Orthogonal Deep Models as Defense Against Black-Box Attacks
Deep learning has demonstrated state-of-the-art performance for a variety of challenging computer vision tasks. On one hand, this has enabled deep visual models to pave the way for a plethora of critical applications like disease prognostics and smart surveillance. On the other, deep learning has al...
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2020-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/9129688/ |
| _version_ | 1818935319337107456 |
|---|---|
| author | Mohammad A. A. K. Jalwana Naveed Akhtar Mohammed Bennamoun Ajmal Mian |
| author_facet | Mohammad A. A. K. Jalwana Naveed Akhtar Mohammed Bennamoun Ajmal Mian |
| author_sort | Mohammad A. A. K. Jalwana |
| collection | DOAJ |
| description | Deep learning has demonstrated state-of-the-art performance for a variety of challenging computer vision tasks. On one hand, this has enabled deep visual models to pave the way for a plethora of critical applications like disease prognostics and smart surveillance. On the other, deep learning has also been found vulnerable to adversarial attacks, which calls for new techniques to defend deep models against these attacks. Among the attack algorithms, the black-box schemes are of serious practical concern since they only need publicly available knowledge of the targeted model. We carefully analyze the inherent weakness of deep models in black-box settings where the attacker may develop the attack using a model similar to the targeted model. Based on our analysis, we introduce a novel gradient regularization scheme that encourages the internal representation of a deep model to be orthogonal to another, even if the architectures of the two models are similar. Our unique constraint allows a model to concomitantly endeavour for higher accuracy while maintaining near orthogonal alignment of gradients with respect to a reference model. Detailed empirical study verifies that controlled misalignment of gradients under our orthogonality objective significantly boosts a model's robustness against transferable black-box adversarial attacks. In comparison to regular models, the orthogonal models are significantly more robust to a range of l<sub>p</sub> norm bounded perturbations. We verify the effectiveness of our technique on a variety of large-scale models. |
| first_indexed | 2024-12-20T05:18:17Z |
| format | Article |
| id | doaj.art-b0f244cabf964c2fa450d0968273f471 |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-12-20T05:18:17Z |
| publishDate | 2020-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-b0f244cabf964c2fa450d0968273f4712022-12-21T19:52:06ZengIEEEIEEE Access2169-35362020-01-01811974411975710.1109/ACCESS.2020.30059619129688Orthogonal Deep Models as Defense Against Black-Box AttacksMohammad A. A. K. Jalwana0https://orcid.org/0000-0002-5184-1884Naveed Akhtar1https://orcid.org/0000-0003-3406-673XMohammed Bennamoun2Ajmal Mian3Department of Computer Science and Software Engineering, The University of Western Australia, Perth, WA, AustraliaDepartment of Computer Science and Software Engineering, The University of Western Australia, Perth, WA, AustraliaDepartment of Computer Science and Software Engineering, The University of Western Australia, Perth, WA, AustraliaDepartment of Computer Science and Software Engineering, The University of Western Australia, Perth, WA, AustraliaDeep learning has demonstrated state-of-the-art performance for a variety of challenging computer vision tasks. On one hand, this has enabled deep visual models to pave the way for a plethora of critical applications like disease prognostics and smart surveillance. On the other, deep learning has also been found vulnerable to adversarial attacks, which calls for new techniques to defend deep models against these attacks. Among the attack algorithms, the black-box schemes are of serious practical concern since they only need publicly available knowledge of the targeted model. We carefully analyze the inherent weakness of deep models in black-box settings where the attacker may develop the attack using a model similar to the targeted model. Based on our analysis, we introduce a novel gradient regularization scheme that encourages the internal representation of a deep model to be orthogonal to another, even if the architectures of the two models are similar. Our unique constraint allows a model to concomitantly endeavour for higher accuracy while maintaining near orthogonal alignment of gradients with respect to a reference model. Detailed empirical study verifies that controlled misalignment of gradients under our orthogonality objective significantly boosts a model's robustness against transferable black-box adversarial attacks. In comparison to regular models, the orthogonal models are significantly more robust to a range of l<sub>p</sub> norm bounded perturbations. We verify the effectiveness of our technique on a variety of large-scale models.https://ieeexplore.ieee.org/document/9129688/Deep learningadversarial examplesadversarial perturbationsorthogonal modelsrobust deep learning |
| spellingShingle | Mohammad A. A. K. Jalwana Naveed Akhtar Mohammed Bennamoun Ajmal Mian Orthogonal Deep Models as Defense Against Black-Box Attacks IEEE Access Deep learning adversarial examples adversarial perturbations orthogonal models robust deep learning |
| title | Orthogonal Deep Models as Defense Against Black-Box Attacks |
| title_full | Orthogonal Deep Models as Defense Against Black-Box Attacks |
| title_fullStr | Orthogonal Deep Models as Defense Against Black-Box Attacks |
| title_full_unstemmed | Orthogonal Deep Models as Defense Against Black-Box Attacks |
| title_short | Orthogonal Deep Models as Defense Against Black-Box Attacks |
| title_sort | orthogonal deep models as defense against black box attacks |
| topic | Deep learning adversarial examples adversarial perturbations orthogonal models robust deep learning |
| url | https://ieeexplore.ieee.org/document/9129688/ |
| work_keys_str_mv | AT mohammadaakjalwana orthogonaldeepmodelsasdefenseagainstblackboxattacks AT naveedakhtar orthogonaldeepmodelsasdefenseagainstblackboxattacks AT mohammedbennamoun orthogonaldeepmodelsasdefenseagainstblackboxattacks AT ajmalmian orthogonaldeepmodelsasdefenseagainstblackboxattacks |