Detection of iterative adversarial attacks via counter attack

DOI10.1007/S10957-023-02273-6MaRDI QIDQ6050144zbMATH OpenOpenAlexFDO

Authors Matthias Rottmann, Kira Maag, Mathis Peyron, Hanno Gottschalk, Nataša Krejić

Publication date 18 September 2023

Published in Journal of Optimization Theory and Applications (Search for Journal in Brave)

Copyright license Creative Commons Attribution 4.0 International

Full work available at URL https://arxiv.org/abs/2009.11397

zbMATH Keywords

adversarial attacksasymptotically perfect detectioncounter attacksdeep neural networks

Mathematics Subject Classification ID

Image analysis in multivariate analysis (62H35) Artificial neural networks and deep learning (68T07) Pattern recognition, speech recognition (68T10)

Abstract: Deep neural networks (DNNs) have proven to be powerful tools for processing unstructured data. However for high-dimensional data, like images, they are inherently vulnerable to adversarial attacks. Small almost invisible perturbations added to the input can be used to fool DNNs. Various attacks, hardening methods and detection methods have been introduced in recent years. Notoriously, Carlini-Wagner (CW) type attacks computed by iterative minimization belong to those that are most difficult to detect. In this work we outline a mathematical proof that the CW attack can be used as a detector itself. That is, under certain assumptions and in the limit of attack iterations this detector provides asymptotically optimal separation of original and attacked images. In numerical experiments, we experimentally validate this statement and furthermore obtain AUROC values up to 99.73% on CIFAR10 and ImageNet. This is in the upper part of the spectrum of current state-of-the-art detection rates for CW attacks.

Recommendations

• Detection in Adversarial Environments
• Theoretical foundations of adversarial binary detection
• Adversarial perturbations of deep neural networks
• Understanding adversarial robustness via critical attacking route

Cites work

• Error stability properties of generalized gradient-type algorithms
• scientific article; zbMATH DE number 46303 (Why is no real title available?)
• scientific article; zbMATH DE number 847272 (Why is no real title available?)
• Introduction to Piecewise Differentiable Equations
• Understanding machine learning. From theory to algorithms

Cited in

(4)

• Adversarial Framework with Certified Robustness for Time-Series Domain via Statistical Features
• Masking and purifying inputs for blocking textual adversarial attacks
• Salient feature extractor for adversarial defense on deep neural networks
• Adversarial ink: componentwise backward error attacks on deep learning

This page was built for publication: Detection of iterative adversarial attacks via counter attack

Report a bug (only for logged in users!)Click here to report a bug for this page (MaRDI item Q6050144)