STPD: Defending against â„“0-norm attacks with space transformation

Chen, Jinlin Cao Jiannong Liang Zhixuan Cui Xiaohui Yu Lequan Li Wei

The human imperceptible adversarial examples crafted by â„“0-norm attacks, which aims to minimize â„“0 distance from the original image, thereby misleading deep neural network classifiers into the wrong classification. Prior works of tackling â„“0 attacks can neither eliminate perturbed pixels nor improve the performance of the classifier in the recovered low-quality images. To address the issue, we propose a novel method, called space transformation pixel defender (STPD), to transform any image into a latent space to separate the perturbed pixels from the normal pixels. In particular, this strategy uses a set of one-class classifiers, including Isolation Forest and Elliptic Envelope, to locate the perturbed pixels from adversarial examples. The value of the neighboring normal pixels is then used to replace the perturbed pixels, which hold more than half of the votes from these one-class classifiers. We use our proposed strategy to successfully defend against well-known â„“0-norm adversarial examples in the image classification settings. We show experimental results under the One-pixel Attack (OPA), the Jacobian-based Saliency Map Attack (JSMA), and the Carlini Wagner (CW) â„“0-norm attack on CIFAR-10, COVID-CT, and ImageNet datasets. Our experimental results show that our approach can effectively defend against â„“0-norm attacks compared with the most popular defense techniques.