Locally optimal detection and randomization defenses against universal adversarial perturbations

Goel, Amish

Permalink

https://hdl.handle.net/2142/117625 Copy

Description

Title

Locally optimal detection and randomization defenses against universal adversarial perturbations

Author(s)

Goel, Amish

Issue Date

2022-08-25

Director of Research (if dissertation) or Advisor (if thesis)

Moulin, Pierre

Doctoral Committee Chair(s)

Moulin, Pierre

Committee Member(s)

• Schwing, Alexander
• Li, Bo
• Raginsky, Maxim
• Veeravalli, Venugopal V.

Department of Study

Electrical & Computer Eng

Discipline

Electrical & Computer Engr

Degree Granting Institution

University of Illinois at Urbana-Champaign

Degree Name

Ph.D.

Degree Level

Dissertation

Keyword(s)

• universal adversarial perturbations
• deep learning
• hypothesis testing
• locally optimal test
• generalized likelihood ratio test

Language

eng

Abstract

This thesis investigates a detection-based approach to safeguard a machine-learning based classifier from adversarial perturbations of its input. In particular, we consider input agnostic universal adversarial perturbations which are selected to force the input to a desired target class. The detector is designed by application of fundamental concepts of statistical decision theory, including locally optimal testing. Since locally optimal detectors depend on the input distribution, which is unknown in real-world datasets, a tractable surrogate input distribution is used instead. The thesis also defines several metrics for joint classification and detection, and evaluates them on several image datasets and popular image classifiers. We demonstrate through the experimental results that our detection-based approach is successful and outperforms the prior state of the art. We also show that detector-aware universal adversarial perturbations can be constructed in a way that evades our detector and achieves high target success rate on the classifier. To mitigate this problem, we propose and evaluate several relevant randomization schemes. Among the proposed methods, we observe that randomized smoothing offers better defense against the stronger detector-aware attacks.

Graduation Semester

2022-12

Type of Resource

Thesis

Handle URL

https://hdl.handle.net/2142/117625

Copyright and License Information

Copyright 2022 Amish Goel

Owning Collections