Pedraza Anibal, Deniz Oscar, Bueno Gloria
VISILAB, University of Castilla La Mancha, 13001 Ciudad Real, Spain.
Entropy (Basel). 2020 Oct 24;22(11):1201. doi: 10.3390/e22111201.
Adversarial examples are one of the most intriguing topics in modern deep learning. Imperceptible perturbations to the input can fool robust models. In relation to this problem, attack and defense methods are being developed almost on a daily basis. In parallel, efforts are being made to simply pointing out when an input image is an adversarial example. This can help prevent potential issues, as the failure cases are easily recognizable by humans. The proposal in this work is to study how chaos theory methods can help distinguish adversarial examples from regular images. Our work is based on the assumption that deep networks behave as chaotic systems, and adversarial examples are the main manifestation of it (in the sense that a slight input variation produces a totally different output). In our experiments, we show that the Lyapunov exponents (an established measure of chaoticity), which have been recently proposed for classification of adversarial examples, are not robust to image processing transformations that alter image entropy. Furthermore, we show that entropy can complement Lyapunov exponents in such a way that the discriminating power is significantly enhanced. The proposed method achieves 65% to 100% accuracy detecting adversarials with a wide range of attacks (for example: CW, PGD, Spatial, HopSkip) for the MNIST dataset, with similar results when entropy-changing image processing methods (such as Equalization, Speckle and Gaussian noise) are applied. This is also corroborated with two other datasets, Fashion-MNIST and CIFAR 19. These results indicate that classifiers can enhance their robustness against the adversarial phenomenon, being applied in a wide variety of conditions that potentially matches real world cases and also other threatening scenarios.
对抗样本是现代深度学习中最引人入胜的话题之一。对输入的不可察觉的扰动能够欺骗鲁棒模型。针对这个问题，攻击和防御方法几乎每天都在发展。与此同时，人们也在努力简单地指出输入图像何时是一个对抗样本。这有助于预防潜在问题，因为失败案例很容易被人类识别。这项工作中的提议是研究混沌理论方法如何有助于将对抗样本与正常图像区分开来。我们的工作基于这样一个假设，即深度网络表现为混沌系统，而对抗样本是其主要表现形式（从轻微的输入变化会产生完全不同的输出这个意义上来说）。在我们的实验中，我们表明，最近被提议用于对抗样本分类的李雅普诺夫指数，对于改变图像熵的图像处理变换并不鲁棒。此外，我们表明熵可以以一种显著增强判别力的方式补充李雅普诺夫指数。对于MNIST数据集，所提出的方法在检测具有广泛攻击（例如：CW、PGD、空间、跳跃搜索）的对抗样本时，准确率达到65%至100%，当应用改变熵的图像处理方法（如均衡化、散斑和高斯噪声）时也有类似结果。这也在另外两个数据集Fashion-MNIST和CIFAR 19上得到了证实。这些结果表明，分类器可以增强其对对抗现象的鲁棒性，适用于各种可能与现实世界情况以及其他威胁场景相匹配的条件。
