Frequency Centric Defense Mechanisms against Adversarial Examples
This work addresses security vulnerabilities in image classification systems for AI practitioners, but it is incremental as it builds on existing defense methods with mixed results across datasets and attack types.
The paper tackles the problem of defending against adversarial examples in convolutional neural networks by using Fourier spectrum magnitude and phase and image entropy, achieving 99% detection accuracy for FGSM and PGD attacks on CIFAR-10 but only 50% for DeepFool and Carlini & Wagner attacks on ImageNet, with denoising improving classification to 70% of adversarial examples.
Adversarial example (AE) aims at fooling a Convolution Neural Network by introducing small perturbations in the input image.The proposed work uses the magnitude and phase of the Fourier Spectrum and the entropy of the image to defend against AE. We demonstrate the defense in two ways: by training an adversarial detector and denoising the adversarial effect. Experiments were conducted on the low-resolution CIFAR-10 and high-resolution ImageNet datasets. The adversarial detector has 99% accuracy for FGSM and PGD attacks on the CIFAR-10 dataset. However, the detection accuracy falls to 50% for sophisticated DeepFool and Carlini & Wagner attacks on ImageNet. We overcome the limitation by using autoencoder and show that 70% of AEs are correctly classified after denoising.