Using an ensemble color space model to tackle adversarial examples
This addresses a critical security issue in AI systems, such as autonomous vehicles, by providing a more robust defense against various adversarial attacks, though it appears incremental as it builds on existing defense strategies.
The authors tackled the problem of adversarial examples in deep learning, particularly for applications like autonomous driving, by proposing a three-step method involving denoising, multiple color spaces, and feature map enlargement, resulting in a 56.12% increase in robustness against white-box attacks without adversarial training.
Minute pixel changes in an image drastically change the prediction that the deep learning model makes. One of the most significant problems that could arise due to this, for instance, is autonomous driving. Many methods have been proposed to combat this with varying amounts of success. We propose a 3 step method for defending such attacks. First, we denoise the image using statistical methods. Second, we show that adopting multiple color spaces in the same model can help us to fight these adversarial attacks further as each color space detects certain features explicit to itself. Finally, the feature maps generated are enlarged and sent back as an input to obtain even smaller features. We show that the proposed model does not need to be trained to defend an particular type of attack and is inherently more robust to black-box, white-box, and grey-box adversarial attack techniques. In particular, the model is 56.12 percent more robust than compared models in case of white box attacks when the models are not subject to adversarial example training.