.png){kind=icon}
.png){kind=icon}
Return
LISArD: learning image similarity to defend against gray-box adversarial attacks
.png){kind=icon}
PRE
AI
C
R
DOI：10.7717/peerj-cs.3735.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
State-of-the-art defense mechanisms are typically evaluated in the context of white-box attacks, which is not realistic, as it assumes the attacker can access the gradients of the target network. To protect against this scenario, Adversarial Training (AT) and Adversarial Distillation (AD) include adversarial examples during the training phase, and Adversarial Purification uses a generative model to reconstruct all the images given to the classifier. This article considers an even more realistic evaluation scenario: gray-box attacks, which assume that the attacker knows the architecture and the dataset used to train the target network, but cannot access its gradients. We provide empirical evidence that models are vulnerable to gray-box attacks and propose Learning Image Similarity Adversarial Defense (LISArD), a defense mechanism that does not require training extra models despite slightly increasing training cost, which provides robustness against gray- and white-box attacks without including AT. Our method constructs a cross-correlation matrix by multiplying the embeddings of noisy (augmented with random Gaussian noise) and clean images, then approximates it to a diagonal matrix while simultaneously promoting correct image classification. This process allows the model to recognize noisy image embeddings as similar to those of clean images, thereby improving its generalization. The results show that LISArD can effectively protect against gray-box attacks across different datasets and can be successfully used in multiple architectures. Additionally, without additional training, LISArD resilience carries over to white-box and black-box scenarios, demonstrating its ability to withstand zero-day attacks (i.e., previously unseen adversarial samples). Finally, the results show that state-of-the-art AD models underperform significantly when AT is removed and/or when moving to gray-box settings, highlighting their lack of robustness across various conditions and further emphasizing the importance of LISArD. All the source code is available at https://github.com/Joana-Cabral/LISArD.
Keywords:
Adversarial attacks
Gray-box
Robustness
Similarity training
Adversarial defense
Journal
IF:
2.5
Papers:
3.3K
Citations:
6.9K
Organization
Cited Papers