Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Scribd Logo
Upload

Welcome to Scribd!

  • 15 views

    271 Peeyush

    Uploaded by

    Thanos

    Copyright:

    © All Rights Reserved
    Download as ODP, PDF, TXT or read online from Scribd

    271 Peeyush

    Uploaded by

    Thanos
    15 views15 pages

    Original Title

    271_Peeyush

    Copyright

    © © All Rights Reserved

    Available Formats

    ODP, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Copyright:

    © All Rights Reserved
    Download as ODP, PDF, TXT or read online from Scribd
    Download as odp, pdf, or txt
    15 views15 pages

    271 Peeyush

    Uploaded by

    Thanos

    Copyright:

    © All Rights Reserved
    Download as ODP, PDF, TXT or read online from Scribd
    Download as odp, pdf, or txt
    of 15

    Research Presentation

    in
    International Conference on Emerging applications of Artificial Intelligence,
    Machine Learning and Cybersecurity (ICAMC-2024)

    At
    HMRITM, New Delhi, India.
    On
    May 16-17, 2024

    Optimized Adversarial Defense: Combating Adversarial Attack with


    Denoising Autoencoders and Ensemble Learning
    By:
    Peeyush Kumar Singh, Kanishk Vikram Singh, Jayesh, Tushar Bhatia
    CONTENT
     Introduction
     Research Objectives
     Related Works
     Methodology and Experimental Setup
     Results
     Conclusion and Future Scope
    Introduction:The Threat of Adversarial Attacks

    01 02 03
    Security Implications Defense Strategies
    Vulnerability of ML
    Various defense strategies have been
    Models These adversarial examples, often
    proposed, with denoising autoencoders
    imperceptible to humans, pose a significant
    showing promise in filtering out
    Machine learning models, especially deep security threat in critical applications such
    adversarial perturbations by learning to
    neural networks, are vulnerable to as autonomous driving and medical
    reconstruct original inputs from noisy
    adversarial attacks, which are small, diagnosis.
    versions.
    carefully crafted perturbations in input data
    that lead to incorrect model outputs.
    Autoencoder Architecture
    Denoising Autoencoders consist of an encoder that reduces input data to a lower-
    dimensional representation and a decoder that attempts to reconstruct the

    Autoencoders as a original input, aiming to minimize reconstruction error.

    Defense Denoising Capability


    Mechanism Denoising autoencoders are trained on noisy inputs to focus on core image
    features, making them potentially effective against adversarial noise.

    FGSM Attack
    The Fast Gradient Sign Method (FGSM) is a common adversarial technique that
    creates perturbations by manipulating the gradient of the loss function to mislead
    the model.
    The Power of Ensemble Learning
    Basics of Ensemble Learning:
    •Ensemble learning combines predictions from multiple models.
    •Methods include K-Folding, bagging, boosting, and stacking.
    • Diverse set of decision boundaries.

    K-Fold Cross-Validation Explained:


    •Divides data into K subsets for training and validation.
    •Repeatedly trains and evaluates model on different subsets.
    •Reduces overfitting

    Synergy with Denoising Autoencoders:


    •Denoising autoencoders filter out adversarial noise.
    •Combined with K-fold cross-validation, enhances model robustness.
    •Improves defense against adversarial attacks in machine learning
    Research
    Objectives
    To investigate the vulnerability of deep learning
    models to adversarial attack (FGSM).

    To evaluate the effectiveness of denoising


    autoencoders as a defense mechanism.

    To assess the impact of ensemble techniques, such


    as K-fold cross-validation, on defense strategies.
    ●
    Related Works
    These unsupervised neural networks are trained to reconstruct the original input from a corrupted or noisy
    version,effectively learning robust representations of the data [2008]
    •Szegedy et al. [2014] pioneered the concept of adversarial examples, which present subtle modifications to input data that can
    mislead well-trained models into inaccurate predictions. Since then, other research have looked into various sorts of adversarial
    attacks and offered defense techniques to lessen their effects.
    •The Fast Gradient Sign Method (FGSM) [2015], introduced by Goodfellow et al., is widely used for its computational
    efficiency. It generates adversarial examples by varying the input data in the direction of the sign of the loss function’s gradient
    with respect to the input.
    •Xu et al. [2017] introduced a novel defense technique called "Feature Squeezing," which aims to reduce the search space
    available to an adversary by coalescing samples that lie within a small spatial region into a single sample.
    •Input transformations, such as denoising or compression, aim to remove or reduce the adversarial perturbations from the input
    data [2018]
    •Samangouei et al. [2018] proposed Defense-GAN, a generative model-based defense mechanism against adversarial attacks,
    which could be explored in conjunction with denoising autoencoders for improved robustness.
    •Shekhar et al. [2023] provide a survey of various attacks and defense mechanisms in machine learning, covering a wide range
    of techniques and applications. They categorize adversarial attacks based on different criteria,such as the attack methodology
    (e.g., gradient-based, optimization-based, or transfer-based), the attacker's knowledge (e.g., white-box or black-box), and the
    attack objective (e.g., misclassification, targeted misclassification, or source-target misclassification).
    METHODOLOGY AND
    EXPERIMENTAL SETUP
    Dataset and Model

    01 02
    MNIST Dataset CNN for Classification
    A Convolutional Neural Network (CNN) with
    The study uses the MNIST dataset, consisting of
    two convolutional layers and a fully connected
    70,000 grayscale images of handwritten digits, to
    layer is employed for the image classification
    assess the defense against adversarial attacks.
    task.
    Adversarial Attack Generation and Defense

    Denoising Autoencoder Architecture


    FGSM for Perturbations
    The autoencoder architecture includes convolutional and transpose
    The FGSM method is used to generate adversarial examples convolutional layers designed to map inputs to a latent space and
    by adding perturbations that maximize the loss function, reconstruct the original image from this representation.
    leading to misclassification.

    Ensemble Learning and Experimental Steps

    K-Fold Cross Validation Technique Experimental Procedure

    The K-fold technique is applied to the dataset The K-fold technique is applied to the dataset to train
    to train and validate the autoencoder-based and validate the autoencoder-based defense, aiming
    defense, aiming for a robust and generalizable for a robust and generalizable model.
    model.
    Results
    01 Impact of Perturbations
    Visualization of original, adversarial, and reconstructed images shows the deceptive nature of
    adversarial attacks and the autoencoder's ability to recover the digit's structure.

    Sample of original, adversarial, and reconstructed image


    02 Classification Performance Analysis

    The study compares the CNN model's classification accuracy on clean, adversarial, and
    reconstructed test sets, demonstrating the autoencoder's effectiveness in improving robustness.

    Strategy Classification Accuracy

    Base Model (Clean) 99.06%

    Adversarial (ε=0.1) 81.48%

    Autoencoder (Noise factor=0.1) 96.21%

    K-Fold + Autoencoder 97.07%

    Adversarial (ε=0.2) 30.30%

    Autoencoder (Noise factor=0.2) 89.88%

    K-Fold + Autoencoder 93.01%

    Adversarial (ε=0.3) 8.38%

    Autoencoder (Noise factor=0.3) 68.04%

    K-Fold + Autoencoder 77.35%


    Conclusion and Future Scope
    Summarizing the Study Directions for Future Research

    •Defense Mechanism Validation: The •Advanced Autoencoder Architectures: Future research


    study validates the effectiveness of could explore more complex autoencoder architectures for
    denoising autoencoders in defending improved denoising and defense capabilities.
    against FGSM attacks, with K-fold cross-
    validation enhancing robustness and •Diverse Adversarial Attacks: Evaluating the defense
    generalization. against a wider range of adversarial attacks will assess its
    robustness and applicability in various scenarios.
    •Trade-offs and Limitations: A trade-off
    between adversarial robustness and •Real-World Applications: Extending the approach to more
    classification performance is observed, complex datasets and real-world applications will
    and the defense's effectiveness decreases determine the practicality and performance of the
    with more severe perturbations. autoencoder-based defense.
    REFERENCES
    [1] Szegedy, C., et al. (2014). Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199.

    [2] Shekhar, S., et al. (2023). A Comprehensive Survey on Adversarial Attacks and Defenses in Machine Learning.
    arXiv preprint arXiv:2312.03520.

    [3] Goodfellow, I. J., et al. (2015). Explaining and harnessing adversarial examples. arXiv preprint
    arXiv:1412.6572.

    [4] Guo, C., et al. (2018). Countering adversarial images using input transformations. arXiv preprint
    arXiv:1711.00117.

    [5] Vincent, P., et al. (2008). Extracting and composing robust features with denoising autoencoders. In Proceedings
    of the 25th international conference on Machine learning (pp. 1096-1103).

    [6] Xu, W., Evans, D., Qi, Y.: Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks. arXiv
    preprint arXiv:1704.01155 (2017).

    [7] Samangouei, P., Kabkab, M., Chellappa, R.: Defense-GAN: Protecting Classifiers Against
    Adversarial Attacks Using Generative Models. arXiv preprint arXiv:1805.06605 (2018).
    THANK YOU

    You might also like