How can you defend ANN models against adversarial attacks in Machine Learning?

1 Types of attacks

There are different ways to classify adversarial attacks based on their goals, methods, and knowledge of the target model. One common distinction is between white-box and black-box attacks. White-box attacks assume that the attacker has full access to the model's architecture, parameters, and gradients, and can craft optimal perturbations to maximize the error rate or the loss function. Black-box attacks, on the other hand, assume that the attacker has limited or no access to the model's internals, and relies on probing, querying, or transferring perturbations from other models to generate adversarial examples. Another common distinction is between targeted and untargeted attacks. Targeted attacks aim to make the model misclassify the input into a specific class chosen by the attacker, while untargeted attacks aim to make the model misclassify the input into any class other than the true one.

2 Attack methods

Adversarial examples can be generated through various methods, depending on the type of attack and the model's domain. Fast Gradient Sign Method (FGSM) is a white-box, untargeted technique that adds a small perturbation in the direction of the gradient of the loss function with respect to the input, creating a small but noticeable change in the input that can cause a large change in the output. Projected Gradient Descent (PGD) is a white-box, targeted or untargeted method that iteratively applies FGSM with a projection step to stay within a predefined epsilon-ball around the original input. Carlini and Wagner (C&W) Attack is a white-box, targeted approach that minimizes an objective function that balances distortion and confidence of the output. Jacobian-based Saliency Map Attack (JSMA) is a white-box, targeted method that computes a saliency map to identify influential pixels for the target class and modifies them to increase its likelihood. Zeroth Order Optimization (ZOO) Attack is a black-box, targeted or untargeted technique that approximates the gradient of the loss function by using finite differences and coordinate descent, allowing attackers to generate adversarial examples without accessing model gradients.

3 Defense strategies

Different ways to defend ANN models against adversarial attacks exist, depending on the stage of the model's lifecycle and the type of defense. We can distinguish between proactive and reactive defenses. Proactive defenses aim to reduce the likelihood of adversarial attacks by making the model more robust, while reactive defenses try to detect or mitigate the impact of adversarial attacks by filtering or correcting the output. Adversarial Training is a proactive defense that trains the model with a combination of clean and adversarial examples in order to increase its resilience to perturbations. Gradient Masking is another proactive defense which modifies the model's architecture, parameters, or loss function in order to prevent attackers from using gradient-based methods for crafting adversarial examples. Feature Squeezing is a reactive defense which reduces the input's dimensionality or complexity by applying transformations such as smoothing, binarizing, or quantizing. Adversarial Detection is another reactive defense which uses auxiliary models, statistical tests, or confidence thresholds in order to identify whether an input is clean or adversarial.