Smart Watchdog: A Lightweight Defending Mechanism Against Adversarial Transfer Learning

Abstract

AbstractMost traffic sign recognition tasks rely on artificial neural network. As a kind of transfer learning method, knowledge distillation has improved the robustness of neural network models to a certain extent and saved time for model training. However, the weights of the original model (teacher model) and the new model (student model) are similar. The adversarial examples of the teacher model are easy to transfer and can successfully attack the student model. In order to solve this problem, this paper proposes a lightweight defense mechanism to reduce the similarity between the weight of the student model and the weight of the teacher model, and the dropout-randomization method is applied in the input layer of the student model to reduce the input probability of the adversarial examples. Moreover, we evaluate the precision and the recall of the improved model, the results show that the robustness of the model is significantly improved under the Carlini-Wagner (CW) attack and Project Gradient Descent (PGD) attack.KeywordsTransfer learningKnowledge distillationWeightDropout