Citation: | Cheng-Cheng Ma, Bao-Yuan Wu, Yan-Bo Fan, Yong Zhang, Zhi-Feng Li. Effective and Robust Detection of Adversarial Examples via Benford-Fourier Coefficients. Machine Intelligence Research, vol. 20, no. 5, pp.666-682, 2023. https://doi.org/10.1007/s11633-022-1328-1 |
[1] |
K. Simonyan, A. Zisserman. Very deep convolutional networks for large-scale image recognition. In Proceedings of the 3rd International Conference on Learning Representations, San Diego, USA, 2015.
|
[2] |
A. Krizhevsky, I. Sutskever, G. E. Hinton. ImageNet classification with deep convolutional neural networks. In Proceedings of the 25th International Conference on Neural Information Processing Systems, Lake Tahoe, USA, pp. 1097–1105, 2012.
|
[3] |
G. Huang, Z. Liu, L. van der Maaten, K. Q. Weinberger. Densely connected convolutional networks. In Proceedings of IEEE Conference on Computer Vision and Pattern Recognition, IEEE, Honolulu, USA, pp. 2261–2269, 2017. DOI: 10.1109/CVPR.2017.243.
|
[4] |
K. M. He, X. Y. Zhang, S. Q. Ren, J. Sun. Deep residual learning for image recognition. In Proceedings of IEEE Conference on Computer Vision and Pattern Recognition, IEEE, Las Vegas, USA, pp. 770–778, 2016. DOI: 10.1109/CVPR.2016.90.
|
[5] |
X. O. Tang, Z. F. Li. Video based face recognition using multiple classifiers. In Proceedings of the 6th IEEE International Conference on Automatic Face and Gesture Recognition, IEEE, Seoul, Republic of Korea, pp. 345–349, 2004. DOI: 10.1109/AFGR.2004.1301555.
|
[6] |
D. H. Gong, Z. F. Li, J. Z. Liu, Y. Qiao. Multi-feature canonical correlation analysis for face photo-sketch image retrieval. In Proceedings of the 21st ACM International Conference on Multimedia, ACM, Barcelona, Spain, pp. 617–620, 2013. DOI: 10.1145/2502081.2502162.
|
[7] |
Z. F. Li, D. H. Gong, Y. Qiao, D. C. Tao. Common feature discriminant analysis for matching infrared face images to optical face images. IEEE Transactions on Image Processing, vol. 23, no. 6, pp. 2436–2445, 2014. DOI: 10.1109/TIP.2014.2315920.
|
[8] |
Z. Y. Deng, X. J. Peng, Z. F. Li, Y. Qiao. Mutual component convolutional neural networks for heterogeneous face recognition. IEEE Transactions on Image Processing, vol. 28, no. 6, pp. 3102–3114, 2019. DOI: 10.1109/TIP.2019.2894272.
|
[9] |
H. B. Qiu, D. H. Gong, Z. F. Li, W. Liu, D. C. Tao. End2end occluded face recognition by masking corrupted features. IEEE Transactions on Pattern Analysis and Machine Intelligence, to be published. DOI: 10.1109/TPAMI.2021.3098962.
|
[10] |
X. L. Yang, X. H. Jia, D. H. Gong, D. M. Yan, Z. F. Li, W. Liu. LARNet: Lie algebra residual network for face recognition. In Proceedings of the 38th International Conference on Machine Learning, pp. 11738–11750, 2021.
|
[11] |
S. Q. Ren, K. M. He, R. Girshick, J. Sun. Faster R-CNN: Towards real-time object detection with region proposal networks. In Proceedings of the 28th International Conference on Neural Information Processing Systems, Montreal, Canada, pp. 91–99, 2015.
|
[12] |
W. Liu, D. Anguelov, D. Erhan, C. Szegedy, S. Reed, C. Y. Fu, A. C. Berg. SSD: Single shot MultiBox detector. In Proceedings of the 14th European Conference on Computer Vision, Springer, Amsterdam, The Netherlands, pp. 21–37, 2016. DOI: 10.1007/978-3-319-46448-0_2.
|
[13] |
R. Feinman, R. R. Curtin, S. Shintre, A. B. Gardner. Detecting adversarial samples from artifacts, [Online], Available: https://arxiv.org/abs/1703.00410, 2017.
|
[14] |
X. J. Ma, B. Li, Y. S. Wang, S. M. Erfani, S. N. R. Wijewickrema, G. Schoenebeck, D. Song, M. E. Houle, J. Bailey. Characterizing adversarial subspaces using local intrinsic dimensionality. In Proceedings of the 6th International Conference on Learning Representations, Vancouver, Canada, 2018.
|
[15] |
M. K. Varanasi, B. Aazhang. Parametric generalized Gaussian density estimation. The Journal of the Acoustical Society of America, vol. 86, no. 4, pp. 1404–1415, 1989. DOI: 10.1121/1.398700.
|
[16] |
C. Pasquini, F. Pérez-González, G. Boato. A Benford-Fourier JPEG compression detector. In Proceedings of IEEE International Conference on Image Processing, IEEE, Paris, France, pp. 5322–5326, 2014. DOI: 10.1109/ICIP.2014.7026077.
|
[17] |
V. N. Vapnik. The Nature of Statistical Learning Theory, New York, USA: Springer, 1999.
|
[18] |
F. J. Massey Jr. The Kolmogorov-Smirnov test for goodness of fit. Journal of the American statistical Association, vol. 46, no. 253, pp. 68–78, 1951. DOI: 10.1080/01621459.1951.10500769.
|
[19] |
X. Li, F. Li. Adversarial examples detection in deep networks with convolutional filter statistics. In Proceedings of the IEEE International Conference on Computer Vision, pp. 5764–5772, 2017.
|
[20] |
K. Pearson. LIII. On lines and planes of closest fit to systems of points in space. The London,Edinburgh,and Dublin Philosophical Magazine and Journal of Science, vol. 2, no. 11, pp. 559–572, 1901. DOI: 10.1080/14786440109462720.
|
[21] |
J. J. Lu, T. Issaranon, D. Forsyth. SafetyNet: Detecting and rejecting adversarial examples robustly. In Proceedings of IEEE International Conference on Computer Vision, IEEE, Venice, Italy, pp. 446–454, 2017. DOI: 10.1109/ICCV.2017.56.
|
[22] |
J. H. Metzen, T. Genewein, V. Fischer, B. Bischoff. On detecting adversarial perturbations. In Proceedings of the 5th International Conference on Learning Representations, Toulon, France, 2017.
|
[23] |
I. J. Goodfellow, J. Shlens, C. Szegedy. Explaining and harnessing adversarial examples. In Proceedings of the 3rd International Conference on Learning Representations, San Diego, USA, 2014.
|
[24] |
N. Papernot, P. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, A. Swami. The Limitations of Deep Learning in Adversarial Settings. In Proceedings of IEEE European Symposium on Security and Privacy, IEEE, Saarbruecken, Germany, pp. 372–387, 2016. DOI: 10.1109/EuroSP.2016.36.
|
[25] |
N. Carlini, D. Wagner. Towards evaluating the robustness of neural networks. In Proceedings of IEEE Symposium on Security and Privacy (SP), IEEE, San Jose, USA, pp. 39–57, 2017. DOI: 10.1109/SP.2017.49.
|
[26] |
K. Grosse, P. Manoharan, N. Papernot, M. Backes, P. McDaniel. On the (statistical) detection of adversarial examples. [Online], Available: https://arxiv.org/abs/1702.06280, 2017.
|
[27] |
R. Z. Gao, F. Liu, J. F. Zhang, B. Han, T. L. Liu, G. Niu, M. Sugiyama. Maximum mean discrepancy test is aware of adversarial attacks. In Proceedings of the 38th International Conference on Machine Learning, pp. 3564–3575, 2021.
|
[28] |
N. Carlini, D. Wagner. Adversarial examples are not easily detected: Bypassing ten detection methods. In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, ACM, Texas, USA, pp. 3–14, 2017. DOI: 10.1145/3128572.3140444.
|
[29] |
Z. H. Zheng, P. Y. Hong. Robust detection of adversarial attacks by modeling the intrinsic properties of deep neural networks. In Proceedings of the 32nd International Conference on Neural Information Processing Systems, Montreal, Canada, pp. 7924–7933, 2018.
|
[30] |
K. Lee, K. Lee, H. Lee, J. Shin. A simple unified framework for detecting out-of-distribution samples and adversarial attacks. In Proceedings of the 32nd International Conference on Neural Information Processing Systems, Montreal, Canada, pp. 7167–7177, 2018.
|
[31] |
K. Roth, Y. Kilcher, T. Hofmann. The odds are odd: A statistical test for detecting adversarial examples. In Proceedings of the 36th International Conference on Machine Learning, Long Beach, USA, pp. 5498–5507, 2019.
|
[32] |
J. Raghuram, V. Chandrasekaran, S. Jha, S. Banerjee. A general framework for detecting anomalous inputs to DNN classifiers. In Proceedings of the 38th International Conference on Machine Learning, pp. 8764–8775, 2021.
|
[33] |
D. Hendrycks, K. Gimpel. Early methods for detecting adversarial images. In Proceedings of the 5th International Conference on Learning Representations, Toulon, France, 2017.
|
[34] |
T. Y. Pang, C. Du, Y. P. Dong, J. Zhu. Towards robust detection of adversarial examples. In Proceedings of the 32nd International Conference on Neural Information Processing Systems, Montreal, Canada, pp. 4584–4594, 2018.
|
[35] |
P. Samangouei, M. Kabkab, R. Chellappa. Defense-GAN: Protecting classifiers against adversarial attacks using generative models. In Proceedings of the 6th International Conference on Learning Representations, Vancouver, Canada, 2018.
|
[36] |
S. Y. Hu, T. Yu, C. Guo, W. L. Chao, K. Q. Weinberger. A new defense against adversarial images: Turning a weakness into a strength. In Proceedings of Advances in Neural Information Processing Systems, Vancouver, Canada, pp. 1633–1644, 2019.
|
[37] |
F. Pérez-González, G. L. Heileman, C. T. Abdallah. Benford′s Lawin image processing. In Proceedings of 2007 IEEE International Conference on Image Processing, IEEE, San Antonio, USA, pp. I-405–I-408, 2007. DOI: 10.1109/ICIP.2007.4378977.
|
[38] |
I. S. Gradshteyn, I. M. Ryzhik. Table of Integrals, Series, and Products, Cambridge, UK: Academic Press, 2014.
|
[39] |
A. Papoulis. Probability, Random Variables, and Stochastic Processes, New York, USA: McGraw-Hill, 1965.
|
[40] |
A. Kurakin, I. J. Goodfellow, S. Bengio. Adversarial examples in the physical world. Artificial Intelligence Safety and Security, R. V. Yampolskiy. Ed., New York, USA: Chapman and Hall/CRC, pp. 99–112, 2018.
|
[41] |
A. Krizhevsky, V. Nair, G. Hinton. Cifar-10 (Canadian institute for advanced research), [Online], Available: https://academictorrents.com/details/463ba7ec7f37ed414c12fbb71ebf6431eada2d7a.
|
[42] |
Y. Netzer, T. Wang, A. Coates, A. Bissacco, B. Wu, A. Y. Ng. Reading digits in natural images with unsupervised feature learning. In Proceedings of NIPS Workshop on Deep Learning and Unsupervised Feature Learning, Granada, Canada, 2011.
|
[43] |
J. Deng, W. Dong, R. Socher, L. J. Li, K. Li, L. Fei-Fei. ImageNet: A large-scale hierarchical image database. In Proceedings of IEEE Conference on Computer Vision and Pattern Recognition, IEEE, Miami, USA, pp. 248–255, 2009. DOI: 10.1109/CVPR.2009.5206848.
|
[44] |
S. M. Moosavi-Dezfooli, A. Fawzi, P. Frossard. DeepFool: A simple and accurate method to fool deep neural networks. In Proceedings of IEEE Conference on Computer Vision and Pattern Recognition, IEEE, Las Vegas, USA, pp. 2574–2582, 2016. DOI: 10.1109/CVPR.2016.282.
|
[45] |
A. Madry, A. Makelov, L. Schmidt, D. Tsipras, A. Vladu. Towards deep learning models resistant to adversarial attacks. In Proceedings of the 6th International Conference on Learning Representations, Vancouver, Canada, 2018.
|
[46] |
A. Creswell, T. White, V. Dumoulin, K. Arulkumaran, B. Sengupta, A. A. Bharath. Generative adversarial networks: An overview. IEEE Signal Processing Magazine, vol. 35, no. 1, pp. 53–65, 2018. DOI: 10.1109/MSP.2017.2765202.
|
[47] |
L. Deng. The MNIST database of handwritten digit images for machine learning research. IEEE Signal Processing Magazine, vol. 29, no. 6, pp. 141–142, 2012. DOI: 10.1109/MSP.2012.2211477.
|
[48] |
N. E. Lasmar, Y. Stitou, Y. Berthoumieu. Multiscale skewed heavy tailed model for texture analysis. In Proceedings of the 16th IEEE International Conference on Image Processing, IEEE, Cairo, Egypt, pp. 2281–2284, 2009. DOI: 10.1109/ICIP.2009.5414404.
|
[49] |
M. Rosenblatt. A central limit theorem and a strong mixing condition. Proceedings of the National Academy of Sciences of the United States of America, vol. 42, no. 1, pp. 43–47, 1956. DOI: 10.1073/pnas.42.1.43.
|
[50] |
N. R. Goodman. Statistical analysis based on a certain multivariate complex Gaussian distribution (An introduction). The Annals of Mathematical Statistics, vol. 34, no. 1, pp. 152–177, 1963. DOI: 10.1214/aoms/1177704250.
|