Defending Adversarial Patches via Joint Region Localizing and Inpainting
Deep neural networks are successfully used in various applications, but show their vulnerability to adversarial examples. With the development of adversarial patches, the feasibility of attacks in physical scenes increases, and the defenses against patch attacks are urgently needed. However, defending such adversarial patch attacks is still an unsolved problem. In this paper, we analyse the properties of adversarial patches, and find that: on the one hand, adversarial patches will lead to the appearance or contextual inconsistency in the target objects; on the other hand, the patch region will show abnormal changes on the high-level feature maps of the objects extracted by a backbone network. Considering the above two points, we propose a novel defense method based on a `localizing and inpainting" mechanism to pre-process the input examples. Specifically, we design an unified framework, where the localizing" sub-network utilizes a two-branch structure to represent the above two aspects to accurately detect the adversarial patch region in the image. For the inpainting" sub-network, it utilizes the surrounding contextual cues to recover the original content covered by the adversarial patch. The quality of inpainted images is also evaluated by measuring the appearance consistency and the effects of adversarial attacks. These two sub-networks are then jointly trained via an iterative optimization manner. In this way, the localizing" and `inpainting" modules can interact closely with each other, and thus learn a better solution. A series of experiments versus traffic sign classification and detection tasks are conducted to defend against various adversarial patch attacks.
Code (0)
등록된 구현이 없습니다.
Similar Papers 제목 키워드 기반
PatchZero: Defending against Adversarial Patch Attacks by Detecting and Zeroing the Patch
Adversarial patch attacks mislead neural networks by injecting adversarial pixels within a local region. Patch attacks can be highly effective in a variety of tasks and physically realizable via attachment (e.g. a sticke…
Diversityimage-classificationImage Classificationobject-detection+3Defending Against Universal Adversarial Patches by Clipping Feature Norms
Physical-world adversarial attacks based on universal adversarial patches have been proved to be able to mislead deep convolutional neural networks (CNNs), exposing the vulnerability of real-world visual classificati…
PatchGuard: A Provably Robust Defense against Adversarial Patches via Small Receptive Fields and Masking
Localized adversarial patches aim to induce misclassification in machine learning models by arbitrarily modifying pixels within a restricted region of an image. Such attacks can be realized in the physical world by attac…
Defending From Physically-Realizable Adversarial Attacks Through Internal Over-Activation Analysis
This work presents Z-Mask, a robust and effective strategy to improve the adversarial robustness of convolutional networks against physically-realizable adversarial attacks. The presented defense relies on specific Z-sco…
Adversarial Robustnessobject-detectionObject DetectionSemantic SegmentationSegment and Complete: Defending Object Detectors against Adversarial Patch Attacks with Robust Patch Detection
Object detection plays a key role in many security-critical systems. Adversarial patch attacks, which are easy to implement in the physical world, pose a serious threat to state-of-the-art object detectors. Developing re…
Adversarial Attack DetectionAdversarial DefenseAdversarial RobustnessObject+3