PaperlayerView exact revision on arXiv

Source-linked AI summary

Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks

Weilin Xu, David Evans, Yanjun Qi

arXiv:1704.01155v2cs.CVcs.CRcs.LG

TL;DR

Adversarial examples can fool DNNs, while prior defenses have shown limited success or required expensive computation. Feature squeezing detects such inputs by comparing predictions before and after reducing image features, achieving 98% detection on MNIST and 85% on CIFAR-10 and ImageNet with around 5% false positives against eleven static attacks.

  • Problem

    Adversarial examples can fool DNNs, while prior defenses have shown limited success or required expensive computation.

  • Method

    Feature squeezing detects adversarial inputs by comparing model predictions on original images with predictions after color-depth reduction or spatial smoothing.

  • Results

    98% detection on MNIST and 85% on CIFAR-10 and ImageNet were achieved with around 5% false positives against eleven static attacks.

  • Takeaways & Limitations

    Feature squeezing provides an inexpensive, complementary framework for detecting static adversarial inputs without changing the underlying model.

  • Takeaways & Limitations

    Feature squeezing is not immune to adversarial adaptation, so its robustness against adaptive attackers requires further investigation.

Abstract

from arXiv · show

Although deep neural networks (DNNs) have achieved great success in many tasks, they can often be fooled by \emph{adversarial examples} that are generated by adding small but purposeful distortions to natural examples. Previous studies to defend against adversarial examples mostly focused on refining the DNN models, but have either shown limited success or required expensive computation. We propose a new strategy, \emph{feature squeezing}, that can be used to harden DNN models by detecting adversarial examples. Feature squeezing reduces the search space available to an adversary by coalescing samples that correspond to many different feature vectors in the original space into a single sample. By comparing a DNN model's prediction on the original input with that on squeezed inputs, feature squeezing detects adversarial examples with high accuracy and few false positives. This paper explores two feature squeezing methods: reducing the color bit depth of each pixel and spatial smoothing. These simple strategies are inexpensive and complementary to other defenses, and can be combined in a joint detection framework to achieve high detection rates against state-of-the-art attacks.

1. Introduction

The paper introduces feature squeezing, a simple, low-cost approach that detects adversarial inputs by comparing predictions on original and squeezed samples while leaving the DNN model unchanged. It evaluates color-depth reduction and spatial smoothing, achieving high detection rates with low false positives in joint detection experiments.

  • Introduction: Detecting adversarial inputs can trigger user alerts, fail-safe actions, or identification and exclusion of malicious clients.The motivation applies to local classifiers and online classifiers accessed through APIs.
  • Introduction: Feature squeezing detects adversarial inputs by comparing a model’s prediction on the original sample with its prediction after squeezing.Inputs are identified as adversarial when the prediction difference exceeds a threshold.
  • Introduction: The approach reduces adversaries’ available degrees of freedom by removing unnecessary input features, while altering samples rather than the DNN model.This contrasts with defenses that modify the model itself, such as adversarial training and gradient masking.
  • Introduction: The study examines reducing each pixel’s color bit depth and applying local or non-local spatial smoothing for image classification.Image classification is emphasized because adversarial examples have been extensively studied in that domain.
  • Introduction: 98% detection rates were achieved on MNIST, while CIFAR-10 and ImageNet reached 85% with joint detection across eleven static attacks.False positive rates were around 5%.

2. Background

This section introduces DNNs and their training, defines adversarial examples and attack constraints, and reviews common attack methods and gradient-masking defenses.

  • Neural Networks: DNNs learn models from large training corpora, while CNNs perform exceptionally well on image classification and map input space X to categorical output space Y.A CNN is represented as a composition of layer functions, g(x) = f_L(f_L−1(...f_1(x))).
  • Neural Networks: Training minimizes the difference between predictions g(x_i) and true labels y_i by backpropagating a loss through the network.The training set contains N labeled inputs, each represented as (x_i, y_i).
  • Adversarial Examples: An adversarial example is a misclassified x′ produced by perturbing a correctly classified seed x within a constrained distance.Targeted attacks seek a particular class, whereas untargeted attacks seek any class other than the correct one; Δ(·) and ε specify closeness and permissible strength.
  • Adversarial Attacks: Common attack formulations vary by targetedness and distance metric, including L∞, L2, and L0 norms, which constrain per-dimension change, Euclidean perturbation, or altered-pixel count.FGSM uses the L∞-norm, DeepFool minimizes L2 perturbation, and JSMA modifies a limited number of pixels under L0.
  • Previous Defenses: Gradient-masking defenses reduce sensitivity to input changes by forcing nearzero gradients, but gradient penalties can significantly reduce model capacity and accuracy.The penalty sums layer-by-layer Frobenius norms of the Jacobian matrix.

3. Feature Squeezing Methods

This section describes two feature-squeezing approaches: reducing image color depth and smoothing pixels to reduce variation. It applies these methods to grayscale and color images, using local and non-local smoothing to coalesce features while preserving recognizable content.

  • Overview: Feature squeezing focuses on reducing image color depth and applying local or non-local spatial smoothing.These methods reduce the feature variation available to adversaries and support later evaluation of classifier robustness.
  • Color depth reduction: Reducing color bit depth is intended to remove irrelevant features and reduce adversarial opportunity without harming classifier accuracy.The paper examines 8-bit grayscale and 24-bit color representations.
  • Color depth reduction: On MNIST, 1-bit monochrome images remain recognizable while reducing the feature space to 1/128th of the original 8-bit grayscale space.The binary filter uses 0.5 as its cutoff, and the processed images appear nearly identical to the originals.
  • Color depth reduction: For CIFAR-10 and ImageNet, reducing color depth to as few as 4 bits per RGB channel does not significantly reduce human recognizability, whereas lower depths introduce observable loss.The paper studies tiny CIFAR-10 images and high-resolution ImageNet photographs.
  • Spatial smoothing: Local smoothing replaces each pixel using nearby pixels, with Gaussian, mean, and median filters among the available mechanisms.Median smoothing is reported as particularly effective against adversarial examples generated by L0 attacks.
  • Spatial smoothing: Non-local smoothing averages several similar patches from a large image area, aiming to cancel zero-mean noise while preserving object edges.Unlike local smoothing, it searches beyond nearby pixels for similar patches.

4. Robustness

Feature squeezing remains effective across datasets and attack types, often restoring classifier accuracy while preserving legitimate-example performance. Its robustness is strongest when appropriate squeezers are matched to perturbations and combined with other defenses, although standalone use can be exploitable.

  • Threat model: The evaluation assumes a white-box adversary with full access to the target model but no awareness that feature squeezing is performed.The adversary cannot influence the trained model and seeks misclassified inputs using white-box attacks.
  • Limitations: Standalone squeezing is not proposed as a complete defense because adversaries can exploit its transformation, including by constructing gray images that yield arbitrary binary-filtered outputs.Under binary squeezing, pixel values near 0.5 can be set to 0.49 or 0.51 to control the resulting 1-bit image.
  • Experimental setup: Experiments use high-performing MNIST, CIFAR-10, and ImageNet models and evaluate eleven attacks, including untargeted FGSM, BIM, and DeepFool plus targeted variants.Targeted attacks use either the next class or the least-likely class.
  • Color depth reduction: 100% accuracy is restored on MNIST CW∞ adversarial examples using a binary filter, while legitimate accuracy decreases only from 99.43% to 99.33%.The binary filter is effective against all evaluated MNIST L2 and L∞ attacks.
  • Spatial smoothing: Over 75% accuracy is achieved on all four CIFAR-10 L0 attacks with a 2×2 median filter, while ImageNet CW0 accuracy rises from 0% to 85%.These results support median smoothing as effective against L0-limited perturbations.
  • Combination with adversarial training: Composing feature squeezing with adversarial training typically gives the highest or comparable accuracy, while squeezing is almost cost-free compared with retraining-based adversarial training.Adversarial training remains beneficial when its computational cost is acceptable.

5. Detecting Adversarial Inputs

Feature squeezing detects adversarial inputs by comparing a DNN’s predictions on original and squeezed samples, using L1-distance thresholds that separate legitimate from adversarial examples. Joint detection performs strongly across datasets, but effectiveness varies by attack and adaptive attacks may require large, suspicious perturbations.

  • Detection framework: Feature squeezing detects adversarial inputs by comparing the model’s prediction on an original sample with its prediction after squeezing.The detection framework uses differences between the original and squeezed prediction vectors.
  • Detection framework: The L1 score ranges from 0 to 2, with higher values indicating greater differences between original and squeezed prediction vectors.A score of 2 occurs when the two predictions assign probability 1 to different classes.
  • Detection framework: Legitimate examples peak near an L1 score of 0, whereas adversarial examples peak near 2, enabling thresholds that balance detection rates against false positives.The threshold is selected between the two peaks.
  • Single-squeezer results: 97.87% detection is achieved for all MNIST L∞ and L2 attacks with one-bit color squeezing, while 3 × 3 median smoothing detects L0 attacks above 88%.One-bit squeezing detects seven attacks at 100%, but is less effective against CW0 attacks.
  • Joint detection: 100% detection of CIFAR-10 CW2-Next examples is achieved by joint detection, compared with 97.87% for the best single squeezer.Joint detection often outperforms the best individual squeezer while maintaining the false-positive constraint.
  • Robustness and adaptive attacks: Around 95% ROC-AUC is achieved on CIFAR-10 and ImageNet, while MNIST reaches 99.44%, excluding failed adversarial examples.Adaptive attacks must both induce misclassification and keep the squeezed-versus-original L1 score below the detection threshold; unrestricted attacks can produce unrecognizable images.

6. Conclusion

Feature squeezing is simple and inexpensive, with its effectiveness attributed to reducing the search space of adversarial perturbations. Although not immune to adaptation and tested only on image classification, the framework suggests broader applications and a new research direction.

  • Conclusion: Feature squeezing’s effectiveness is attributed to reducing the search space of perturbations available to an adversary.The authors note that developing a theory of adversarial examples remains elusive.
  • Conclusion: Although tested only on image classification, feature squeezing could apply across deep-learning domains, including voice commands and character-based toxic-text detection.Prior work used lowered sampling rates for adversarial voice commands and spelling correction for adversarial toxic text inputs.
  • Conclusion: Feature squeezing is not immune to adversarial adaptation but substantially changes the adversary’s challenge and opens a new research direction.The framework also supports studying the limits of deep neural networks in adversarial contexts.
Loading 1704.01155v2…