Combating adversaries with anti-adversaries

Conference item

Deep neural networks are vulnerable to small input perturbations known as adversarial attacks. Inspired by the fact that these adversaries are constructed by iteratively minimizing the confidence of a network for the true class label, we propose the anti-adversary layer, aimed at countering this effect. In particular, our layer generates an input perturbation in the opposite direction of the adversarial one and feeds the classifier a perturbed version of the input. Our approach is trainingfree and theoretically supported. We verify the effectiveness of our approach by combining our layer with both nominally and robustly trained models and conduct large-scale experiments from black-box to adaptive attacks on CIFAR10, CIFAR100, and ImageNet. Our layer significantly enhances model robustness while coming at no cost on clean accuracy

Authors: Alfarra, M; Perez, JC; Thabet, A; Bibi, A; Torr, P

• Publication status: Published
• Peer review status: Peer reviewed
• Publisher: Association for the Advancement of Artificial Intelligence
• Host title: Proceedings of the 36th AAAI Conference on Artificial Intelligence
• Volume: 36
• Issue: 6
• Pages: 5992-6000
• Publication date: 2022-06-28
• Acceptance date: 2021-11-29
• Event title: 36th AAAI Conference on Artificial Intelligence (AAAI 2022)
• Event location: Virtual event
• Event website: https://aaai.org/Conferences/AAAI-22/
• Event start date: 2022-02-22
• Event end date: 2022-03-01
• DOI: 10.1609/aaai.v36i6.20545
• EISSN: 2374-3468
• ISSN: 2159-5399
• Language: English
• Keywords: FFR; computer vision; machine learning