Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression
Nilaksh Das Georgia Institute of Technology Madhuri Shanbhogue Georgia Institute of Technology Shang-Tse Chen Georgia Institute of Technology Fred Hohman Georgia Institute of Technology Li Chen Intel Corporation Michael E. Kounavis Intel Corporation Duen Horng Chau Georgia Institute of Technology
Abstract
Deep neural networks (DNNs) have achieved great success in solving a variety of machine learning (ML) problems, especially in the domain of image recognition. However, recent research showed that DNNs can be highly vulnerable to adversarially generated instances, which look seemingly normal to human observers, but completely confuse DNNs. These adversarial samples are crafted by adding small perturbations to normal, benign images. Such perturbations, while imperceptible to the human eye, are picked up by DNNs and cause them to misclassify the manipulated instances with high confidence. In this work, we explore and demonstrate how systematic JPEG compression can work as an effective pre-processing step in the classification pipeline to counter adversarial attacks and dramatically reduce their effects (e.g., Fast Gradient Sign Method, DeepFool). An important component of JPEG compression is its ability to remove high frequency signal components, inside square blocks of an image. Such an operation is equivalent to selective blurring of the image, helping remove additive perturbations. Further, we propose an ensemble-based technique that can be constructed quickly from a given well-per
中文速览
深度神经网络（DNN）在图像识别上表现出色，却对"对抗样本"（adversarial examples）极度脆弱——攻击者只需在图片上叠加人眼几乎察觉不到的微小扰动，就能让模型以极高置信度做出错误判断。针对这一问题，研究者提出将 JPEG 压缩作为分类前的预处理步骤：JPEG 压缩的核心机制是通过离散余弦变换（DCT）丢弃人眼不敏感的高频信息，而对抗扰动恰好大量存在于这些高频分量中，因此压缩过程能有效"洗掉"这些扰动。实验在 CIFAR-10 和 GTSRB 两个数据集上系统评估了不同压缩质量参数的影响，并进一步提出在训练阶段也加入不同压缩等级的图像、再将多个模型组合成集成模型（ensemble）的方案，结果显示该方案能在对抗 FGSM 和 DeepFool 两类攻击时大幅降低误分类率，同时不损害正常图片的识别准确率。这项工作的价值在于：JPEG 压缩无需了解攻击方式或模型内部结构，部署成本极低，可作为即插即用的通用防御模块与其他防御方法叠加使用。
原文 arXiv:1705.02900;中英对照 + 大白话阅读 https://aha.fim.ai/paper/1705.02900v1