Conference paper Open Access

Defending Neural ODE Image Classifiers from Adversarial Attacks with Tolerance Randomization

Carrara Fabio; Caldelli Roberto; Falchi Fabrizio; Amato Giuseppe

Deep learned models are now largely adopted in different fields, and they generally provide superior performances with respect to classical signal-based approaches. Notwithstanding this, their actual reliability when working in an unprotected environment is far enough to be proven. In this work, we consider a novel deep neural network architecture, named Neural Ordinary Differential Equations (N-ODE), that is getting particular attention due to an attractive property--a test-time tunable trade-off between accuracy and efficiency. This paper analyzes the robustness of N-ODE image classifiers when faced against a strong adversarial attack and how its effectiveness changes when varying such a tunable trade-off. We show that adversarial robustness is increased when the networks operate in different tolerance regimes during test time and training time. On this basis, we propose a novel adversarial detection strategy for N-ODE nets based on the randomization of the adaptive ODE solver tolerance. Our evaluation performed on standard image classification benchmarks shows that our detection technique provides high rejection of adversarial examples while maintaining most of the original samples under white-box attacks and zero-knowledge adversaries.

Files (1.0 MB)
Name Size
defending_preprint.pdf
md5:db6b65e109e63cb0015b95db6dd76fa0
1.0 MB Download
16
15
views
downloads
Views 16
Downloads 15
Data volume 15.4 MB
Unique views 10
Unique downloads 13

Share

Cite as