Parameter Free Countermeasure Against Adversarial Examples

In recent years, the increasing number of reported crimes in Japan has drawn attention to crime prevention sys-tems. Among these, intelligent security systems utilizing image classification neural networks (NNs) have been employed to enhance security by detecting suspicious individuals lingering for extended periods or identifying intruders in restricted areas. These systems use image classification NNs to perform tasks such as detecting individuals, estimating attributes like gender and age, and predicting movements from camera images. However, several attack methods targeting such image classification NNs used in these security systems have been reported. One of these is the use of adversarial examples (AEs), which are images intentionally perturbed with noise to cause misclassification by the NN. If such AEs appear in security camera footage, the system may fail to function correctly, making countermeasures essential. In this study, we propose an AE defense method using GIF conversion that can be applied to existing NNs. Additionally, we evaluate the effectiveness of the proposed method through experimental validation.