Patch Replacement: A Transformation-based Method to Improve Robustness against Adversarial Attacks - Archive ouverte HAL Access content directly
Conference Papers Year : 2021

Patch Replacement: A Transformation-based Method to Improve Robustness against Adversarial Attacks

Abstract

Deep Neural Networks (DNNs) are robust against intra-class variability of images, pose variations and random noise, but vulnerable to imperceptible adversarial perturbations that are well-crafted precisely to mislead. While random noise even of relatively large magnitude can hardly affect predictions, adversarial perturbations of very small magnitude can make a classifier fail completely. To enhance robustness, we introduce a new adversarial defense called patch replacement, which transforms both the input images and their intermediate features at early layers to make adversarial perturbations behave similarly to random noise. We decompose images/features into small patches and quantize them according to a codebook learned from legitimate training images. This maintains the semantic information of legitimate images, while removing as much as possible the effect of adversarial perturbations. Experiments show that patch replacement improves robustness against both white-box and gray-box attacks, compared with other transformation-based defenses. It has a low computational cost since it does not need training or fine-tuning the network. Importantly, in the white-box scenario, it increases the robustness, while other transformation-based defenses do not.
Fichier principal
Vignette du fichier
workshop.pdf (1.35 Mo) Télécharger le fichier
Origin : Files produced by the author(s)

Dates and versions

hal-03363999 , version 1 (04-10-2021)

Identifiers

Cite

Hanwei Zhang, Yannis Avrithis, Teddy Furon, Laurent Amsaleg. Patch Replacement: A Transformation-based Method to Improve Robustness against Adversarial Attacks. Trustworthy AI 2021 - 1st International Workshop on Trustworthy AI for Multimedia Computing, Oct 2021, Virtual, China. pp.1-10, ⟨10.1145/3475731.3484955⟩. ⟨hal-03363999⟩
59 View
127 Download

Altmetric

Share

Gmail Facebook X LinkedIn More