Mitigating adversarial effects through randomization

C Xie, J Wang, Z Zhang, Z Ren, A Yuille - arXiv preprint arXiv:1711.01991, 2017 - arxiv.org
arXiv preprint arXiv:1711.01991, 2017arxiv.org
Convolutional neural networks have demonstrated high accuracy on various tasks in recent
years. However, they are extremely vulnerable to adversarial examples. For example,
imperceptible perturbations added to clean images can cause convolutional neural
networks to fail. In this paper, we propose to utilize randomization at inference time to
mitigate adversarial effects. Specifically, we use two randomization operations: random
resizing, which resizes the input images to a random size, and random padding, which pads …
Convolutional neural networks have demonstrated high accuracy on various tasks in recent years. However, they are extremely vulnerable to adversarial examples. For example, imperceptible perturbations added to clean images can cause convolutional neural networks to fail. In this paper, we propose to utilize randomization at inference time to mitigate adversarial effects. Specifically, we use two randomization operations: random resizing, which resizes the input images to a random size, and random padding, which pads zeros around the input images in a random manner. Extensive experiments demonstrate that the proposed randomization method is very effective at defending against both single-step and iterative attacks. Our method provides the following advantages: 1) no additional training or fine-tuning, 2) very few additional computations, 3) compatible with other adversarial defense methods. By combining the proposed randomization method with an adversarially trained model, it achieves a normalized score of 0.924 (ranked No.2 among 107 defense teams) in the NIPS 2017 adversarial examples defense challenge, which is far better than using adversarial training alone with a normalized score of 0.773 (ranked No.56). The code is public available at https://github.com/cihangxie/NIPS2017_adv_challenge_defense.
arxiv.org
以上显示的是最相近的搜索结果。 查看全部搜索结果