3 ms·

Any proposed methods of attack mitigation comes to mind after this research? I would suspect, and take this with a grain of salt, I haven't been working with ma

Any proposed methods of attack mitigation comes to mind after this research? I would suspect, and take this with a grain of salt, I haven't been working with machine learning for quite some time, that smaller subsets of the same data each representing a different kind of attack mapped to another dimension in the network output (that would be then recurrently fed to the same network) could prevent the issue. Kind of teaching the network to defend itself, recognising patterns of attacks and discarding or compensating them as it would noise or other kind of interventions. Are the attacks statistically identifiable? Can they be translated to a training subset? What would you propose?

c0deb0t 7y ago
Feeding examples generated by an attack back into the network is a very classical defense mechanism. This works ok, but it is not attack-agnostic, and removing adversarial points works better in 3D. There are also works (mostly in 2D) on detecting adversarial examples with neural networks. I am not sure about statistical identification, but we show that it is difficult to identify and remove adversarial points by looking for statistical outliers points. I am not sure about truly robust 3D-specific defenses---if anyone has some idea, I am open to collaboration. I would imagine some sort of provably robust method built specifically to handle the varying density and distribution of points.