The vulnerability of Deep Neural Networks (DNNs) to adversarial examples has been confirmed. Existing adversarial defenses primarily aim at preventing adversarial examples from attacking DNNs successfully, rather than preventing their generation. If the generation of adversarial examples is unregulated, images within reach are no longer secure and pose a threat to non-robust DNNs. Although gradient obfuscation attempts to address this issue, it has been shown to be circumventable. Therefore, we propose a novel adversarial defense mechanism, which is referred to as immune defense and is the example-based pre-defense. This mechanism applies carefully designed quasi-imperceptible perturbations to the raw images to prevent the generation of adversarial examples for the raw images, and thereby protecting both images and DNNs. These perturbed images are referred to as Immune Examples (IEs). In the white-box immune defense, we provide a gradient-based and an optimization-based approach, respectively. Additionally, the more complex black-box immune defense is taken into consideration. We propose Masked Gradient Sign Descent (MGSD) to reduce approximation error and stabilize the update to improve the transferability of IEs and thereby ensure their effectiveness against black-box adversarial attacks. The experimental results demonstrate that the optimization-based approach has superior performance and better visual quality in white-box immune defense. In contrast, the gradient-based approach has stronger transferability and the proposed MGSD significantly improve the transferability of baselines.
翻译:深神经网络(DNNS)对对抗性实例的脆弱性已经得到证实。现有的对抗性防御机制的主要目的是防止对DNN(DNNS)的攻击成功,而不是阻止其产生。如果产生对抗性实例不受管制,那么所能得到的图像就不再安全,对非机器人DNN(DNNS)构成威胁。虽然梯度模糊模糊图解试图解决这一问题,但已经证明这是可以规避的。因此,我们提议了一个新型的对抗性防御机制,称为免疫防御,是以实例为基础的防守。这个机制主要是为了防止对DNNNNW(DNNS)的攻击成功成功,而不是防止其产生敌对性例子,而不是阻止其产生。如果产生对抗原始图像的对抗性实例,那么可以同时保护图像和DNNNNW(D)。在“Immune 示例”中,我们分别提供了一种基于梯度和基于优化的方法。此外,我们建议采用更复杂的黑箱免疫性防御。我们提议使用“防腐蚀性重型”的IGNSB(MSD)来大幅降低原始图像的准性,从而改进了其战略效果的升级性,并稳定了其交付性战略效果,从而改进了其交付性战略效果,从而改进了其交付性能更精确性。</s>