Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks

Abstract

Although deep neural networks (DNNs) have achieved great success in many\ntasks, they can often be fooled by \\emph{adversarial examples} that are\ngenerated by adding small but purposeful distortions to natural examples.\nPrevious studies to defend against adversarial examples mostly focused on\nrefining the DNN models, but have either shown limited success or required\nexpensive computation. We propose a new strategy, \\emph{feature squeezing},\nthat can be used to harden DNN models by detecting adversarial examples.\nFeature squeezing reduces the search space available to an adversary by\ncoalescing samples that correspond to many different feature vectors in the\noriginal space into a single sample. By comparing a DNN model's prediction on\nthe original input with that on squeezed inputs, feature squeezing detects\nadversarial examples with high accuracy and few false positives. This paper\nexplores two feature squeezing methods: reducing the color bit depth of each\npixel and spatial smoothing. These simple strategies are inexpensive and\ncomplementary to other defenses, and can be combined in a joint detection\nframework to achieve high detection rates against state-of-the-art attacks.\n

Keywords

Affiliated Institutions

• University of Virginia US

Related Publications