Adversarial robustness in deep neural networks based on variable attributes of the stochastic ensemble model - Qin, Ruoxi; Wang, Linyuan; Du, Xuehui; Xie, Pengfei; Chen, Xingyuan; Yan, Bin (Frontiers in Neurorobotics, 2023)
Deep neural networks (DNNs) are shown to be susceptible to critical vulnerabilities when subjected to attacks of adversarial samples. This has prompted the development of attack and defense strategies that resemble those used in cyberspace security. The dependence of such strategies on attack and defense mechanisms makes the associated algorithms on both sides appear as closely reciprocating processes, where the defense method are particularly passive in these processes. Taking inspiration from the dynamic defense approach proposed in cyberspace to address endless arm races, this paper defines ensemble variable attributes such as model order, network structure, and smoothing parameters, proposing a stochastic strategy that builds upon the ensemble model using heterogeneous and redundant models. The proposed method introduces the diversity and randomness characteristic to deep neural network to alter the fixed correspondence gradient between input and output. The unpredictability and diversity of gradients make it impossible for attackers to directly implement white-box attacks, which helps to handle the extreme transferability and vulnerability of ensemble models under white-box attacks. Experimental comparison of ASR-vs-distortion curves with different attack scenarios demonstrates that even the highest-capacity attacker cannot easily exceed the attack success rate associated with the ensemble smoothed model, especially under untargeted attacks.