Visible to the public SHIELD: Fast, Practical Defense and Vaccination for Deep Learning Using JPEG Compression

TitleSHIELD: Fast, Practical Defense and Vaccination for Deep Learning Using JPEG Compression
Publication TypeConference Paper
Year of Publication2018
AuthorsDas, Nilaksh, Shanbhogue, Madhuri, Chen, Shang-Tse, Hohman, Fred, Li, Siwei, Chen, Li, Kounavis, Michael E., Chau, Duen Horng
Conference NameProceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining
PublisherACM
Conference LocationNew York, NY, USA
ISBN Number978-1-4503-5552-0
KeywordsAdversarial Machine Learning, Artificial neural networks, Collaboration, cyber physical systems, Deep Learning, ensemble defense, JPEG compression, machine learning security, Metrics, policy-based governance, pubcrawl, Resiliency
Abstract

The rapidly growing body of research in adversarial machine learning has demonstrated that deep neural networks (DNNs) are highly vulnerable to adversarially generated images. This underscores the urgent need for practical defense techniques that can be readily deployed to combat attacks in real-time. Observing that many attack strategies aim to perturb image pixels in ways that are visually imperceptible, we place JPEG compression at the core of our proposed SHIELD defense framework, utilizing its capability to effectively "compress away" such pixel manipulation. To immunize a DNN model from artifacts introduced by compression, SHIELD "vaccinates" the model by retraining it with compressed images, where different compression levels are applied to generate multiple vaccinated models that are ultimately used together in an ensemble defense. On top of that, SHIELD adds an additional layer of protection by employing randomization at test time that compresses different regions of an image using random compression levels, making it harder for an adversary to estimate the transformation performed. This novel combination of vaccination, ensembling, and randomization makes SHIELD a fortified multi-pronged defense. We conducted extensive, large-scale experiments using the ImageNet dataset, and show that our approaches eliminate up to 98% of gray-box attacks delivered by strong adversarial techniques such as Carlini-Wagner's L2 attack and DeepFool. Our approaches are fast and work without requiring knowledge about the model.

URLhttps://dl.acm.org/doi/10.1145/3219819.3219910
DOI10.1145/3219819.3219910
Citation Keydas_shield:_2018