including a road sign image database and a GPU-equipped Jetson embedded computing board shows the effectiveness of our approach.

Citations

• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• A study of the effect of JPG compression on adversarial images
• On the (Statistical) Detection of Adversarial Examples
• On Detecting Adversarial Perturbations
• Detecting Adversarial Samples from Artifacts
• Early Methods for Detecting Adversarial Images
• Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression
• Feature Squeezing Mitigates and Detects Carlini/Wagner Adversarial Examples
• Robust Physical-World Attacks on Deep Learning Models
• On Evaluating Adversarial Robustness
• Simple Physical Adversarial Examples against End-to-End Autonomous Driving Models
• PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models

Cited by

• Moving Target Defense Against Adversarial False Data Injection Attacks In Power Grids

Related

• Leveraging Generalizability of Image-to-Image Translation for Enhanced Adversarial Defense
• Revisiting Adversarial Perception Attacks and Defense Methods on Autonomous Driving Systems
• SLAP: Improving Physical Adversarial Examples with Short-Lived Adversarial Perturbations
• Targeted Attack on Deep RL-based Autonomous Driving with Learned Visual Patterns
• Invisible Triggers, Visible Threats! Road-Style Adversarial Creation Attack for Visual 3D Detection in Autonomous Driving