Model Compression Hardens Deep Neural Networks: A New Perspective to Prevent Adversarial Attacks
Model Compression Hardens Deep Neural Networks: A New Perspective to Prevent Adversarial Attacks
复制标题
DOI：
10.1109/tnnls.2021.3089128
复制
发表时间：
2021-06-25
影响因子：
10.4
通讯作者：
Wen, Wujie
中科院分区：
文献类型：
--
作者：
Liu, Qi;Wen, Wujie
深度神经网络（DNN）在许多实际应用中取得了显著的成功。然而，近期的研究表明，DNN的决策很容易被对抗样本误导——这些对抗样本是由恶意攻击者精心制作的、带有难以察觉的扰动的输入，这给基于DNN的系统带来了日益增长的安全担忧。不幸的是，当前的防御技术面临以下问题：1）鉴于在实际场景中可能出现的多样化攻击具有不同的性质，它们通常无法抵御所有类型的攻击；2）它们中的大多数都需要相当高的实施成本，比如完全重新训练。这迫切需要开发一种部署成本低的综合防御框架。在这项工作中，我们揭示了“防御决策边界”和“小梯度”是缓解具有不同特性的对抗样本有效性的两个关键条件。我们建议巧妙地使用“哈希压缩”来重建一个低成本的“防御哈希分类器”，作为我们防御的第一道防线。然后，我们提出了一组无需重新训练的“梯度抑制”（GI）方法，以极大地抑制和随机化用于制作对抗样本的梯度。最后，我们通过将“防御哈希分类器”和“GI”进行组合，开发了一个综合防御框架。我们在传统的白盒、强自适应白盒和黑盒设置下评估了我们的防御。大量研究表明，我们的解决方案能够极大地降低针对不同数据集的各种对抗攻击的成功率。
Deep neural networks (DNNs) have been demonstrating phenomenal success in many real-world applications. However, recent works show that DNN's decision can be easily misguided by adversarial examples-the input with imperceptible perturbations crafted by an ill-disposed adversary, causing the ever-increasing security concerns for DNN-based systems. Unfortunately, current defense techniques face the following issues: 1) they are usually unable to mitigate all types of attacks, given that diversified attacks, which may occur in practical scenarios, have different natures and 2) most of them are subject to considerable implementation cost such as complete retraining. This prompts an urgent need of developing a comprehensive defense framework with low deployment costs. In this work, we reveal that ``defensive decision boundary'' and ``small gradient'' are two critical conditions to ease the effectiveness of adversarial examples with different properties. We propose to wisely use ``hash compression'' to reconstruct a low-cost ``defensive hash classifier'' to form the first line of our defense. We then propose a set of retraining-free ``gradient inhibition'' (GI) methods to extremely suppress and randomize the gradient used to craft adversarial examples. Finally, we develop a comprehensive defense framework by orchestrating ``defensive hash classifier'' and ``GI.'' We evaluate our defense across traditional white-box, strong adaptive white-box, and black-box settings. Extensive studies show that our solution can enormously decrease the attack success rate of various adversarial attacks on the diverse dataset.