A Non-Deterministic Method to Construct Ensemble-Based Classifiers to Protect Decision Support Systems Against Adversarial Images: A Case Study

Abstract

In recent years, Deep Learning has presented impressive performance when solving complex image classification and recognition tasks in decision support systems. Nonetheless, studies have demonstrated Deep Learning models are susceptible to attacks conducted with adversarial images, i.e. images containing subtle perturbations in order to induce models to misclassification. The main existing countermeasures against adversarial images have shown ineficiency, permitting attackers to map their internal operation more easily. Therefore, this work aims to evaluate a defense method called MultiMagNet which randomly incorporates at runtime multiple defense components, implemented as autoencoders, in order to introduce an expanded form of non-determinism behavior for hindering evasions of adversarial nature. Experiments on CIFAR-10 dataset showed MultiMagNet was able to detect images generated by different attack algorithms.