Adversarial Detection by Approximation of Ensemble Boundary

TL;DR

This paper introduces a novel adversarial detection method for ensemble DNNs by approximating decision boundary curvature using Walsh coefficients, which helps identify adversarial attacks based on boundary complexity changes.

Contribution

The paper proposes a new detection technique that models ensemble decision boundaries with Walsh coefficients, capturing boundary curvature variations to detect adversarial examples.

Findings

Walsh coefficients effectively approximate ensemble decision boundaries.

Adversarial attacks alter boundary curvature, detectable through coefficient analysis.

Method applicable beyond image recognition to other two-class problems.

Abstract

Despite being effective in many application areas, Deep Neural Networks (DNNs) are vulnerable to being attacked. In object recognition, the attack takes the form of a small perturbation added to an image, that causes the DNN to misclassify, but to a human appears no different. Adversarial attacks lead to defences that are themselves subject to attack, and the attack/ defence strategies provide important information about the properties of DNNs. In this paper, a novel method of detecting adversarial attacks is proposed for an ensemble of Deep Neural Networks (DNNs) solving two-class pattern recognition problems. The ensemble is combined using Walsh coefficients which are capable of approximating Boolean functions and thereby controlling the decision boundary complexity. The hypothesis in this paper is that decision boundaries with high curvature allow adversarial perturbations to be found, but change the curvature of the decision boundary, which is then approximated in a different way by Walsh coefficients compared to the clean images. Besides controlling boundary complexity, the coefficients also measure the correlation with class labels, which may aid in understanding the learning and transferability properties of DNNs. While the experiments here use images, the proposed approach of modelling two-class ensemble decision boundaries could in principle be applied to any application area.