1. STPD: Defending against ℓ0-norm attacks with space transformation
- Author
-
Zhixuan Liang, Jiannong Cao, Lequan Yu, Wei Li, Xiaohui Cui, and Jinlin Chen
- Subjects
Pixel ,Artificial neural network ,Contextual image classification ,Computer Networks and Communications ,Computer science ,business.industry ,Pattern recognition ,Image (mathematics) ,Set (abstract data type) ,symbols.namesake ,Hardware and Architecture ,Computer Science::Computer Vision and Pattern Recognition ,Norm (mathematics) ,Computer Science::Multimedia ,Classifier (linguistics) ,Jacobian matrix and determinant ,symbols ,Artificial intelligence ,business ,Software ,Computer Science::Cryptography and Security - Abstract
The human imperceptible adversarial examples crafted by l 0 -norm attacks, which aims to minimize l 0 distance from the original image, thereby misleading deep neural network classifiers into the wrong classification. Prior works of tackling l 0 attacks can neither eliminate perturbed pixels nor improve the performance of the classifier in the recovered low-quality images. To address the issue, we propose a novel method, called space transformation pixel defender (STPD), to transform any image into a latent space to separate the perturbed pixels from the normal pixels. In particular, this strategy uses a set of one-class classifiers, including Isolation Forest and Elliptic Envelope, to locate the perturbed pixels from adversarial examples. The value of the neighboring normal pixels is then used to replace the perturbed pixels, which hold more than half of the votes from these one-class classifiers. We use our proposed strategy to successfully defend against well-known l 0 -norm adversarial examples in the image classification settings. We show experimental results under the One-pixel Attack (OPA), the Jacobian-based Saliency Map Attack (JSMA), and the Carlini Wagner (CW) l 0 -norm attack on CIFAR-10, COVID-CT, and ImageNet datasets. Our experimental results show that our approach can effectively defend against l 0 -norm attacks compared with the most popular defense techniques.
- Published
- 2022
- Full Text
- View/download PDF