Bayes without Bayesian Learning for Resisting Adversarial Attacks
Thi Thu Thao Khong, Takashi Nakada, Yasuhiko Nakashima · 2020
Recent studies have been shown the vulnerability of Deep neural networks (DNNs) by a small adversarial perturbation in images that humans cannot distinguish and a well-trained neural network misclassifies. There are many defense methods, e.g. randomness, ensemble, and adversarial training that can improve the robustness of neural networks with respect to adversaries. Among them, adversarial training has been being the most outstanding defense. However, the training cost becomes a big challenge to adversarial learning. In this paper, we propose a new defense algorithm called Bayes without Bayesian Learning, which does not add the training phase in resisting adversarial attacks. Our method has based on the stochastic components of Bayesian Convolutional Neural Network (BCNN) to prevent the forceful gradient based attacks and generate the ensemble model to enhance the performance of models. In order to avoid adversarial training, we utilize pretrained CNN models on both natural and perturbed data. Therefore, this approach can be applied to any model with learned parameters to accelerate the computation of the defensive method. Our defensive algorithm has significantly improved the accuracy of pretrained CNN models under the high level of attacks. For instance, on ImageNet with Resnet50 network, we achieve 57% prediction accuracy in the top5, under strong PGD attack. We also confirm 3% improvement when combining our method with adversarial training. Experimental results prove the efficiency of our BCNN model that does not need Bayesian learning but still resists adversarial perturbation on both small and large scale datasets as CIFAR10, CIFAR100, and ImageNet.