Resisting Adversarial Attacks in Deep Neural Networks using Diverse Decision Boundaries

TL;DR

This paper proposes a novel ensemble-based defense for deep neural networks that enhances robustness against adversarial attacks by creating diverse decision boundaries through input transformation and feature restriction techniques.

Contribution

The paper introduces a new ensemble method that constructs diverse classifiers with different decision boundaries to improve adversarial robustness, evaluated on standard image datasets.

Findings

Enhanced robustness against state-of-the-art adversarial attacks

Effective in defending against stronger, targeted adversaries

Maintains low false positive and false negative rates

Abstract

The security of deep learning (DL) systems is an extremely important field of study as they are being deployed in several applications due to their ever-improving performance to solve challenging tasks. Despite overwhelming promises, the deep learning systems are vulnerable to crafted adversarial examples, which may be imperceptible to the human eye, but can lead the model to misclassify. Protections against adversarial perturbations on ensemble-based techniques have either been shown to be vulnerable to stronger adversaries or shown to lack an end-to-end evaluation. In this paper, we attempt to develop a new ensemble-based solution that constructs defender models with diverse decision boundaries with respect to the original model. The ensemble of classifiers constructed by (1) transformation of the input by a method called Split-and-Shuffle, and (2) restricting the significant features by a method called Contrast-Significant-Features are shown to result in diverse gradients with respect to adversarial attacks, which reduces the chance of transferring adversarial examples from the original to the defender model targeting the same class. We present extensive experimentations using standard image classification datasets, namely MNIST, CIFAR-10 and CIFAR-100 against state-of-the-art adversarial attacks to demonstrate the robustness of the proposed ensemble-based defense. We also evaluate the robustness in the presence of a stronger adversary targeting all the models within the ensemble simultaneously. Results for the overall false positives and false negatives have been furnished to estimate the overall performance of the proposed methodology.