Authors:
Duc-Anh Nguyen
1
;
Kha Do Minh
1
;
Duc-Anh Pham
2
and
Pham Ngoc Hung
1
Affiliations:
1
VNU University of Engineering and Technology (VNU-UET), Building E3, 144 Xuan Thuy Road, Cau Giay District, Hanoi, Vietnam
;
2
University of Transport Technology, 54 Trieu Khuc Road, Thanh Xuan District, Hanoi, Vietnam
Keyword(s):
Adversarial Example Generation, Deep Neural Network, Robustness, Autoencoder.
Abstract:
To evaluate the robustness of DNNs, most of the adversarial methods such as FGSM, box-constrained L-BFGS, and ATN generate adversarial examples with small Lp-norm. However, these adversarial examples might contain many redundant perturbations. Removing these perturbations increases the quality of adversarial examples. Therefore, this paper proposes a method to improve the quality of adversarial examples by recognizing and then removing such perturbations. The proposed method includes two phases namely the autoencoder training phase and the improvement phase. In the autoencoder training phase, the proposed method trains an autoencoder that learns how to recognize redundant perturbations. In the second phase, the proposed method uses the trained autoencoder in combination with the greedy improvement step to produce more high-quality adversarial examples. The experiments on MNIST and CIFAR-10 have shown that the proposed method could improve the quality of adversarial examples significa
ntly. In terms of L0-norm, the distance decreases by about 82%-95%. In terms of L2-norm, the distance drops by around 56%-81%. Additionally, the proposed method has a low computational cost. This shows the potential ability of the proposed method in practice.
(More)