STPD: Defending against ℓ0-norm attacks with space transformation
Future Generation Computer Systems
; 2021.
Article
in English
| ScienceDirect | ID: covidwho-1364020
ABSTRACT
The human imperceptible adversarial examples crafted by ℓ0-norm attacks, which aims to minimize ℓ0 distance from the original image, thereby misleading deep neural network classifiers into the wrong classification. Prior works of tackling ℓ0 attacks can neither eliminate perturbed pixels nor improve the performance of the classifier in the recovered low-quality images. To address the issue, we propose a novel method, called space transformation pixel defender (STPD), to transform any image into a latent space to separate the perturbed pixels from the normal pixels. In particular, this strategy uses a set of one-class classifiers, including Isolation Forest and Elliptic Envelope, to locate the perturbed pixels from adversarial examples. The value of the neighboring normal pixels is then used to replace the perturbed pixels, which hold more than half of the votes from these one-class classifiers. We use our proposed strategy to successfully defend against well-known ℓ0-norm adversarial examples in the image classification settings. We show experimental results under the One-pixel Attack (OPA), the Jacobian-based Saliency Map Attack (JSMA), and the Carlini Wagner (CW) ℓ0-norm attack on CIFAR-10, COVID-CT, and ImageNet datasets. Our experimental results show that our approach can effectively defend against ℓ0-norm attacks compared with the most popular defense techniques.
Full text:
Available
Collection:
Databases of international organizations
Database:
ScienceDirect
Language:
English
Journal:
Future Generation Computer Systems
Year:
2021
Document Type:
Article
Similar
MEDLINE
...
LILACS
LIS