DCN: Detector-Corrector Network Against Evasion Attacks on Deep Neural Networks

Deep neural networks are extensively used in image recognition. However, its integrity is compromised by evasion attacks. Attackers can easily craft adversarial examples that make DNNs unknowingly output the labels they want rather than the right labels. In a recent study, it was shown that existing detection methods are not effective in identifying these adversarial examples, i.e., it is a realistic threat to existing systems. Unlike the previous detection methods, we observe that the classification probability distributions of adversarial examples and those of untampered examples exhibit a big difference, which can be easily identified based on the output of a DNN without getting into the complicated DNN internal structure. Based on this new insight, we propose a new light-weight detection method by transforming the detection of adversarial examples into a binary classification problem. The detector we train achieves almost 100% accuracy on adversarial examples. Moreover, we propose a detector-corrector network that effectively reduces successful rate of existing state-of-the-art evasion attacks under three commonly used distance metrics. In particular, for the common L2 attack, DCN mitigates 99% adversarial examples on MNIST and 95% on CIFAR-10. Our evaluation demonstrates that DCN is significantly more effective and efficient against various evasion attacks than existing methods.