Detecting Adversarial Examples in Deep Neural Networks using Normalizing Filters

Thumbnail Image

Files

ICAART_2019_79.pdf (4.9 MB)

Links to Files

http://www.scitepress.org/DigitalLibrary/Link.aspx?doi=10.5220/0007370301640173

Permanent Link

https://doi.org/10.5220/0007370301640173
 http://hdl.handle.net/11603/16930

Collections

UMBC Computer Science and Electrical Engineering Department
UMBC Faculty Collection
UMBC Student Collection

Author/Creator

Author/Creator ORCID

Date

2019

Type of Work

conference papers and proceedings
Text

Department

Program

Citation of Original Publication

Gu, Shuangchi; Yi, Ping; Zhu, Ting; Yao, Yao; Wang, Wei; Detecting Adversarial Examples in Deep Neural Networks using Normalizing Filters; In Proceedings of the 11th International Conference on Agents and Artificial Intelligence - Volume 1: ICAART, pages 164-173 (2019); http://www.scitepress.org/DigitalLibrary/Link.aspx?doi=10.5220/0007370301640173

Rights

This item is likely protected under Title 17 of the U.S. Copyright Law. Unless on a Creative Commons license, for uses protected by Copyright Law, contact the copyright holder or the author.
Attribution-NonCommercial-NoDerivatives 4.0 International (CC BY-NC-ND 4.0)

Subjects

normalizing filter
adversarial example
detection framework

Abstract

Deep neural networks are vulnerable to adversarial examples which are inputs modified with unnoticeable but malicious perturbations. Most defending methods only focus on tuning the DNN itself, but we propose a novel defending method which modifies the input data to detect the adversarial examples. We establish a detection framework based on normalizing filters that can partially erase those perturbations by smoothing the input image or depth reduction work. The framework gives the decision by comparing the classification results of original input and multiple normalized inputs. Using several combinations of gaussian blur filter, median blur filter and depth reduction filter, the evaluation results reaches a high detection rate and achieves partial restoration work of adversarial examples in MNIST dataset. The whole detection framework is a low-cost highly extensible strategy in DNN defending works.