Distillation as a Defense to Adversarial Perturbations against Deep Neural Networks
Nicolas Papernot1, Patrick McDaniel1, Xi Wu4, Somesh Jha4, and Ananthram Swami3 1Department of Computer Science and Engineering, Penn State University 4Computer Sciences Department, University of Wisconsin-Madison 3United States Army Research Laboratory, Adelphi, Maryland
Abstract
Deep learning algorithms have been shown to perform extremely well on many classical machine learning problems. However, recent studies have shown that deep learning, like other machine learning techniques, is vulnerable to adversarial samples: inputs crafted to force a deep neural network (DNN) to provide adversary-selected outputs. Such attacks can seriously undermine the security of the system supported by the DNN, sometimes with devastating consequences. For example, autonomous vehicles can be crashed, illicit or illegal content can bypass content filters, or biometric authentication systems can be manipulated to allow improper access. In this work, we introduce a defensive mechanism called defensive distillation to reduce the effectiveness of adversarial samples on DNNs. We analytically investigate the generalizability and robustness properties granted by the use of defensive distillation when training DNNs. We also empirically study the effectiveness of our defense mechanisms on two DNNs placed in adversarial settings. The study shows that defensive distillation can reduce effectiveness of sample creation from 95% to less than 0.5% on a studied DNN. Such dramatic gains can be
中文速览
深度神经网络（DNN）虽然在图像识别等任务上表现出色，却极易被"对抗样本"（adversarial samples）欺骗——攻击者只需对输入图片加上人眼几乎察觉不到的微小扰动，就能让模型给出完全错误的判断，这对自动驾驶、内容过滤、生物识别等安全敏感场景威胁极大。为此，作者提出了一种名为"防御性蒸馏"（defensive distillation）的训练方法：先用原始数据训练一个DNN，再用它输出的类别概率向量（而非硬标签）来重新训练同一架构的网络，使模型学到更平滑、对输入扰动更不敏感的决策面。实验表明，这一方法将攻击者在MNIST数据集上的对抗样本成功率从95.89%压低到0.45%，同时将攻击所依赖的梯度幅度降低了10³⁰倍，且需要篡改的输入特征数量平均增加约800%。这项工作为在真实安全场景中部署更可靠的深度学习系统提供了一条无需修改网络架构、成本低且效果显著的防护思路。
原文 arXiv:1511.04508;中英对照 + 大白话阅读 https://aha.fim.ai/paper/1511.04508v2