Defending From Physically-Realizable Adversarial Attacks Through Internal Over-Activation Analysis
This work presents Z-Mask, a robust and effective strategy to improve the adversarial robustness of convolutional networks against physically-realizable adversarial attacks. The presented defense relies on specific Z-score analysis performed on the internal network features to detect and mask the pixels corresponding to adversarial objects in the input image. To this end, spatially contiguous activations are examined in shallow and deep layers to suggest potential adversarial regions. Such proposals are then aggregated through a multi-thresholding mechanism. The effectiveness of Z-Mask is evaluated with an extensive set of experiments carried out on models for both semantic segmentation and object detection. The evaluation is performed with both digital patches added to the input images and printed patches positioned in the real world. The obtained results confirm that Z-Mask outperforms the state-of-the-art methods in terms of both detection accuracy and overall performance of the networks under attack. Additional experiments showed that Z-Mask is also robust against possible defense-aware attacks.
Code (0)
등록된 구현이 없습니다.
Tasks
Adversarial Robustnessobject-detectionObject DetectionSemantic SegmentationSimilar Papers 제목 키워드 기반
Defending Against Physically Realizable Attacks on Image Classification
We study the problem of defending deep neural network approaches for image classification from physically realizable attacks. First, we demonstrate that the two most scalable and effective methods for learning robust mod…
ClassificationGeneral Classificationimage-classificationImage ClassificationCertified robustness against physically-realizable patch attack via randomized cropping
This paper studies a certifiable defense against adversarial patch attacks on image classification. Our approach classifies random crops from the original image independently and the original image is classified as the v…
ClassificationCrop ClassificationGeneral Classificationimage-classification+1Overcomplete Representations Against Adversarial Videos
Adversarial robustness of deep neural networks is an extensively studied problem in the literature and various methods have been proposed to defend against adversarial images. However, only a handful of defense methods h…
Adversarial RobustnessDecoderVideo RecognitionPatchZero: Defending against Adversarial Patch Attacks by Detecting and Zeroing the Patch
Adversarial patch attacks mislead neural networks by injecting adversarial pixels within a local region. Patch attacks can be highly effective in a variety of tasks and physically realizable via attachment (e.g. a sticke…
Diversityimage-classificationImage Classificationobject-detection+3Adversarial camera stickers: A physical camera-based attack on deep learning systems
Recent work has documented the susceptibility of deep learning systems to adversarial examples, but most such attacks directly manipulate the digital input to a classifier. Although a smaller line of work considers physi…