[Paper Review] Exploiting the Inherent Limitation of L0 Adversarial Examples

Fei Zuo, Bokai Yang+3 more|arXiv (Cornell University)|Dec 23, 2018

Adversarial Robustness in Machine Learning44 references4 citations

TL;DR

This paper proposes AEPecker, a novel defense system that detects and rectifies $L_0$ adversarial examples by exploiting their inherent limitation: minimal pixel corruption with high-amplitude perturbations. The method uses a Siamese network to compare an input image with an inpainted version, enabling high-accuracy detection and effective correction of misclassified inputs.

ABSTRACT

Despite the great achievements made by neural networks on tasks such as image classification, they are brittle and vulnerable to adversarial example (AE) attacks, which are crafted by adding human-imperceptible perturbations to inputs in order that a neural-network-based classifier incorrectly labels them. In particular, L0 AEs are a category of widely discussed threats where adversaries are restricted in the number of pixels that they can corrupt. However, our observation is that, while L0 attacks modify as few pixels as possible, they tend to cause large-amplitude perturbations to the modified pixels. We consider this as an inherent limitation of L0 AEs, and thwart such attacks by both detecting and rectifying them. The main novelty of the proposed detector is that we convert the AE detection problem into a comparison problem by exploiting the inherent limitation of L0 attacks. More concretely, given an image I, it is pre-processed to obtain another image I' . A Siamese network, which is known to be effective in comparison, takes I and I' as the input pair to determine whether I is an AE. A trained Siamese network automatically and precisely captures the discrepancies between I and I' to detect L0 perturbations. In addition, we show that the pre-processing technique, inpainting, used for detection can also work as an effective defense, which has a high probability of removing the adversarial influence of L0 perturbations. Thus, our system, called AEPECKER, demonstrates not only high AE detection accuracies, but also a notable capability to correct the classification results.

Motivation & Objective

• Address the challenge of detecting and defending against $L_0$ adversarial examples, which are difficult to mitigate due to large-amplitude, sparse perturbations.
• Overcome the limitations of prior defenses that fail against $L_0$ attacks, especially those relying on feature squeezing or compression.
• Leverage the inherent structural characteristics of $L_0$ AEs—sparse, high-amplitude pixel modifications—to design a robust detection and correction mechanism.
• Develop a defense system that not only detects $L_0$ AEs with high accuracy but also rectifies them to restore correct classification.
• Demonstrate resilience of the proposed method against adaptive attacks that bypass existing defenses.

Proposed method

• Pre-process the input image $I$ using an inpainting-based technique to generate a modified image $I'$, which removes high-amplitude, isolated perturbations characteristic of $L_0$ AEs.
• Feed the pair $(I, I')$ into a Siamese neural network to compare the two images and determine whether $I$ is an adversarial example.
• Utilize the Siamese network’s ability to learn fine-grained differences between images, enabling precise detection of $L_0$ perturbations.
• Use the same inpainting pre-processing step as a defense mechanism to remove adversarial effects and restore correct model predictions.
• Train the Siamese network end-to-end on real benign images and $L_0$ adversarial examples to learn discriminative features for detection.
• Validate the system using standard benchmarks and adversarial attacks such as Carlini-Wagner $L_0$ (CW-$L_0$), demonstrating robustness against adaptive attacks.

Experimental results

Research questions

• RQ1 Can the inherent structural limitation of $L_0$ adversarial examples—sparse, high-amplitude pixel corruption—be exploited to build a more effective detection mechanism?
• RQ2 Can a Siamese network architecture effectively detect $L_0$ adversarial examples by comparing the original image with an inpainted version?
• RQ3 Can the inpainting pre-processing step not only detect but also correct $L_0$ adversarial examples to restore correct classification?
• RQ4 How does the proposed method perform against adaptive attacks that bypass traditional defenses like feature squeezing or compression?
• RQ5 Is the detection and correction capability of the system generalizable across different neural network architectures and datasets?

Key findings

• The Siamese network-based detector achieves high detection accuracy for $L_0$ adversarial examples by leveraging the structural differences between original and inpainted images.
• The inpainting-based pre-processing step effectively removes large-amplitude, sparse perturbations, significantly improving classification accuracy on $L_0$ adversarial examples.
• AEPecker demonstrates resilience against adaptive attacks, including those that bypass feature squeezing and compression-based defenses.
• The method outperforms existing defenses such as JPEG compression, PCA, and feature squeezing in handling $L_0$ attacks, especially in correcting misclassified predictions.
• The system maintains high performance across different base classifiers, including ResNet and CNN, indicating generalization potential.
• The study confirms that $L_0$ attacks are inherently limited by their inability to control perturbation amplitude, which can be exploited for detection and correction.