NIC: Detecting Adversarial Samples with Neural Network Invariant Checking
NIC: Detecting Adversarial Samples with Neural Network Invariant Checking
复制标题
DOI：
10.14722/ndss.2019.23415
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
Shiqing Ma;Yingqi Liu;Guanhong Tao;Wen-Chuan Lee;X. Zhang
中科院分区：
文献类型：
--
作者：
Shiqing Ma;Yingqi Liu;Guanhong Tao;Wen-Chuan Lee;X. Zhang
- 深度神经网络（DNN）容易受到对抗性样本的影响，这些样本是通过扰动正确分类的艾德输入而生成的，从而导致DNN模型行为不当（例如，misclass-sification）。这可能会导致灾难性的后果，特别是在安全敏感的应用程序中。现有的防御和检测技术在各种假设下（例如，可能攻击的集合是预先已知的）。然而，它们不足以保护免受更广泛的攻击。在本文中，我们分析了DNN模型在各种攻击下的内部结构，并确定了两个常见的利用渠道：起源渠道和激活值分发渠道。然后，我们提出了一种新的技术来提取DNN不变量，并使用它们来执行运行时对抗样本检测。我们在包括ImageNet和13个模型在内的流行数据集上对11种不同类型的攻击进行了实验，结果表明，我们的技术可以有效地检测到所有这些攻击（准确率超过90%），误报率有限。我们还将其与三种最先进的技术进行了比较，包括基于局部固有相干性（LID）的方法，基于去噪器的方法（即，MagNet和HGD），以及基于预测不一致性的方法（即，特征挤压）。我们的实验显示了有希望的结果。
—Deep Neural Networks (DNN) are vulnerable to adversarial samples that are generated by perturbing correctly classified inputs to cause DNN models to misbehave (e.g., misclas-sification). This can potentially lead to disastrous consequences especially in security-sensitive applications. Existing defense and detection techniques work well for specific attacks under various assumptions (e.g., the set of possible attacks are known beforehand). However, they are not sufficiently general to protect against a broader range of attacks. In this paper, we analyze the internals of DNN models under various attacks and identify two common exploitation channels: the provenance channel and the activation value distribution channel. We then propose a novel technique to extract DNN invariants and use them to perform runtime adversarial sample detection. Our experimental results of 11 different kinds of attacks on popular datasets including ImageNet and 13 models show that our technique can effectively detect all these attacks (over 90% accuracy) with limited false positives. We also compare it with three state-of-the-art techniques including the Local Intrinsic Dimensionality (LID) based method, denoiser based methods (i.e., MagNet and HGD), and the prediction inconsistency based approach (i.e., feature squeezing). Our experiments show promising results.