ODDR: Outlier Detection & Dimension Reduction Based Defense Against Adversarial Patches

📄 arXiv: 2311.12084v2 📥 PDF

作者: Nandish Chattopadhyay, Amira Guesmi, Muhammad Abdullah Hanif, Bassem Ouni, Muhammad Shafique

分类: cs.CR, cs.CV

发布日期: 2023-11-20 (更新: 2024-08-27)

💡 一句话要点

提出ODDR以应对基于补丁的对抗攻击问题

🎯 匹配领域: 支柱三：空间感知与语义 (Perception & Semantics)

关键词: 对抗攻击 异常检测 降维技术 机器学习 模型鲁棒性 图像处理 深度学习

📋 核心要点

  1. 现有的对抗攻击防御方法在面对基于补丁的攻击时效果不佳，导致模型的准确性显著下降。
  2. ODDR通过识别输入特征中的异常值，利用统计方法进行防御，能够有效应对对抗补丁的影响。
  3. 在GoogleAp攻击下，ODDR将模型准确性从39.26%提升至79.1%，显著超越了现有的领先防御方法。

📝 摘要（中文）

对抗攻击对机器学习模型的可靠部署构成了重大挑战，尤其是基于补丁的攻击。这些攻击在图像的局部区域引入对抗扰动，欺骗经过良好训练的模型。本文提出了一种全面的防御策略——异常检测与降维（ODDR），旨在通过先进的统计方法抵御基于补丁的对抗攻击。ODDR通过三个阶段的管道操作：分割、隔离和中和，识别出与对抗扰动相关的异常特征，并有效中和其影响，同时保留关键信息。对基准数据集的广泛评估表明，ODDR在多种任务中表现出色，显著提高了模型的准确性。

🔬 方法详解

问题定义：本文旨在解决基于补丁的对抗攻击对机器学习模型的影响，现有方法在检测和防御此类攻击时效果不理想，导致模型性能下降。

核心思路：ODDR的核心思路是通过识别与对抗补丁相关的异常特征，利用统计方法进行防御，从而中和对抗扰动的影响。

技术框架：ODDR的整体架构包括三个主要阶段：分割阶段将图像样本划分为更小的片段；隔离阶段使用先进的异常检测技术识别与对抗扰动相关的异常特征；中和阶段则应用降维技术处理这些异常值，保留关键信息的同时消除对抗影响。

关键创新：ODDR的主要创新在于其模型无关性和适用性，能够在多种任务中提供保护，且在CNN和Transformer架构中均表现出色。

关键设计：在设计上，ODDR采用了高效的异常检测算法和降维技术，确保在处理对抗样本时能够有效识别和中和异常特征，同时保持模型的整体性能。

📊 实验亮点

ODDR在对抗攻击下的实验结果显示，模型准确性从39.26%提升至79.1%，在GoogleAp攻击下显著超越了LGS（53.86%）、Jujutsu（60%）和Jedi（64.34%）等领先防御方法，验证了其有效性。

🎯 应用场景

该研究的潜在应用领域包括图像分类、目标检测和深度估计等任务，能够为各种机器学习模型提供有效的对抗攻击防御方案。随着对抗攻击技术的不断演进，ODDR的应用将有助于提升模型在实际场景中的鲁棒性和可靠性，具有重要的实际价值和未来影响。

📄 摘要（原文）

Adversarial attacks present a significant challenge to the dependable deployment of machine learning models, with patch-based attacks being particularly potent. These attacks introduce adversarial perturbations in localized regions of an image, deceiving even well-trained models. In this paper, we propose Outlier Detection and Dimension Reduction (ODDR), a comprehensive defense strategy engineered to counteract patch-based adversarial attacks through advanced statistical methodologies. Our approach is based on the observation that input features corresponding to adversarial patches-whether naturalistic or synthetic-deviate from the intrinsic distribution of the remaining image data and can thus be identified as outliers. ODDR operates through a robust three-stage pipeline: Fragmentation, Segregation, and Neutralization. This model-agnostic framework is versatile, offering protection across various tasks, including image classification, object detection, and depth estimation, and is proved effective in both CNN-based and Transformer-based architectures. In the Fragmentation stage, image samples are divided into smaller segments, preparing them for the Segregation stage, where advanced outlier detection techniques isolate anomalous features linked to adversarial perturbations. The Neutralization stage then applies dimension reduction techniques to these outliers, effectively neutralizing the adversarial impact while preserving critical information for the machine learning task. Extensive evaluation on benchmark datasets against state-of-the-art adversarial patches underscores the efficacy of ODDR. Our method enhances model accuracy from 39.26% to 79.1% under the GoogleAp attack, outperforming leading defenses such as LGS (53.86%), Jujutsu (60%), and Jedi (64.34%).