Deep learning has become the state of the art approach in many machine learning problems such as classification. It has recently been shown that deep learning is highly vulnerable to adversarial perturbations. Taking the camera systems of self-driving cars as an example, small adversarial perturbations can cause the system to  make errors in important tasks, such as classifying traffic signs or detecting pedestrians. Hence, in order to use deep learning without safety concerns a proper defense strategy is required. We propose to use ensemble methods as a defense strategy against adversarial perturbations. We find that an attack leading one model to misclassify does not imply the same for other networks performing the same task. This makes ensemble methods an attractive defense strategy against adversarial attacks. We empirically show for the MNIST and the CIFAR-10 data sets that ensemble methods not only improve the accuracy of neural networks on test data but also increase their robustness against adversarial perturbations. In recent years, deep neural networks (DNNs) led to significant improvements in many areas ranging from computer vision BID14 BID17 to speech recognition . Some applications that can be solved with DNNs are sensitive from the security perspective, for example camera systems of self driving cars for detecting traffic signs or pedestrians BID21 BID24 . Recently, it has been shown that DNNs can be highly vulnerable to adversaries BID25 BID5 BID20 . The adversary produces some kind of noise on the input of the system to mislead its output behavior, producing undesirable outcomes or misclassification. Adversarial perturbations are carefully chosen in order to be hard, if not impossible, to be detected by the human eye (see FIG1 ). Attacks occur after the training of the DNN is completed. Furthermore, it has been shown that the exact structure of the DNN does not need to be known in order to mislead the system as one can send inputs to the unknown system in order to record its outputs to train a new DNN that imitates its behavior BID21 . Hence, in this manuscript it is assumed that the DNN and all its parameters are fully known to the adversary.There are many methods on how to attack neural networks appearing in the literature. Some of the most well-known ones are the Fast Gradient Sign Method BID5 and its iterative extension BID15 , DeepFool BID19 , Jacobian-Based Saliency Map Attack BID22 , and the L-BFGS Attack BID25 . This shows the need of building neural networks that are themselves robust against any kind of adversarial perturbations.Novel methods on defending against adversarial attacks are appearing more and more frequently in the literature. Some of those defense methods are to train the network with different kinds of adversarially perturbated training data BID5 BID22 , the use of distillation to reduce the effectiveness of the perturbation BID23 or to apply denoising autoencoders to preprocess the data used by the DNN BID7 . It also has been noted that adversarial attacks can be detected BID18 BID4 , but FIG1 : The first line shows original and correctly classified MNIST test data images. In the second line are the corresponding adversarial BIM attacks on a single classifier ( = 0.2, α = 0.025, n = 8) which predicts (from left to right): 6, 8, 1, 5, 9, 3, 0, 2, 2, and 4. Analogously, the third line corresponds to correctly predicted examples of the CIFAR-10 test data set. In the bottom line are the corresponding adversarial BIM attacks on a single classifier ( = 0.02, α = 0.0025, n = 8) which predicts (from left to right): deer, cat, deer, ship, bird, deer, deer, frog, automobile, and automobile. these detection systems are again vulnerable to adversarial attacks. To our knowledge, there is no method that can reliably defend or detect all kinds of adversarial attacks.In this manuscript, ensemble methods are used to obtain a classification system that is more robust against adversarial perturbations. The term ensemble method refers to constructing a set of classifiers used to classify new data points by the weighted or unweighted average of their predictions. Many ensemble methods have been introduced in the literature such as Bayesian averaging, Bagging BID1 and boosting BID3 . These methods frequently win machine learning competitions, for example the Netflix prize BID12 . Initial results on using ensembles of classifiers in adversarial context can be found in BID0 BID9 . However, to the best of our knowledge this is the first manuscript that empirically evaluates the robustness of ensemble methods to adversarial perturbations.One advantage of using ensemble methods as defense against adversarial perturbations is that they also increase the accuracy on unperturbed test data. This is not the case in general for other defense methods (see TAB4 ). However, in most applications a perturbated input can be considered as exception. Hence, it is desirable to obtain a state of the art result on unperturbed test data while making the model more robust against adversarial attacks. Another advantage is that ensemble methods can easily be combined with other defense mechanisms to improve the robustness against adversarial perturbations further (see TAB4 ). However, the advantages come at a cost of an increase of computational complexity and memory requirements which are proportional to the number of classifiers in the ensemble. This paper is organized as follows: In section 2, some methods for producing adversarial perturbations are briefly introduced. Section 3 describes the defense strategy proposed in this manuscript. In section 4, the previous methods are tested on the MNIST and CIFAR-10 data sets and are compared to other defense strategies appearing in the literature. Finally, in section 5 the conclusions are presented. With the rise of deep learning as the state-of-the-art approach for many classification tasks, researchers noted that neural networks are highly vulnerable to adversarial perturbations. This is particularly problematic when neural networks are used in security sensitive applications such as autonomous driving. Hence, with the development of more efficient attack methods against neural networks it is desirable to obtain neural networks that are themselves robust against adversarial attacks.In this manuscript, it is shown that several ensemble methods such as random initialization or Bagging do not only increase the accuracy on the test data, but also make the classifiers considerably more robust against certain adversarial attacks. We consider ensemble methods as sole defense methods, but more robust classifiers can be obtained by combining ensemble methods with other defense mechanisms such as adversarial training. Although only having tested simple attack scenarios, it can be expected that ensemble methods may improve the robustness against other adversarial attacks.
Using ensemble methods as a defense to adversarial perturbations against deep neural networks. This paper proposes to use ensembling as an adversarial defense mechanism. Empirally investigated the robustness of different deep neural entworks ensembles to the two types of attacks, FGSM and BIM, on two popular datasets, MNIST and CIFAR10