Skip to main content

Defending Against Universal Attacks Through Selective Feature Regeneration

Author(s): Borkar, Tejas; Heide, Felix; Karam, Lina

To refer to this page use:
Abstract: Deep neural network (DNN) predictions have been shown to be vulnerable to carefully crafted adversarial perturbations. Specifically, image-agnostic (universal adversarial) perturbations added to any image can fool a target network into making erroneous predictions. Departing from existing defense strategies that work mostly in the image domain, we present a novel defense which operates in the DNN feature domain and effectively defends against such universal perturbations. Our approach identifies pre-trained convolutional features that are most vulnerable to adversarial noise and deploys trainable feature regeneration units which transform these DNN filter activations into resilient features that are robust to universal perturbations. Regenerating only the top 50% adversarially susceptible activations in at most 6 DNN layers and leaving all remaining DNN activations unchanged, we outperform existing defense strategies across different network architectures by more than 10% in restored accuracy. We show that without any additional modification, our defense trained on ImageNet with one type of universal attack examples effectively defends against other types of unseen universal attacks.
Publication Date: 2020
Citation: Borkar, Tejas, Felix Heide, and Lina Karam. "Defending Against Universal Attacks Through Selective Feature Regeneration." In IEEE/CVF Conference on Computer Vision and Pattern Recognition (2020): pp. 706-716. doi:10.1109/CVPR42600.2020.00079
DOI: 10.1109/CVPR42600.2020.00079
ISSN: 1063-6919
EISSN: 2575-7075
Pages: 706 - 716
Type of Material: Conference Article
Journal/Proceeding Title: IEEE/CVF Conference on Computer Vision and Pattern Recognition
Version: Author's manuscript

Items in OAR@Princeton are protected by copyright, with all rights reserved, unless otherwise indicated.