A Halfspace-Mass Depth-Based Method for Adversarial Attack Detection
Résumé
Despite the widespread use of deep learning algorithms, vulnerability to adversarial attacks
is still an issue limiting their use in critical applications. Detecting these attacks is thus
crucial to build reliable algorithms and has received increasing attention in the last few
years. In this paper, we introduce the HalfspAce Mass dePth dEtectoR (HAMPER), a new
method to detect adversarial examples by leveraging the concept of data depths, a statistical
notion that provides center-outward ordering of points with respect to (w.r.t.) a probability
distribution. In particular, the halfspace-mass (HM) depth exhibits attractive properties
which makes it a natural candidate for adversarial attack detection in high-dimensional
spaces. Additionally, HM is non differentiable making it harder for attackers to directly
attack HAMPER via gradient based-methods. We evaluate HAMPER in the context of supervised
adversarial attacks detection across four benchmark datasets. Overall, we empirically show
that HAMPER consistently outperforms SOTA methods. In particular, the gains are 13.1%
(29.0%) in terms of AUROC↑ (resp. FPR ↓95%) on SVHN, 14.6% (25.7%) on CIFAR10 and
22.6% (49.0%) on CIFAR100 compared to the best performing method.
Domaines
Informatique et langage [cs.CL]Origine | Fichiers produits par l'(les) auteur(s) |
---|