Adaptive Channel Transformation-Based Detector for Adversarial Attacks

As deep neural networks (DNNs) are extensively used in computer vision tasks, the vulnerability of such systems to well-designed adversarial examples has received increasing attention. While various adversarial defense methods have been proposed to improve the robustness of DNNs, the detection of adversarial examples remains challenging. It has been shown in previous studies that adversarial examples are sensitive to channel transformation operations such as rotation and resizing, while clean examples are immune to these operations. Testing efficiency largely depends on the number and type of transformation operations. Hence, we propose a lightweight detector based on adaptive channel transformations, that selects the near-optimal type of channel transformations and the least number of channel transformations by cuckoo search. Not only can our method detect adversarial instances and clean instances but also can recognize the types of attacks, such as white-box attacks and black-box attacks. In order to validate the detection efficiency of our method, we conduct comprehensive experiments on MNIST, CIFAR10, and ImageNet datasets. With 99.05% and 98.8% detection rates on the MNIST and CIFAR10 datasets, ACT-Detector outperforms detectors that include 45-channel transforms and those that use only 5-channel transforms. The reason for this is that our method can select channels with different features, whereas the features in the 45 channels are redundant. With the reduced number of channels, the total time required by our method to detect an instance during a test is about one-fourth of that of the 45-channel detector. Thus, the proposed detector proves to be effective and efficient, which is valuable for detecting adversarial instances.