Scholarlink

<p>Deep Neural Networks (DNNs) exhibit a notable vulnerability to adversarially crafted examples, which introduce minute perturbations that are imperceptible to human eyes but can lead to misclassifications. Recent research has focused on modifying the structural parameters of pre-trained DNNs or training new models to combat adversarial threats. However, the practicality of these approaches is limited in scenarios where there are not sufficient adversarial examples provided for model retraining, or when the architecture of the DNN model is unknown, rendering such parameter modifications infeasible. To address this problem, this paper proposes a novel hybrid algorithm, called RAP-EBD, to effectively defend against a variety of adversarial attacks without altering the DNN model’s structure. The RAP-EBD algorithm employs two key techniques coordinate-disruption and de-noising. Specifically, it utilizes the coordinate-disruption technique to destroy the correlation between adversarial perturbations and image coordinates by Replacing Adjacent Pixel (RAP), and the EEMD-Based De-noising (EBD) technique to eliminate high-frequency noise in images that is closely associated with adversarial perturbations. Furthermore, the integration of Coordinate-Disruption and De-noising techniques allows the algorithm to leverage their combined strengths to defend against diverse adversarial attacks. Extensive experiments are conducted on various DNN models, including both known and unknown DNN structures. Experimental results demonstrate that the proposed RAP-EBD algorithm outperforms three state-of-the-art defense algorithms in terms of accuracy, generalization, and robustness.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Defending deep learning models: a hybrid algorithm employing de-noising and coordinate-disruption techniques against adversarial attacks

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2025年9月11日

查看全文
  • Lihua He,
  • Shiwei Wei,
  • Huiyi Zhou,
  • Qinghui Hu

摘要

Deep Neural Networks (DNNs) exhibit a notable vulnerability to adversarially crafted examples, which introduce minute perturbations that are imperceptible to human eyes but can lead to misclassifications. Recent research has focused on modifying the structural parameters of pre-trained DNNs or training new models to combat adversarial threats. However, the practicality of these approaches is limited in scenarios where there are not sufficient adversarial examples provided for model retraining, or when the architecture of the DNN model is unknown, rendering such parameter modifications infeasible. To address this problem, this paper proposes a novel hybrid algorithm, called RAP-EBD, to effectively defend against a variety of adversarial attacks without altering the DNN model’s structure. The RAP-EBD algorithm employs two key techniques coordinate-disruption and de-noising. Specifically, it utilizes the coordinate-disruption technique to destroy the correlation between adversarial perturbations and image coordinates by Replacing Adjacent Pixel (RAP), and the EEMD-Based De-noising (EBD) technique to eliminate high-frequency noise in images that is closely associated with adversarial perturbations. Furthermore, the integration of Coordinate-Disruption and De-noising techniques allows the algorithm to leverage their combined strengths to defend against diverse adversarial attacks. Extensive experiments are conducted on various DNN models, including both known and unknown DNN structures. Experimental results demonstrate that the proposed RAP-EBD algorithm outperforms three state-of-the-art defense algorithms in terms of accuracy, generalization, and robustness.