An Introduction to Adversarial Attacks and Defense Strategies

In our previous article, we showed that neural networks are vulnerable to carefully crafted adversarial attacks, i.e. attacks based on minor modifications of the input. While those perturbations are often invisible to a human observer or perceived as noise that does not influence the recognition, they can fool even the most successful state-of-the-art neural network based systems. Thus, it is of great importance to be able to defend against such attacks, especially in safety-critical environments. Multiple techniques have been proposed over the last years to achieve this, including but not limited to: adversarial training, image preprocessing or transformation, and feature denoising. The most popular defense strategy is adversarial training. In this method, images are adversarially attacked with a chosen approach and perturbed examples are introduced to the model during the training process so that it learns to classify them correctly [1,2].