We improve the robustness of deep neural nets  to adversarial attacks by using an interpolating function as the output activation.    This data-dependent activation function remarkably improves both classification accuracy and stability to adversarial perturbations. Together with the total variation minimization of adversarial images and augmented training, under the strongest attack, we achieve up to 20.6%, 50.7%, and 68.7% accuracy improvement w.r.t.   the fast gradient sign method, iterative fast gradient sign method, and Carlini-WagnerL2attacks, respectively.   Our defense strategy is additive to many of the existing methods.   We give an intuitive explanation of our defense strategy via analyzing the geometry of the feature space. For reproducibility, the code will be available on GitHub. The adversarial vulnerability BID26 of deep neural nets (DNNs) threatens their applicability in security critical tasks, e.g., autonomous cars BID0 , robotics BID8 , DNN-based malware detection systems BID20 BID7 . Since the pioneering work by BID26 , many advanced adversarial attack schemes have been devised to generate imperceptible perturbations to sufficiently fool the DNNs BID6 BID19 BID5 BID29 BID11 BID2 . And not only are adversarial attacks successful in white-box attacks, i.e. when the adversary has access to the DNN parameters, but they are also successful in black-box attacks, i.e. it has no access to the parameters. Black-box attacks are successful because one can perturb an image so it misclassifies on one DNN, and the same perturbed image also has a significant chance to be misclassified by another DNN; this is known as transferability of adversarial examples BID22 ). Due to this transferability, it is very easy to attack neural nets in a blackbox fashion BID14 BID4 . In fact, there exist universal perturbations that can imperceptibly perturb any image and cause misclassification for any given network (MoosaviDezfooli et al. (2017) ). There is much recent research on designing advanced adversarial attacks and defending against adversarial perturbation.In this work, we propose to defend against adversarial attacks by changing the DNNs' output activation function to a manifold-interpolating function, in order to seamlessly utilize the training data's information when performing inference. Together with the total variation minimization (TVM) and augmented training, we show state-of-the-art defense results on the CIFAR-10 benchmark. Moreover, we show that adversarial images generated from attacking the DNNs with an interpolating function are more transferable to other DNNs, than those resulting from attacking standard DNNs.
We proposal strategies for adversarial defense based on data dependent activation function, total variation minimization, and training data augmentation
{"src": "scitldr-AIC_train", "paper_id": "r1z1UjA5FX"}