Tricking Adversarial Attacks To Fail
This addresses the problem of adversarial attacks for machine learning classifiers by offering a novel defense strategy that eliminates the need to know the attack or generate adversarial samples, though it may be incremental in the broader field.
The paper tackles the failure of recent adversarial defenses by introducing Target Training, a white-box defense that tricks untargeted gradient-based attacks into targeting designated classes, from which the real class can be derived, achieving 86.2% accuracy on CIFAR10 against CW-L2 attacks.
Recent adversarial defense approaches have failed. Untargeted gradient-based attacks cause classifiers to choose any wrong class. Our novel white-box defense tricks untargeted attacks into becoming attacks targeted at designated target classes. From these target classes, we can derive the real classes. Our Target Training defense tricks the minimization at the core of untargeted, gradient-based adversarial attacks: minimize the sum of (1) perturbation and (2) classifier adversarial loss. Target Training changes the classifier minimally, and trains it with additional duplicated points (at 0 distance) labeled with designated classes. These differently-labeled duplicated samples minimize both terms (1) and (2) of the minimization, steering attack convergence to samples of designated classes, from which correct classification is derived. Importantly, Target Training eliminates the need to know the attack and the overhead of generating adversarial samples of attacks that minimize perturbations. We obtain an 86.2% accuracy for CW-L2 (confidence=0) in CIFAR10, exceeding even unsecured classifier accuracy on non-adversarial samples. Target Training presents a fundamental change in adversarial defense strategy.