Deep learning algorithms have been known to be vulnerable to adversarial perturbations in various tasks such as image classification. This problem was addressed by employing several defense methods for detection and rejection of particular types of attacks. However, training and manipulating networks according to particular defense schemes increases computational complexity of the learning algorithms. In this work, we propose a simple yet effective method to improve robustness of convolutional neural networks (CNNs) to adversarial attacks by using data dependent adaptive convolution kernels. To this end, we propose a new type of HyperNetwork in order to employ statistical properties of input data and features for computation of statistical adaptive maps. Then, we filter convolution weights of CNNs with the learned statistical maps to compute dynamic kernels. Thereby, weights and kernels are collectively optimized for learning of image classification models robust to
 adversarial attacks without employment of additional target detection and rejection algorithms.
 We empirically demonstrate that the proposed method enables CNNs to spontaneously defend against different types of attacks, e.g. attacks generated by Gaussian noise, fast gradient sign methods (Goodfellow et al., 2014) and a black-box attack (Narodytska & Kasiviswanathan, 2016). Deep convolutional neural networks are powerful and popular algorithms that achieve state-of-the-art performance in various computer vision tasks, such as object recognition. Despite the advances made by the recent architectures BID7 BID16 BID18 BID5 , they are discovered to be fragile to small but carefully directed perturbations of images BID17 , such that the targeted images can be classified to incorrect categories with high confidence, while humans are still able to correctly classify the attacked images, being undisturbed or even unaware of the perturbations. The vulnerability of these networks to these, so called adversarial examples, may lead to undesirable consequences in safety-and security-critical applications. provide an example of misclassification of traffic signs which could be a significant threat for autonomous driving systems that employ deep learning algorithms. Various adversarial attack methods for neural networks have been studied in numerous works. The majority of attack methods can be catalogued in three groups.1. Methods which use unspecific statistical noise: In this group, input images are perturbed using unspecific statistical noise, e.g. Gaussian noise, salt and pepper noise and blurring. Since shape and parameters of distribution functions that are used to generate noise are not determined, it is usually not easy to obtain a highly confident misclassification results with imperceptible perturbations BID17 . 2. Gradient based attack methods: They are used to generate high confidence imperceptible adversarial examples within few steps or one-shot gradient based noise. Some examples of the methods considered in this group are (Iterative) Fast Gradient Sign Method BID3 BID8 , L-BFGS BID19 , Jacobian-based Saliency Map BID12 and DeepFool . These methods require a white-box environment in order to make attacks. In other words, the full network architecture and weights are required to be accessible in order to obtain gradients towards input images.3. Black-box attack methods. These methods assume that only the output of the networks can be accessed. Substitute networks and greedy search of noisy pixels BID11 are considered in this group. It is worth mentioning that, methods such as transferring adversarial examples from another network, which is optimized with a sufficient part or the whole training datasets, are not considered as a genuine black-box method.In this work, inspired by the recent works BID0 BID4 that construct neural networks with data dependent weights, we propose a simple yet effective method to train CNNs by improving their robustness to adversarial perturbations. Our main idea is to adaptively filter convolution weights of CNNs by using statistical properties of input data and features. Concretely, we propose a HyperNetwork to compute statistical adaptive maps using these statistical properties (mean and variance) of input data and features for each input channel. Then, we obtain data dependent kernels for convolution operations by computing Hadamard (element-wise) product of computed maps and convolution weights. Our main contributions can be summarized as follows:1. We propose a new type of CNN architecture that employ HyperNetworks to dynamically generate data dependent convolution kernels with statistical properties of input data and features. 2. We empirically verify the robustness of our proposed models using large scale vision dataset, and demonstrate that their robustness is improved without using additional aforementioned computationally complex defense methods or spending effort to generate adversarial examples for training. In this work, we propose a simple yet effective method to improve robustness of convolutional neural networks (CNNs) to adversarial attacks by training CNNs using data dependent adaptive convolution kernels. To this end, we employ HyperNetworks to dynamically generate data dependent convolution kernels with statistical properties of input data and features. The robustness of our proposed method is verified using 3 different types of attack with state-of-the-art CNN models trained on the ILSVRC-2012 dataset. Moreover, the robustness is obtained spontaneously during a normal training progress without losing any performance in the original tasks. This shed light on building practical deep learning systems that focus on the target without a concern of attacker. On the other hand, there still exists uncertainty on the mechanism of the robustness remains to be solved in the future works. Furthermore, designing of network architectures that employ more powerful HyperNetworks with better adversarial robustness is still an open problem.
We modified the CNN using HyperNetworks and observed better robustness against adversarial examples. Improving the robustness and reliability of deep convolution neural networks by using data-dependent convolution kernels