Preprocessing-based Adversarial Defense for Object Detection via Feature Filtration
Ling Zhou, Qihe Liu, Shijie Zhou · 2023
Deep Neural Network (DNN)-based object detection achieved great success in a variety of scenarios. However, adversarial examples can cause catastrophic mistakes in DNNs. Despite the adversarial examples with human-imperceptible perturbations can completely change the predictions of the networks in the decision space, few defenses for object detection are known to date. In this paper, we proposed an end-to-end input transformation model to defend adversarial examples, which is motivated by research on feature representations under adversarial attacks. The proposed model consists of an Autoencoder (contains an encoder and a decoder) and a critic network only used in training. Both benign and adversarial examples are used as training sets for the proposed model. The critic network can force the encoder to eliminate the distribution divergence between benign and adversarial examples in the latent space, to filter out the non-robust features and adversarial perturbations. Finally, the decoder is used to reconstruct the input examples from preserved feature vectors into a clean version, which is then fed to the trained detector. Extensive experiments on the challenging PASCAL VOC dataset demonstrate that the proposed method can significantly improve the robustness of various detectors against unseen adversarial attacks, and it has better performance and lower time cost than previous works.