Unsupervised smoothing defense against adversarial images
One example method includes accessing an adversarial image, processing the adversarial image by applying a smoothing defense to the adversarial image, and classifying the processed adversarial image. The smoothing defense, which may be an unsupervised process, may include a noising process, such as a gaussian noising process, and an edge-preserving process. The smoothing defense can be implemented against basic iterative method (BIM) attacks, as well as fast gradient sign method (FGSM) attacks.
1 . A method, comprising:
accessing an adversarial image that was created with either an FGSM (fast gradient sign method) attack executed against an original image or a BIM (basic iterative method) attack executed against the original image;
processing the adversarial image by applying a smoothing defense to the adversarial image to create a processed adversarial image, wherein the smoothing defense comprises:
first, applying a noising process to the adversarial image to create a noised image, wherein the noising process includes adding noise to the adversarial image, and wherein a magnitude of the noise is different depending on whether the FGSM attack was executed against the original image or the BIM attack was executed against the original image, such that different magnitudes of noise are available for selection, where said selection is based on whichever type of attack was executed against the original image, and
second, applying a blurring process to the noised image; and
classifying the processed adversarial image.
2 . The method as recited in claim 1 , wherein the blurring process comprises bilateral filter blurring.
3 . The method as recited in claim 1 , wherein the noising process comprises adding gaussian noise to the adversarial image.
4 . The method as recited in claim 1 , wherein the blurring process comprises an edge-preserving process.
5 . The method as recited in claim 1 , wherein a classification of the adversarial image, prior to the processing, is different from a classification of an original image that was used to generate the adversarial image.
6 . The method as recited in claim 1 , wherein a classification of the adversarial image, after the processing, is the same as a classification of an original image that was used to generate the adversarial image.
7 . The method as recited in claim 1 , wherein the smoothing defense is an unsupervised process.
8 . A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
accessing an adversarial image that was created with either an FGSM (fast gradient sign method) attack executed against an original image or a BIM (basic iterative method) attack executed against the original image;
processing the adversarial image by applying a smoothing defense to the adversarial image to create a processed adversarial image, wherein the smoothing defense comprises:
first, applying a noising process to the adversarial image to create a noised image, wherein the noising process includes adding noise to the adversarial image, and wherein a magnitude of the noise is different depending on whether the FGSM attack was executed against the original image or the BIM attack was executed against the original image, such that different magnitudes of noise are available for selection, where said selection is based on whichever type of attack was executed against the original image, and
second, applying a blurring process to the noised image; and
classifying the processed adversarial image.
9 . The non-transitory storage medium as recited in claim 8 , wherein the blurring process comprises bilateral filter blurring.
10 . The non-transitory storage medium as recited in claim 8 , wherein the noising process comprises adding gaussian noise to the adversarial image.
11 . The non-transitory storage medium as recited in claim 8 , wherein the blurring process comprises an edge-preserving process.
12 . The non-transitory storage medium as recited in claim 8 , wherein a classification of the adversarial image, prior to the processing, is different from a classification of an original image that was used to generate the adversarial image.
13 . The non-transitory storage medium as recited in claim 8 , wherein a classification of the adversarial image, after the processing, is the same as a classification of an original image that was used to generate the adversarial image.
14 . The non-transitory storage medium as recited in claim 8 , wherein the smoothing defense is an unsupervised process.