Effects of Image Processing Operations on Adversarial Noise and Their Use in Detecting and Correcting Adversarial Images

Huy H. Nguyen, Minoru Kuribayashi, Junichi Yamagishi, Isao Echizen

Research output: Contribution to journalArticlepeer-review

Abstract

Deep neural networks (DNNs) have achieved excellent performance on several tasks and have been widely applied in both academia and industry. However, DNNs are vulnerable to adversarial machine learning attacks in which noise is added to the input to change the networks' output. Consequently, DNN-based mission-critical applications such as those used in self-driving vehicles have reduced reliability and could cause severe accidents and damage. Moreover, adversarial examples could be used to poison DNN training data, resulting in corruptions of trained models. Besides the need for detecting adversarial examples, correcting them is important for restoring data and system functionality to normal. We have developed methods for detecting and correcting adversarial images that use multiple image processing operations with multiple parameter values. For detection, we devised a statistical-based method that outperforms the feature squeezing method. For correction, we devised a method that uses for the first time two levels of correction. The first level is label correction, with the focus on restoring the adversarial images' original predicted labels (for use in the current task). The second level is image correction, with the focus on both the correctness and quality of the corrected images (for use in the current and other tasks). Our experiments demonstrated that the correction method could correct nearly 90% of the adversarial images created by classical adversarial attacks and affected only about 2% of the normal images.

Original languageEnglish
Pages (from-to)65-77
Number of pages13
JournalIEICE Transactions on Information and Systems
VolumeE105D
Issue number1
DOIs
Publication statusPublished - 2022

Keywords

  • Adversarial machine learning
  • Correcting adversarial image
  • Data cleansing
  • Deep neural network
  • Detecting adversarial image
  • Image processing operation

ASJC Scopus subject areas

  • Software
  • Hardware and Architecture
  • Computer Vision and Pattern Recognition
  • Electrical and Electronic Engineering
  • Artificial Intelligence

Fingerprint

Dive into the research topics of 'Effects of Image Processing Operations on Adversarial Noise and Their Use in Detecting and Correcting Adversarial Images'. Together they form a unique fingerprint.

Cite this