Adversarial Attack Mitigation Techniques

Abstract

Adversarial attacks have demonstrated the ability to change image classification labels with minimal alterations to the input image across a wide variety of Deep Neural Network (DNN) algorithms. Specifically the Fast Gradient Attack (FGA) [2] method has been shown to change a model’s output classification label with minimal visual alterations. Goodfellow et. al. [1] conjectured that this may be due to the high dimensional nature of the input data, as well as the linearity of the Deep Learning (DL) algorithms. Our study investigates the efficacy of one mitigation strategy (attack defense), centered on a simple preprocessing method (median de-noising) on input images. The median filter is employed on images input into ResNet models of varying depth, which have been pre-trained on the CIFAR10 dataset. It is hypothesized that by employing this preprocessing mitigation technique to adversarial attacked images, the impact of the FGA method [1] can be reduced. This study is designed to test if de-noising an input image can mitigate adversarial attack effectiveness. Additionally, the median filter removes some information contained within the dataset. Therefore, we seek to characterize and quantify the robustness of the ResNet models with this transformation technique. This research provides insight into the nature of the FGA adversarial attack vector, a simple attack mitigation strategy, as well as the robustness of the Deep Learning models being studied. [1] I. J. Goodfellow, J. Shlens and C. Szegedy, Explaining and Harnessing Adversarial Examples, arXiv e-prints, p. 1412.6572 December 2014 [2] Nicolae, Maria-Irina and Sinn, Mathieu and Tran, Minh Ngoc and Buesser, Beat and Rawat, Ambrish and Wistuba, Martin and Zantedeschi, Valentina and Baracaldo, Nathalie and Chen, Bryant and Ludwig, Heiko and Molloy, Ian and Edwards, Ben, Adversarial Robustness Toolbox v1.2.0 CoRR 1807.01069 https://arxiv.org/pdf/1807.01069 2018