Source-linked AI summary
Ensemble Methods as a Defense to Adversarial Perturbations Against Deep Neural Networks
Thilo Strauss, Markus Hanselmann, Andrej Junginger, Holger Ulmer
TL;DR
Deep neural networks are vulnerable to adversarial perturbations that can cause errors in security-sensitive tasks. The paper evaluates ensemble methods as a defense and reports improved clean accuracy and robustness on MNIST and CIFAR-10, while noting added computational and memory costs.
Problem
Deep neural networks can be highly vulnerable to adversarial perturbations that cause misclassification in security-sensitive applications.
Method
The paper uses ensembles of classifiers as a sole defense against adversarial perturbations.
Results
On MNIST and CIFAR-10, ensemble methods improve test accuracy and substantially outperform single classifiers under FGSM and BIM attacks.
Takeaways & Limitations
Ensemble methods provide a robustness strategy that can preserve or improve unperturbed-data accuracy, although combining defenses can reduce clean accuracy.
Abstract
from arXiv · showhide
Deep learning has become the state of the art approach in many machine learning problems such as classification. It has recently been shown that deep learning is highly vulnerable to adversarial perturbations. Taking the camera systems of self-driving cars as an example, small adversarial perturbations can cause the system to make errors in important tasks, such as classifying traffic signs or detecting pedestrians. Hence, in order to use deep learning without safety concerns a proper defense strategy is required. We propose to use ensemble methods as a defense strategy against adversarial perturbations. We find that an attack leading one model to misclassify does not imply the same for other networks performing the same task. This makes ensemble methods an attractive defense strategy against adversarial attacks. We empirically show for the MNIST and the CIFAR-10 data sets that ensemble methods not only improve the accuracy of neural networks on test data but also increase their robustness against adversarial perturbations.
1 Introduction
Deep neural networks are vulnerable to adversarial perturbations that can cause misclassification in security-sensitive applications. The paper proposes ensemble methods as a sole defense, aiming to improve clean accuracy while increasing robustness.
- 1 Introduction: Adversarial perturbations can mislead deep neural networks in applications such as traffic-sign and pedestrian detection.
- 1 Introduction: Existing defenses include adversarial training, distillation, denoising autoencoders, and attack detection.
- 1 Introduction: The paper uses ensemble methods as a sole defense against adversarial perturbations.An ensemble averages predictions from multiple classifiers, and the paper positions this approach as improving both clean accuracy and robustness.
- 1 Introduction: The paper reports that ensembles improve unperturbed-test accuracy while considerably increasing robustness, at the cost of computational complexity and memory.
2 Adversarial Atack
The paper describes FGSM as a single gradient-sign perturbation and BIM as its iterative extension. Both attacks perturb inputs within specified constraints to induce misclassification.
- 2.1 Fast Gradient Sign Method: FGSM adds a perturbation of size ϵ to the input in the sign direction of the input gradient.The gradient is computed by backpropagation, making the attack relatively cheap and simple.
- 2.2 Basic Iterative Method: BIM repeatedly applies FGSM-like perturbations using step size α for n iterations while keeping samples within an ϵ-neighborhood of the original input.The clipping operation enforces the ϵ-neighborhood constraint.
3 Ensemble Methods
The proposed ensembles combine multiple classifiers whose predictions are averaged, relying on diversity to resist attacks. Experiments use randomized models, architectural variation, Bagging, and Gaussian-noise training, while evaluating classifier-specific and averaged gradients.
- 3 Ensemble Methods: Different classifiers perform quite differently under adversarial perturbations, while most remain accurate for small ϵ, supporting adversarial diversity in ensembles.
- 3 Ensemble Methods: The study varies classifier diversity through random initialization, similar architectural changes, Bagging, and Gaussian noise added to training data.Bagging trains each classifier on a different bootstrap replicate, while Gaussian noise creates similar but different training sets.
- 3 Ensemble Methods: Gaussian noise in training data also makes each classifier somewhat more robust against adversarial perturbations.
- 3 Ensemble Methods: Ensembles predict by choosing the label with the highest average output probability across classifiers.
- 3 Ensemble Methods: Robustness is evaluated with gradients from one classifier and with the average gradient across the ensemble.The first gradient is not the correct ensemble gradient, whereas the second averages classifier gradients.
4 Experiments
Experiments on MNIST and CIFAR-10 compare ensemble defenses with single classifiers under unperturbed and adversarial conditions. Ensembles generally preserve or improve clean accuracy while substantially improving robustness, with performance depending on the ensemble strategy and defense combination.
- 4.1 MNIST: On MNIST clean data, accuracy is roughly 99%, with ensembles slightly outperforming single classifiers by less than one percent.The ensemble advantage remains small without perturbations compared with the much larger adversarial gains.
- 4.1 MNIST: 7%-22%: ensembles outperform single classifiers on MNIST FGSM attacks.Single-classifier accuracy falls to roughly 35%-56%, whereas ensembles reach 57%-78% with Grad. 1 and 45%-70% with Grad. 2.
- 4.1 MNIST: 37%-85%: ensembles significantly outperform single classifiers on MNIST BIM attacks.Ensemble accuracy reaches 65%-92% against Grad. 1 and 89%-98% against Grad. 2 BIM attacks, while single classifiers can fall to around 6%.
- 4.1 MNIST: Random initialization and similar architectures improve robustness, while Gaussian-noise ensembles provide the best adversarial defense but the weakest clean-test performance among ensemble variants.Bagging outperforms the other non-noise ensemble variants on adversarial data but performs slightly worse on unperturbed data.
- 4.2 CIFAR-10: CIFAR-10 confirms the pattern: ensembles improve clean accuracy from roughly 72%-80% to 77%-84% and outperform single classifiers under FGSM and BIM attacks.Under FGSM, ensembles reach 43%-61% or 31%-47%; under BIM, they reach 52%-67% or 68%-73%, depending on the gradient source.
- 4.3 Comparison with other Methods: Compared with adversarial training and defensive distillation, standard ensembles achieve higher accuracy on attacked and unperturbed data, while combining ensembles with adversarial training can improve robustness further.Combining ensembles with defensive distillation does not show the same improvement tendency.
5 Conclusion
Ensemble methods improve test accuracy while making classifiers considerably more robust against certain adversarial attacks. The paper presents them as a sole defense, while noting that combining them with other defenses can further improve robustness at a cost to unperturbed accuracy.
- Ensemble methods increase test accuracy and considerably improve robustness against certain adversarial attacks.
- Combining ensembles with other defense mechanisms can produce more robust classifiers, but typically decreases accuracy on unperturbed data.
- The reported robustness findings are based on simple attack scenarios, although the authors expect ensembles may help against other attacks.