Online Alternate Generator against Adversarial Attacks

TL;DR

This paper introduces an online alternate generator method that synthesizes images during inference to defend against adversarial attacks without modifying target network parameters, outperforming existing defenses.

Contribution

The proposed online alternate generator provides a parameter-free, inference-stage defense against adversarial attacks, avoiding retraining and known attack dependencies.

Findings

Outperforms state-of-the-art defenses against gray-box attacks

Does not require access to or modification of target network parameters

Effective in synthesizing images to counter adversarial noise

Abstract

The field of computer vision has witnessed phenomenal progress in recent years partially due to the development of deep convolutional neural networks. However, deep learning models are notoriously sensitive to adversarial examples which are synthesized by adding quasi-perceptible noises on real images. Some existing defense methods require to re-train attacked target networks and augment the train set via known adversarial attacks, which is inefficient and might be unpromising with unknown attack types. To overcome the above issues, we propose a portable defense method, online alternate generator, which does not need to access or modify the parameters of the target networks. The proposed method works by online synthesizing another image from scratch for an input image, instead of removing or destroying adversarial noises. To avoid pretrained parameters exploited by attackers, we alternately update the generator and the synthesized image at the inference stage. Experimental results demonstrate that the proposed defensive scheme and method outperforms a series of state-of-the-art defending models against gray-box adversarial attacks.