Detecting Adversarial Image Examples in Deep Networks with Adaptive Noise Reduction

Bin Liang; Hongcheng Li; Miaoqiang Su; Xirong Li; Wenchang Shi; Xiaofeng Wang

Source-linked AI summary

Detecting Adversarial Image Examples in Deep Networks with Adaptive Noise Reduction

Bin Liang, Hongcheng Li, Miaoqiang Su, Xirong Li, Wenchang Shi, Xiaofeng Wang

arXiv:1705.08378v5May 23, 2017cs.CRcs.LG

TL;DR

Adversarial examples can fool DNN classifiers while remaining difficult for humans to notice, and existing defenses often require attack knowledge or target-model modification. This paper detects them with entropy-adaptive noise reduction integrated as a filter, achieving a 96.39% overall F1 score in defense-unaware experiments and raising the bar for defense-aware attacks.

Problem
DNN classifiers can be fooled by imperceptibly perturbed images, while existing defenses often require attack knowledge or modification of the target model.
Method
The method treats adversarial perturbations as noise and uses entropy-adaptive scalar quantization and spatial smoothing to compare classifications before and after denoising.
Results
96.39% overall F1 score was achieved for detecting adversarial examples in defense-unaware experiments, while experiments reported that the method raises the bar for defense-aware attacks.
Takeaways & Limitations
The detector can be integrated into unmodified models without attack-specific prior knowledge and can also be combined with other defense techniques.
Takeaways & Limitations
Heavy, perceptible perturbations are difficult to reduce with filtering without compromising the original image's semantics.

Abstract

from arXiv · show

Recently, many studies have demonstrated deep neural network (DNN) classifiers can be fooled by the adversarial example, which is crafted via introducing some perturbations into an original sample. Accordingly, some powerful defense techniques were proposed. However, existing defense techniques often require modifying the target model or depend on the prior knowledge of attacks. In this paper, we propose a straightforward method for detecting adversarial image examples, which can be directly deployed into unmodified off-the-shelf DNN models. We consider the perturbation to images as a kind of noise and introduce two classic image processing techniques, scalar quantization and smoothing spatial filter, to reduce its effect. The image entropy is employed as a metric to implement an adaptive noise reduction for different kinds of images. Consequently, the adversarial example can be effectively detected by comparing the classification results of a given sample and its denoised version, without referring to any prior knowledge of attacks. More than 20,000 adversarial examples against some state-of-the-art DNN models are used to evaluate the proposed method, which are crafted with different attack techniques. The experiments show that our detection method can achieve a high overall F1 score of 96.39% and certainly raises the bar for defense-aware attacks.

1 INTRODUCTION

DNN classifiers can be fooled by small, often imperceptible perturbations, while existing defenses commonly require model modification or attack-specific knowledge. The paper introduces adaptive noise reduction and classification comparison to detect adversarial images on unmodified models.

Threat and motivation: Adversarial examples can cause DNN image classifiers to misclassify inputs despite perturbations being imperceptible to human observers.The paper motivates detection by noting that crafted images can create dangerous errors, such as confusing a stop sign with a yield sign.
Limitations of existing defenses: Existing defenses and detectors often require modifying or retraining the target model, acquiring adversarial examples, or relying on prior attack knowledge.These requirements increase training cost and can leave defenses vulnerable to previously unknown attacks.
Adaptive detection: Image entropy selects the noise-reduction strength: low-entropy samples receive aggressive processing, whereas high-entropy samples receive lighter processing.The framework uses entropy to determine quantization intervals and whether smoothing is applied.
Adaptive detection: A sample is considered benign when the original and denoised images receive the same classification; otherwise, it is identified as adversarial.The detection filter T produces the denoised sample T(x), and the classifier compares C(x) with C(T(x)).
Evaluation: 96.39% overall F1 was achieved across defense-unaware experiments, with 95.00% recall and 97.81% precision for adversarial-example detection.The evaluation used 21,673 effectual adversarial examples generated with FGSM, DeepFool, and CW attacks against models including GoogLeNet and CaffeNet.
Proposed approach: The proposed method treats adversarial perturbations as image noise and reduces their effect using scalar quantization and a smoothing spatial filter.This reframes detection as comparing model outputs before and after image processing.

2 BACKGROUND

Adversarial examples exploit vulnerabilities in DNN classifiers and can remain imperceptible to humans. The section reviews attack scenarios and techniques, including a finding that concentrated pixel manipulation can still produce effective attacks.

Attack scenarios: The evaluation considers defense-unaware and defense-aware scenarios based on different levels of attacker knowledge about the target model and detection mechanism.In the defense-aware setting, attackers may analyze both the classifier C and filter T.
Detection setting: The proposed technique can be deployed on an unchanged trained model, addressing the model-modification requirement described for several defenses.The section also motivates techniques that do not rely on a predictable perturbation distribution or prior attack knowledge.
Adversarial examples: Adversarial examples add perturbations that can make DNN classifiers misclassify images while remaining imperceptible to human observers.The reviewed attacks target trained models and may be generated directly or through optimization.
Attack techniques: The experiments use FGSM, DeepFool, and CW attacks, representing efficient gradient-based and optimization-based methods that produce small perturbations.FGSM uses the cost-function gradient, while DeepFool and CW seek perturbations that change classification with optimization procedures.
Attack techniques: 30,000 (19.92%) highest-gradient pixels can generate an effectual adversarial example with the same ε used when manipulating all pixels.This finding indicates that adversarial perturbations need not be assumed to follow a particular distribution.

3 METHODOLOGY

The method treats adversarial perturbations as image noise, reduces them with quantization and smoothing, and detects attacks by comparing classifications before and after adaptive denoising. Image entropy selects the reduction strategy across image types and resolutions, while the filter can preprocess inputs for unchanged target models.

3.1 Overview: Adversarial perturbations are modeled as additive noise, motivating scalar quantization and spatial smoothing to reduce their effect.The method seeks classification-preserving reconstruction rather than exact recovery of the original image.
3.1 Overview: Detection flags a sample when denoising changes the classifier’s predicted class; unchanged classifications are treated as benign.The processed image is intended to retain the correct class for benign inputs.
3.1 Overview: Image entropy adapts noise reduction because low-entropy and high-entropy images differ in perturbation space, information content, and tolerance for smoothing.Low-entropy samples receive more aggressive reduction, whereas high-entropy samples receive lighter treatment.
3.1 Overview: Evaluation spans MNIST and ImageNet, five target models, and detection parameters selected through training, validation, and test splits.The evaluation includes 10,000 MNIST test digits and 3,730 ImageNet samples.
3.1 Overview: Uniform quantization maps values within equal-sized intervals to shared codewords, whereas non-uniform quantization uses intervals of differing sizes.The interval size controls the trade-off between perturbation removal and image distortion.
3.1 Overview: The framework uses two-, four-, or six-interval quantization according to entropy, adding smoothing for samples with entropy above 5.0.For high-entropy samples, the method applies six-interval quantization followed by smoothing with a selected 7×7 cross mask.
3.1 Overview: The detection filter is transparent to the target model and can be integrated as a preprocessor without changing an off-the-shelf model.The target classifier remains unchanged.

4 EVALUATION

The method is evaluated against FGSM, DeepFool, and CW attacks in defense-unaware and defense-aware settings. It achieves strong detection performance without modifying or retraining the target model, while making defense-aware attacks less successful.

Evaluation setup: The evaluation uses MNIST and ImageNet samples with FGSM, DeepFool, and CW attacks in defense-unaware and defense-aware scenarios.The test set contains 4,500 MNIST digits and 1,489 ImageNet images; later CW experiments use selected subsets because CW generation is expensive.
Defense-unaware attacks: 95.37% average F1 and 94.16% recovered classifications are obtained for FGSM examples without attack-specific prior knowledge.FGSM perturbation magnitudes vary across MNIST and ImageNet settings.
Defense-unaware attacks: 93.85% and 95.95% F1 scores are achieved for DeepFool examples against GoogLeNet and CaffeNet, respectively.The filter also successfully recovers the classifications of 95.02% of DeepFool examples.
Defense-unaware attacks: 98.89% recall and 0.90% false positive rate are reported against the compared defense-unaware CW L2 setting, outperforming existing methods.The comparison follows the configurations used in the referenced evaluation, including κ = 0.0.
Defense-aware attacks: 67.37% is the attack success rate for defense-aware CW L2 attacks, compared with nearly 100% for the referenced existing methods.The defense-aware attack constrains the original and denoised samples to receive the same classification.
Overall results: 96.39% overall F1 is achieved across 43,346 defense-unaware samples, with 95.00% recall, 97.81% precision, and 2.13% benign-sample false positives.The filter recovers classifications for 94.16% of adversarial examples; detection takes less than one second for a sample.
Practical deployment: The method can be deployed without modifying or retraining the target model or knowing attack techniques, while a filter selected using FGSM also works against DeepFool and CW.The authors state that the approach raises the bar for defense-aware attacks.

5 DISCUSSION AND LIMITATIONS

The discussion identifies ambiguity and perceptible perturbations as important boundaries of the detection approach. It also notes that additional image-processing techniques could extend the method.

Ambiguous images: Ambiguous images can cause both false positives and false negatives because the target classifier itself makes weak predictions.The paper gives examples involving low-confidence Pineapple, Lemon, Jackfruit, and Sea Anemone classifications.
Ambiguous images: Ambiguous samples reduce precision and recall, so inspecting multiple predictions rather than only the top class may be necessary.The paper specifically suggests considering the top five predictions.
Perceptible perturbations: CW L0 and JSMA can create large-amplitude, perceptible perturbations that filtering may not reduce without compromising original-image semantics.Detecting this type of adversarial example is outside the paper’s scope and left for future research.
Future directions: Other techniques, including Rényi entropy and image segmentation, may further improve detection by isolating informative regions from perturbations.The paper presents these techniques as future research directions rather than evaluated components of the current method.

6 RELATED WORK

Prior defenses for adversarial examples commonly modify or retrain target models, require attack-specific examples, or rely on known attack techniques. The paper positions adaptive, attack-independent filtering as easier to deploy and potentially applicable to unknown attacks.

Defenses for Traditional Classifiers: Traditional classifier defenses include game-theoretic models, probabilistic models, multiple classifier systems, and feature-selection optimization.These approaches aim to make evasion more difficult by modeling attack strategies, combining classifiers, or distributing feature importance.
Attacks on DNNs: DNN adversarial attacks extend beyond images to audio, text, and malware, but traditional-classifier techniques cannot be directly applied to DNNs.The paper focuses specifically on detecting adversarial images and identifies discrete data such as text and malware as outside its proposed technique’s scope.
Improve the Robustness of Deep Networks: Adversarial training and input-transformation methods improve model robustness by retraining models or transforming inputs before classification.Examples include adding adversarial examples during training, projecting inputs into a new representation, and randomly nullifying features.
Detection Techniques: Direct detection methods may train detectors or thresholds from adversarial examples, making performance depend on sufficient examples and known attack techniques.The cited approach is described as less effective against unknown attacks and potentially dependent on datasets and models.
Detection Techniques: The proposed method adapts filtering to each image’s entropy, applies parameters tuned for FGSM to stronger attacks, and integrates with trained models without modification or retraining.The authors identify adaptivity, attack independence, and deployment simplicity as advantages over the reviewed defenses.

7 CONCLUSION

The paper presents adversarial-image detection that treats perturbations as noise, adjusts filtering using image entropy, and integrates with unmodified DNN models. Experiments report strong detection across attack techniques and models, while future work targets more practical techniques for defense-aware attacks.

Conclusion: The method regards adversarial perturbations as noise and uses image entropy to automatically adjust filtering for individual samples.Its stated deployment features are independence from prior attack knowledge and direct integration into unmodified models.
Conclusion: The experiments report high F1 scores across different attack techniques and target models in defense-unaware settings, while raising the bar for defense-aware attacks.Compared with existing detection methods, the authors report better performance in both attack scenarios.
Conclusion: Future work will investigate additional image-processing techniques, especially for more effective and practicable detection against defense-aware attacks.The conclusion frames classic image processing as a useful basis for analyzing adversarial images but leaves further technique development open.