Deep neural networks (DNNs) are finding broad applications in many real-world applications from daily image recognition to safety- and security-sensitive medical diagnosis and self-driving cars. However, the input based adversarial-example attacks bring in ever-increasing security challenges to DNNs, as decisions can be precisely misled by simply adding human imperceptible perturbations into the legitimate model input by attackers. The primary goal of this project is to create a new paradigm of safeguarding DNNs against such attacks by directly rooting defense into compression of the inputs and DNN models, with the guarantee of low cost and high accuracy.  

We have accomplished these goals and more specifically,

(1)  We developed a JPEG-based defensive compression framework, namely "Feature Distillation", to effectively rectify adversarial examples without impacting classification accuracy on benign data with theoretical guarantee. The work for the first time unleashes the defense potentials of the input-transformation techniques with almost zero loss of DNN testing accuracy by re-architecting the fundamental entities of JPEG compression/decompression. This includes defensive quantization to maximize the filtering of adversarial inputs and DNN-oriented quantization to restore DNN testing accuracy. It is extremely low cost and can be widely applicable to many essential components in modern DNN powered intelligent cyber physical systems, such as image sensors, cameras. It also significantly outperforms the state-of-the-art input-transformation based defense and serves as a new benchmark.

(2)  We developed a low-cost frequency refinement approach to defend DNN-based biomedical image segmentation from adversarial attacks. The key idea is to redesign the quantization of JEPG compression based on the unique statistical pattern of adversarial perturbations in frequency domain in image segmentation. It almost recovers the low segmentation prediction to the original level without impacting that of benign images under adversarial settings. This is the very first study that targets the defense against the practical adversarial attacks in the context of biomedical image segmentation.

(3)  We developed a defensive dropout solution (a type of model compression techniques) to harden DNN models under adversarial attacks. The key is to develop a defensive dropout algorithm that determines an optimal test dropout rate given the DNN model and the attacker?s strategy for generating adversarial examples to trade-off the defense effect and testing accuracy.

(4)  We developed a holistic defensive model compression solution set consisting of defensive to harden DNNs? intrinsic resistance capability to a variety of unknown adversarial attacks. It consists of defensive hash compression to strengthen the decision boundary of pretrained DNN models, and retraining-free gradient inhibition methods to effectively eliminate the remaining impact of adversarial gradients with marginal accuracy loss. The work shows how weight compression-an indispensable technique originally aiming to ease the memory/storage overhead during DNN hardware implementation, can be redesigned for enhancing the robustness of DNN models.

The research findings of this project have been disseminated in the forms of conferences papers and presentations, journal papers, as well as invited seminars. The developed software algorithms have been open sourced in Github and served as new benchmarks for the community to further advance the field. This project is the core of the thesis and project of two graduate students (one Ph.D. and one Master). This EAGER research project supported three graduate students and publications of 12 conference and 1 journal papers in total.

Last Modified: 01/05/2022
Modified by: Wujie Wen