Advanced defensive distillation with ensemble voting and noisy logits

Abstract

In this paper we provide an approach for deep neural networks that protects against adversarial examples in image classification-type problems. blackUnlike adversarial training, our approach is independent to the obtained adversarial examples through min-max optimization. The approach relies on the defensive distillation mechanism. This defence mechanism, while very successful at the time, was defeated in less than a year due to a major intrinsic vulnerability: the availability of the neural network’s logit layer to the attacker. We overcome this vulnerability and enhance defensive distillation by two mechanisms: 1) a mechanism to hide the logit layer (noisy logit) which increases robustness at the expense of accuracy, and, 2) a mechanism that improves accuracy but does not always increase robustness (ensemble network). We show that by combining the two mechanisms and incorporating a voting method, we can provide protection against adversarial examples while retaining accuracy. We formulate potential attacks on our approach with different threat models. The experimental results demonstrate the effectiveness of our approach. We also provide a robustness guarantee along with an interpretation for the guarantee.

Appendices

Appendix:

1.1 A Superimposition Attack using $L_{\infty }$ Norm

In this section we present the results from applying the Superimposition (3 ×) attack with the $L_{\infty }$ norm to our model. In Table 7 we observe similarly that Noisy Logit reduces the success rate of attack on the individual networks and Ensemble Voting allows accuracy to be further improved for both datasets.

Table 7 Distributions for Superimposition (3 ×) of adversarial attack with the $L_{\infty }$ norm

1.2 B A second look at noisy logit

The results for the Random Single Network Attack in Section 4.3 provided some insights into how Noisy Logit works to reduce transferability across different neural networks. However, in the case of the MNIST dataset, we observed that although Noisy Logit changes the distribution of perturbations in the adversarial examples, it appears there is no benefit to using Noisy Logit as Ensemble Voting alone provides better accuracy rates. In this section, we look at the output of each individual network in isolation when it’s being targeted, to see whether applying Noisy Logit improves robustness in a single network. In Fig. 9 we craft adversarial examples corresponding to a single sample and single target, on each of the 50 networks in the ensemble.

Fig. 9

Adversarial examples without and with Noisy Logit applied

In Fig. 9a and b, the sample input is the digit 7 and target is the digit 0. Observe that the distribution of perturbations is changed if we apply Noisy Logit, where in Fig. 9b we see more occurrences in the tails (i.e. very small or very large perturbations). In Fig. 9a each targeted network mis-classifies its corresponding adversarial example as 0 (corresponding to 100% success rate of Carlini-Wagner on a single network); whereas in Fig. 9b, only 8 of the networks misclassify as 0, and 29 of the networks still correctly classify as 7 as shown in Table 8a. Therefore, for an individual MNIST network with Noisy Logit applied, the success rate of a targeted Carlni-Wagner attack is low. Thus, a single MNIST network is more robust to adversarial examples if Noisy Logit is applied, however the accuracy rate suffers since extra noise is added.

Table 8 Classifications of the 50 networks corresponding to Fig. 9b and d, respectively

In Fig. 9c and d, the sample input is the object ship and the target is the object airplane. There is no noticeable difference in the distribution of perturbations whether or not Noisy Logit is applied. In Fig. 9c, again each targeted network misclassifies its corresponding adversarial example as the target (airplane); whereas in Fig. 9d, only 1 of the networks misclassifies as airplane, and 38 of the networks still correctly classify as ship as shown in Table 8. Therefore, the success rate of a targeted Carlni-Wagner attack on a single CIFAR10 network is very low, i.e., robustness of a single CIFAR10 network is increased in the presence of Noisy Logit. Note also the accuracy rate only slightly suffers from extra noise added.

C Sample results for superimposition attacks

In Figs. 10a–13b samples of resulting images with adversarial perturbations are shown. The leftmost column displays the original images, the middle columns display the adversarial examples with the two or three smallest perturbations, the last column shows the superimposition of the two or three adversarial examples. The rows correspond to different targets being applied in the adversarial examples. Classifications of these images are provided in Tables 9 and 10.

Fig. 10

Adversarial Images using Superimposition (2 × and 3 ×) MNIST Sample 1

Fig. 11

Adversarial Images using Superimposition (2 × and 3 ×) MNIST Sample 2

Fig. 12

Adversarial Images using Superimposition (3 ×) CIFAR Sample 1

Fig. 13

Adversarial Images using Superimposition (2 × and 3 ×) CIFAR Sample 2

Table 9 Classifications of MNIST

Table 10 Classifications of CIFAR