Effects of Image Processing Operations on Adversarial Noise and Their Use in Detecting and Correcting Adversarial Images

Huy H. NGUYEN; Minoru KURIBAYASHI; Junichi YAMAGISHI; Isao ECHIZEN

doi:10.1587/transinf.2021MUP0005

Open Access
Effects of Image Processing Operations on Adversarial Noise and Their Use in Detecting and Correcting Adversarial Images

Huy H. NGUYEN, Minoru KURIBAYASHI, Junichi YAMAGISHI, Isao ECHIZEN

Full Text Views

120

Share
Cite this

Free PDF (1.2MB)

Summary :

Deep neural networks (DNNs) have achieved excellent performance on several tasks and have been widely applied in both academia and industry. However, DNNs are vulnerable to adversarial machine learning attacks in which noise is added to the input to change the networks' output. Consequently, DNN-based mission-critical applications such as those used in self-driving vehicles have reduced reliability and could cause severe accidents and damage. Moreover, adversarial examples could be used to poison DNN training data, resulting in corruptions of trained models. Besides the need for detecting adversarial examples, correcting them is important for restoring data and system functionality to normal. We have developed methods for detecting and correcting adversarial images that use multiple image processing operations with multiple parameter values. For detection, we devised a statistical-based method that outperforms the feature squeezing method. For correction, we devised a method that uses for the first time two levels of correction. The first level is label correction, with the focus on restoring the adversarial images' original predicted labels (for use in the current task). The second level is image correction, with the focus on both the correctness and quality of the corrected images (for use in the current and other tasks). Our experiments demonstrated that the correction method could correct nearly 90% of the adversarial images created by classical adversarial attacks and affected only about 2% of the normal images.

Publication: IEICE TRANSACTIONS on Information Vol.E105-D No.1 pp.65-77

Publication Date: 2022/01/01

Publicized: 2021/10/05

Online ISSN: 1745-1361

DOI: 10.1587/transinf.2021MUP0005

Type of Manuscript: Special Section PAPER (Special Section on Enriched Multimedia — Multimedia Technologies Enhancing User Experience —)

Category

Authors

Huy H. NGUYEN
  The Graduate University for Advanced Studies
Minoru KURIBAYASHI
  Okayama University
Junichi YAMAGISHI
  The Graduate University for Advanced Studies,National Institute of Informatics
Isao ECHIZEN
  The Graduate University for Advanced Studies,National Institute of Informatics,University of Tokyo

Keyword

adversarial machine learning, image processing operation, detecting adversarial image, correcting adversarial image, data cleansing, deep neural network

Cite this

Copy

Huy H. NGUYEN, Minoru KURIBAYASHI, Junichi YAMAGISHI, Isao ECHIZEN, "Effects of Image Processing Operations on Adversarial Noise and Their Use in Detecting and Correcting Adversarial Images" in IEICE TRANSACTIONS on Information, vol. E105-D, no. 1, pp. 65-77, January 2022, doi: 10.1587/transinf.2021MUP0005.
Abstract: Deep neural networks (DNNs) have achieved excellent performance on several tasks and have been widely applied in both academia and industry. However, DNNs are vulnerable to adversarial machine learning attacks in which noise is added to the input to change the networks' output. Consequently, DNN-based mission-critical applications such as those used in self-driving vehicles have reduced reliability and could cause severe accidents and damage. Moreover, adversarial examples could be used to poison DNN training data, resulting in corruptions of trained models. Besides the need for detecting adversarial examples, correcting them is important for restoring data and system functionality to normal. We have developed methods for detecting and correcting adversarial images that use multiple image processing operations with multiple parameter values. For detection, we devised a statistical-based method that outperforms the feature squeezing method. For correction, we devised a method that uses for the first time two levels of correction. The first level is label correction, with the focus on restoring the adversarial images' original predicted labels (for use in the current task). The second level is image correction, with the focus on both the correctness and quality of the corrected images (for use in the current and other tasks). Our experiments demonstrated that the correction method could correct nearly 90% of the adversarial images created by classical adversarial attacks and affected only about 2% of the normal images.
URL: https://globals.ieice.org/en_transactions/information/10.1587/transinf.2021MUP0005/_p

Copy

@ARTICLE{e105-d_1_65,
author={Huy H. NGUYEN, Minoru KURIBAYASHI, Junichi YAMAGISHI, Isao ECHIZEN, },
journal={IEICE TRANSACTIONS on Information},
title={Effects of Image Processing Operations on Adversarial Noise and Their Use in Detecting and Correcting Adversarial Images},
year={2022},
volume={E105-D},
number={1},
pages={65-77},
abstract={Deep neural networks (DNNs) have achieved excellent performance on several tasks and have been widely applied in both academia and industry. However, DNNs are vulnerable to adversarial machine learning attacks in which noise is added to the input to change the networks' output. Consequently, DNN-based mission-critical applications such as those used in self-driving vehicles have reduced reliability and could cause severe accidents and damage. Moreover, adversarial examples could be used to poison DNN training data, resulting in corruptions of trained models. Besides the need for detecting adversarial examples, correcting them is important for restoring data and system functionality to normal. We have developed methods for detecting and correcting adversarial images that use multiple image processing operations with multiple parameter values. For detection, we devised a statistical-based method that outperforms the feature squeezing method. For correction, we devised a method that uses for the first time two levels of correction. The first level is label correction, with the focus on restoring the adversarial images' original predicted labels (for use in the current task). The second level is image correction, with the focus on both the correctness and quality of the corrected images (for use in the current and other tasks). Our experiments demonstrated that the correction method could correct nearly 90% of the adversarial images created by classical adversarial attacks and affected only about 2% of the normal images.},
keywords={},
doi={10.1587/transinf.2021MUP0005},
ISSN={1745-1361},
month={January},}

Copy

TY - JOUR
TI - Effects of Image Processing Operations on Adversarial Noise and Their Use in Detecting and Correcting Adversarial Images
T2 - IEICE TRANSACTIONS on Information
SP - 65
EP - 77
AU - Huy H. NGUYEN
AU - Minoru KURIBAYASHI
AU - Junichi YAMAGISHI
AU - Isao ECHIZEN
PY - 2022
DO - 10.1587/transinf.2021MUP0005
JO - IEICE TRANSACTIONS on Information
SN - 1745-1361
VL - E105-D
IS - 1
JA - IEICE TRANSACTIONS on Information
Y1 - January 2022
AB - Deep neural networks (DNNs) have achieved excellent performance on several tasks and have been widely applied in both academia and industry. However, DNNs are vulnerable to adversarial machine learning attacks in which noise is added to the input to change the networks' output. Consequently, DNN-based mission-critical applications such as those used in self-driving vehicles have reduced reliability and could cause severe accidents and damage. Moreover, adversarial examples could be used to poison DNN training data, resulting in corruptions of trained models. Besides the need for detecting adversarial examples, correcting them is important for restoring data and system functionality to normal. We have developed methods for detecting and correcting adversarial images that use multiple image processing operations with multiple parameter values. For detection, we devised a statistical-based method that outperforms the feature squeezing method. For correction, we devised a method that uses for the first time two levels of correction. The first level is label correction, with the focus on restoring the adversarial images' original predicted labels (for use in the current task). The second level is image correction, with the focus on both the correctness and quality of the corrected images (for use in the current and other tasks). Our experiments demonstrated that the correction method could correct nearly 90% of the adversarial images created by classical adversarial attacks and affected only about 2% of the normal images.
ER -