Mitigating Evasion Attacks to Deep Neural Networks via Region-based Classification

TLDR

Deep neural networks have revolutionized AI but are vulnerable to evasion attacks that manipulate test inputs to cause misclassification. Adversarial examples are crafted by adding small, carefully designed perturbations to test inputs that cause a DNN to misclassify. These evasion attacks pose a major threat to deploying DNNs in safety‑critical domains such as autonomous driving.

Abstract

Deep neural networks (DNNs) have transformed several artificial intelligence research areas including computer vision, speech recognition, and natural language processing. However, recent studies demonstrated that DNNs are vulnerable to adversarial manipulations at testing time. Specifically, suppose we have a testing example, whose label can be correctly predicted by a DNN classifier. An attacker can add a small carefully crafted noise to the testing example such that the DNN classifier predicts an incorrect label, where the crafted testing example is called adversarial example. Such attacks are called evasion attacks. Evasion attacks are one of the biggest challenges for deploying DNNs in safety and security critical applications such as self-driving cars.