Adversarial Sample Joint Detection Method Based on Feature Squeezing

Deep neural networks are susceptible to adversarial sample attacks, which can cause deep learning models to output erroneous results with high confidence. In this paper, to address the problems of high computational cost and high false alarm rate of the existing adversarial sample detection methods, we propose a joint detection method of adversarial samples based on feature squeezing, which, without modifying the structure and parameters of the DNN model, performs feature squeezing by combining the color bit depth and spatial smoothing, and calculates the prediction results of the compressed samples input into the DNN model and the original samples input into the DNN, and takes the maximum value of multiple prediction differences, and if the maximum value is greater than a threshold, the input is adversarial. The prediction difference of the compressed sample input DNN model and the prediction result of the original sample input DNN are calculated, and the maximum value of the multiple prediction differences is taken, if the maximum value is larger than a threshold then the input is adversarial. The adversarial sample joint detection method proposed in this paper has a low training cost and can solve the problem that a single squeezing detection cannot remain efficient for all adversarial attacks. The method retains the accuracy of legitimate samples while guaranteeing a low false-positive rate, improves the accuracy of the adversarial sample detection, reduces the computational overhead, reduces the false positives, and It is an effective strategy for adversarial sample detection.