K-Anonymity inspired adversarial attack and multiple one-class classification defense.

Area of Science:

• Computer Science
• Artificial Intelligence
• Machine Learning

Background:

• Deep neural networks (DNNs) are vulnerable to adversarial attacks in image classification.
• Existing adversarial attacks aim to misclassify images with minimal perturbations.
• Effective defense mechanisms are crucial for secure DNN deployment.

Purpose of the Study:

• To propose a novel adversarial attack methodology, K-Anonymity-inspired Adversarial Attack (K-A³).
• To introduce a novel defense mechanism, Multiple Support Vector Data Description Defense (M-SVDD-D).
• To enhance the robustness of DNNs against adversarial attacks in image classification.

Main Methods:

• K-A³: Incorporates K-Anonymity principles into adversarial attack optimization criteria.
• K-A³: Generates adversarial examples that are misclassified and spread across K ranked output positions.
• M-SVDD-D: Replaces the final linear layer of DNNs with non-linear one-class classifiers (Support Vector Data Description).
• M-SVDD-D: Includes an additional class verification mechanism for enhanced security.
• M-SVDD-D: Evaluated for its effectiveness in both white-box and black-box attack scenarios.

Main Results:

• K-A³ successfully generates adversarial examples with targeted output distribution.
• M-SVDD-D significantly decreases the effectiveness of adversarial attacks by increasing required noise energy.
• The non-linearity introduced by M-SVDD-D enhances model robustness.
• M-SVDD-D demonstrates effectiveness in preventing adversarial attacks even in black-box settings.

Conclusions:

• The proposed K-A³ offers a novel approach to crafting sophisticated adversarial attacks.
• M-SVDD-D presents a promising defense strategy against adversarial attacks on DNNs.
• The M-SVDD-D defense mechanism improves model security and resilience in image classification tasks.