Defense Against Adversarial Attacks using Convolutional Auto-Encoders

Deep learning has made notable progress across a diverse range of machine learning domains, including image classification, object detection and speech recognition. The influence of deep learning extends to an increasing number of real-world applications and systems. However, recent research highlights the susceptibility of deep learning models to well-designed input samples, called adversarial examples. Adversarial examples are imperceptible to humans but can easily fool deep neural networks [1]. Szedegy et al. [2] manipulated state-of-the-art deep neural networks to misclassify images by applying subtle and barely perceptible perturbations, as seen in Figure 1, showcasing the vulnerability of these models to targeted errors. Researchers discovered that a single perturbation could lead a neural network to misclassify multiple classes, revealing inherent weaknesses in the training algorithms. Despite neural networks being nonlinear functions [3], it was surprising to find that linear approximations are effective in creating adversarial perturbations. This unexpected result is attributed to the design of easily trainable models, which empirically exhibit an accurate local linear approximation for their loss function [4], allowing adversaries to make subtle changes in the pixel values that lead to misclassification. Figure 1: Szegedy et al. [2] were able to fool AlexNet [5] by classifying a perturbed image of a dog into an ostrich There has been a good amount of progress in research pertaining to defending against these adversarial attacks. The defenses aim to either detect whether an input is adversarial, or aim to modify the input so that it is no longer adversarial in nature.