A defense method based on attention mechanism against traffic sign adversarial samples

Highlights

• The attacker can cheat the neural network by adding tiny disturbance to the image.

• If traffic signs are attacked, automatic driving will probably be misguided.

• The key areas in the image are extracted by the attention mechanism.

• It can theoretically defend against unknown attacks.

Abstract

A traditional neural network cannot realize the invariance of image rotation and distortion well, so an attacker can fool the neural network by adding tiny disturbances to an image. If traffic signs are attacked, automatic driving will probably be misguided, leading to disastrous consequences. Inspired by the principle of human vision, this paper proposes a defense method based on an attentional mechanism for traffic sign adversarial samples. In this method, the affine coordinate parameters of the target objects in the images are extracted by a CNN, and then the target objects are redrawn by the coordinate mapping model. In this process, the key areas in the image are extracted by the attention mechanism, and the pixels are filtered by interpolation. Our model simulates the daily behavior of human beings, making it more intelligent in the defense against the adversarial samples. Experiments show that our method has a strong defense ability for traffic sign adversarial samples generated by various attack methods. Compared with other defense methods, our method is more universal and has a strong defense ability against a variety of attacks. Moreover, our model is portable and can be easily implanted into neural networks in the form of defense plug-ins.

Introduction

Deep neural networks (DNNs) have achieved great success in various tasks such as semantic segmentation, target tracking and image retrieval [1], [2], [3]. However, as was first shown by Christian Szegedy et al. [4], for an adversarial sample created by adding subtle disturbance to the input samples, the image classification recognition model can output the wrong classification with high confidence. Since the added disturbance is very trivial, the adversarial sample looks almost the same as the original image. Subsequently, a large number of attack methods have been developed [5], [6], [7], [8], demonstrating the severe shortcoming of the recognition by the neural network.

Intelligent transportation systems have been emerging gradually, and in particular, DNNs have been used in the control pipes of automobiles [9], [10]. Traffic sign recognition is a key technology and is one of the challenges in the intelligent transportation research. As shown in Fig. 1, if an attacker generates adversarial samples of traffic signs, the images that do not appear to be different from the normal traffic signs to human eyes may be misjudged as the wrong signs by the automatic recognition system [11], which will can clearly result in catastrophic consequences.

Currently, the existing defense methods are designed based on specific adversarial samples. Experiments have shown that once the attack mode changes, the defense ability will be greatly reduced or even invalid. Therefore, we seek to explore a defense model that is independent of the attack mode. We speculate that the application of a visual attention mechanism [12] in neural networks may be able to provide a defense against attacks. We know that when people observe a target object, they often focus on the key parts of the target object and ignore the background information. As shown in Fig. 2, people will directly focus on the bird in the image and ignore the blue sky background. Attention mechanisms have been widely used in the field of computer vision [13]. Inspired by this, we implant a visual attention mechanism in a DNN to guide it to focus on the key parts of the target object while ignoring the disturbance in the adversarial samples.

In this paper, we design a defense method based on an attention mechanism to eliminate the disturbance in the adversarial samples and capture the main features of the correct objects. In our model, through end-to-end training, CNN extracted affine coordinate parameters of the target object in the image, and redrew the target object with the coordinate mapping module. During this process, the key areas of the image are extracted by the attention mechanism, and the pixels are filtered by interpolation to eliminate the misclassification caused by the disturbance in the adversarial samples. Different from the current conventional defense methods, our method is not targeted to the specific neural network model and the structure of the adversarial samples but rather guides the network to pay attention to the key parts of the target object in a more intelligent manner and discards the non-vital parts to fundamentally defend against the adversarial samples. Equipped with this perspective, our contributions can be summarized as follows:

• We propose a defense method based on the attention mechanism that can guide the neural network to focus on the key parts of the target object in the image while ignoring the disturbance to achieve the defense goal;

• We propose a spatial transformation model that can transform significant parts of the image into new space and redraw to generate new images;

• The experimental results show that compared with other defense models, our model has a balanced performance on multiple neural networks and datasets. This indicates that our model has better robustness and universality.