Improving Adversarial Robustness Against Universal Patch Attacks Through Feature Norm Suppressing.

Area of Science:

• Computer Vision
• Deep Learning
• Cybersecurity

Background:

• Universal adversarial patch attacks pose a significant threat to real-world deep convolutional neural networks (CNNs).
• Existing defense methods struggle with adaptive attacks, scalability, and computational overhead.
• These attacks exploit large feature norms in classifiers and channel-aware norms (CA-Norm) in detectors.

Purpose of the Study:

• To investigate the underlying mechanisms of universal adversarial patch attacks in CNNs.
• To propose and evaluate a novel defense mechanism against these attacks.
• To enhance the robustness of computer vision systems against adversarial patch manipulations.

Main Methods:

• Mathematical analysis of adversarial patch success factors in CNNs.
• Introduction of a Feature Norm Suppressing (FNS) layer as a defense mechanism.
• Adaptive insertion of the FNS layer into various CNN architectures for multistage feature norm suppression.

Main Results:

• The FNS layer effectively renormalizes feature norms, mitigating adversarial patch attacks.
• The proposed defense significantly improves adversarial robustness in both image classification and object detection tasks.
• FNS demonstrates efficiency with no trainable parameters and low computational overhead, with minimal impact on benign image performance.

Conclusions:

• The FNS layer offers a simple, efficient, and effective defense against universal adversarial patch attacks.
• This method enhances the security of practical computer vision systems without compromising performance.
• The findings provide a promising direction for developing robust CNNs against adversarial manipulations.