Locally optimal detection of adversarial inputs to image classifiers

Abstract

Deep neural networks achieve state-of-the-art performance for image classification and other tasks but are easily fooled by forgeries which slightly modify a legitimate image in a specific direction and are visually indistinguishable from the original. This presents a security risk for applications such as driverless transportation systems. We formulate detection of such forgeries as a watermark detection problem and derive locally optimal statistical tests for identifying them. Motivated by this optimal structure, we present a procedure for learning a forgery detector from a training set. The reliability of our forgery detector is assessed for several image classification tasks.