Cross-Layer Strategic Ensemble Defense Against Adversarial Examples
Deep neural network (DNN) has demonstrated its success in multiple domains. However, DNN models are inherently vulnerable to adversarial examples, which are generated by adding adversarial perturbations to benign inputs to fool the DNN model to misclassify. In this paper, we present a cross-layer strategic ensemble framework and a suite of robust defense algorithms, which are attack-independent, and capable of auto-repairing and auto-verifying the target model being attacked. Our strategic ensemble approach makes three original contributions. First, we employ input-transformation diversity to design the input-layer strategic transformation ensemble algorithms. Second, we utilize model-disagreement diversity to develop the output-layer strategic model ensemble algorithms. Finally, we create an input-output cross-layer strategic ensemble defense that strengthens the defensibility by combining diverse input transformation based model ensembles with diverse output verification model ensembles. Evaluated over 10 attacks on ImageNet dataset, we show that our strategic ensemble defense algorithms can achieve high defense success rates and are more robust with high attack prevention success rates and low benign false negative rates, compared to existing representative defense methods.
Code (0)
등록된 구현이 없습니다.
Tasks
DiversitySimilar Papers 제목 키워드 기반
Ensemble-based Adversarial Defense Using Diversified Distance Mapping
We propose an ensemble-based defense against adversarial examples using distance map layers (DMLs). Similar to linear (map) layers, DMLs can be used to output logits for a multi-class classification model. We show in thi…
Adversarial DefenseDiversityMulti-class ClassificationDenoising and Verification Cross-Layer Ensemble Against Black-box Adversarial Attacks
Deep neural networks (DNNs) have demonstrated impressive performance on many challenging machine learning tasks. However, DNNs are vulnerable to adversarial inputs generated by adding maliciously crafted perturbations to…
DenoisingDiversityStratDef: Strategic Defense Against Adversarial Attacks in ML-based Malware Detection
Over the years, most research towards defenses against adversarial attacks on machine learning models has been in the image recognition domain. The ML-based malware detection domain has received less attention despite it…
Adversarial RobustnessMalware DetectionRun-Off Election: Improved Provable Defense against Data Poisoning Attacks
In data poisoning attacks, an adversary tries to change a model's prediction by adding, modifying, or removing samples in the training data. Recently, ensemble-based approaches for obtaining provable defenses against dat…
Data PoisoningEnsemble of Models Trained by Key-based Transformed Images for Adversarially Robust Defense Against Black-box Attacks
We propose a voting ensemble of models trained by using block-wise transformed images with secret keys for an adversarially robust defense. Key-based adversarial defenses were demonstrated to outperform state-of-the-art …
image-classificationImage Classification