STPD: Defending against [formula omitted]-norm attacks with space transformation

Abstract

The human imperceptible adversarial examples crafted by ℓ0-norm attacks, which aims to minimize ℓ0 distance from the original image, thereby misleading deep neural network classifiers into the wrong classification. Prior works of tackling ℓ0 attacks can neither eliminate perturbed pixels nor improve the performance of the classifier in the recovered low-quality images. To address the issue, we propose a novel method, called space transformation pixel defender (STPD), to transform any image into a latent space to separate the perturbed pixels from the normal pixels. In particular, this strategy uses a set of one-class classifiers, including Isolation Forest and Elliptic Envelope, to locate the perturbed pixels from adversarial examples. The value of the neighboring normal pixels is then used to replace the perturbed pixels, which hold more than half of the votes from these one-class classifiers. We use our proposed strategy to successfully defend against well-known ℓ0-norm adversarial examples in the image classification settings. We show experimental results under the One-pixel Attack (OPA), the Jacobian-based Saliency Map Attack (JSMA), and the Carlini Wagner (CW) ℓ0-norm attack on CIFAR-10, COVID-CT, and ImageNet datasets. Our experimental results show that our approach can effectively defend against ℓ0-norm attacks compared with the most popular defense techniques.