The vulnerability of deep neural networks to adversarial examples has been confirmed.If the generation of adversarial examples is unregulated,images within reach are no longer secure and pose a threat to non-robust DNNs.However,existing adversarial defenses primarily aim at preventing adversarial examples from attacking deep neural networks successfully,rather than preventing their generation.Therefore,we propose a novel adversarial defense mechanism,which is referred to as immune defense.This mechanism applies carefully designed quasi-imperceptible perturbations to the raw images to prevent the generation of adversarial examples for the raw images thereby protecting both images and deep neural networks.Such perturbations are referred to as immune perturbations,and these perturbed images are referred to as immune examples.In the white-box immune defense,we propose Hyperbolic Tangent Immune Defense(HTID)to craft white-box immune examples with high classification accuracy,defensive performance,and visual quality.In the black-box immune defense,we propose Moment-based Immune Defense(MID)to enhance the transferability of immune examples,so as to ensure the defensive performance against unknown adversarial attacks.In addition,we propose immune rate to more accurately measure the defensive performance of immune examples.Extensive experiments on CIFAR-10,MNIST,STL-10,and Caltech-256 show that the immune examples crafted by HTID and MID have high classification accuracy,which reaches 100.0％and is 10.5％higher than the original accuracy on average.The immune examples also have high visual quality with SSIM between 0.822 and 0.900.The experiments also show that MID has higher transferability than HTID.The average immune rates of the immune examples crafted by MID against AdvGAN to defend against other 11 adversarial attacks on the two datasets are 62.1％,52.1％,56.8％and 48.7％,which are 15.0％,10.8％,17.5％and 15.7％higher than HTID,respectively.
关键词
深度神经网络/对抗样本/对抗防御/免疫防御/可迁移性
Key words
deep neural network/adversarial example/adversarial defense/immune defense/transferability
维普
万方数据