Frequency Centric Defense Mechanisms against Adversarial Examples

TL;DR

This paper introduces a frequency-based defense mechanism against adversarial examples in CNNs, utilizing Fourier spectrum analysis and entropy, with methods for detection and denoising tested on CIFAR-10 and ImageNet.

Contribution

It proposes a novel frequency-centric approach combining Fourier analysis and entropy for adversarial defense, including detection and denoising techniques.

Findings

High detection accuracy for simple attacks on CIFAR-10

Reduced detection accuracy on complex attacks on ImageNet

Effective denoising restores correct classification for many adversarial examples

Abstract

Adversarial example (AE) aims at fooling a Convolution Neural Network by introducing small perturbations in the input image.The proposed work uses the magnitude and phase of the Fourier Spectrum and the entropy of the image to defend against AE. We demonstrate the defense in two ways: by training an adversarial detector and denoising the adversarial effect. Experiments were conducted on the low-resolution CIFAR-10 and high-resolution ImageNet datasets. The adversarial detector has 99% accuracy for FGSM and PGD attacks on the CIFAR-10 dataset. However, the detection accuracy falls to 50% for sophisticated DeepFool and Carlini & Wagner attacks on ImageNet. We overcome the limitation by using autoencoder and show that 70% of AEs are correctly classified after denoising.