Defence on unrestricted adversarial examples

Abstract

Deep neural networks in image classification have gained popularity in recent years, and as such, have also become the target of attacks. Adversarial samples are inputs crafted to fool neural networks into misclassification. They come in two forms: one is created by adding specific perturbations to pixels in an image and the second is through generative models or transformations, called unrestricted adversarial samples, which will be the focus of this paper. Conventional methods that make use of the neural network’s gradients are less effective against unrestricted adversarial samples. This paper proposes making use of Generative Adversarial Networks (GANs) which are neural networks that generate images through learning the differences between real and fake images. Transfer learning is used from parts of the GAN to train a general network to distinguish between images created by generative models and real images. Neural networks can be protected from unrestricted adversarial attack through detection of the presence of adversarial images and prevent them from being input to the neural networks. Experiments from the project show that when trained on a dataset of real and adversarial images, the model can differentiate these two classes of images. Testing on images outside of the dataset distribution however yields worse results.