Abstract
In recent years, deep neural network (DNN) approaches prove to be useful in many machine learning tasks, including classification. However, small perturbations that are carefully crafted by attackers can lead to the misclassification of the images. Previous studies have shown that adversarial subspaces lie off (but close to) the data submanifold and detection techniques based on the distributional difference between adversarial and normal samples have been proposed. These distribution-based detection techniques achieve excellent performance in characterizing adversarial samples. In this paper, We propose W-PGD to generate adversarial samples close to normal data distribution to bypass those detecting mechanisms. We trained a neural network WassNet to estimate the difference between two distributions using Wasserstein distance and use the gradient of WassNet to constrain the Wasserstein distance between adversarial and normal samples’ distribution. Our experiment shows that W-PGD can effectively decrease the detection rate of distribution-based detection techniques and generate adversarial samples with constrained Wasserstein distance.
Highlights
Deep learning has been widely used and has achieved state of art performances on image classification
The adversarial samples constructed for one model have a considerable probability to succeed in attacking other deep neural network (DNN) models [8], [9], which makes DNN models having fatal security risks when applied in the real-world environment
We show that adversarial samples generated by W-PGD can decrease the detection rate of distribution based detecting techniques including [14, LID], [15, KD], [15, BU] and craft adversarial samples more imperceptible by human
Summary
Deep learning has been widely used and has achieved state of art performances on image classification. Recent studies have found that by adding a small perturbation to the normal image, the deep neural network can make classification errors whereas the perturbation is still unrecognizable to human [1]–[3]. This kind of sample is called adversarial sample [1]. Image recognition technology is widely used in autonomous vehicle to recognize the situation around the car. The existence of adversarial samples is a serious security issue
Sign-in/Register to view highlights & summary Sign-in/Register to access full text options 
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a callDisclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.
