Escaping Filter-based Adversarial Example Defense: A Reinforcement Learning Approach

An adversarial example is a specially-crafted example with subtle and intentional perturbations that causes a machine learning model to make a false classification. A plethora of papers have proposed to use filters to effectively defend against adversarial example attacks. However, we demonstrate that the filter-based defenses may not be reliable in this paper. We develop AEDescaptor, a scheme to escape the filter-based defenses. AEDescaptor uses a specially -crafted policy gradient reinforcement learning algorithm to generate adversarial exam-ples even if the filters are used to interrupt the backpropagation channel (that is used in traditional adversarial example attack algorithms). Furthermore, we design a customized algorithm to reduce the possible action space in policy gradient reinforcement learning to accelerate AEDescaptor training while still ensuring that AEDescaptor generates successful adversarial examples. The intensive experiments demonstrate that AEDescaptor-generated adversarial examples have good performance (in terms of success rate and transferability) to escape the filter-based defenses.

I. Introduction

In the past decade, with the explosive growth of data, the traditional machine learning (ML) methods cannot make full use of big data and fail to provide ML models with superior performance. Deep learning, as a new research direction in the field of ML, has significantly improved performance over traditional ML. Therefore, it has been widely used in image classification [1], [2], semantic segmentation [3], [4], object detection [5], [6], and so on. Image classification is one of the most popular applications of deep learning. Some security-critical applications highly rely on image classification techniques. For example, autonomous driving vehicles employ images captured by cameras to classify road traffic signs (such as Stop signs and Speed Limit signs).