Recoloring based Countermeasure against Adversarial Example and its Evaluation

Adversarial Example (AE) has been reported as an attack that causes AI to make false inferences by adding slight perturbations to images that cannot be perceived. Some countermeasures against AE have been proposed, including model-focused techniques such as Adversarial Training and input-focused methods like Gk-means. However, the feasibility of previous countermeasures is low in terms of implementation cost and target coverage. Therefore, this study proposes an AE countermeasure based on c-means clustering to achieve high feasibility. The proposed countermeasure generates a modified image that can be correctly inferred by using image features obtained by c-means and performing recoloring processing, which converts them into safe pixel values. The characteristic of the proposed method is the use of c-means, a soft clustering technique, which allows the use of an appropriate number of colors for each image. Experiments were conducted to compare the proposed method with previous studies using representative AE, demonstrating its effectiveness in terms of inference success rate and the rate of change to the correct inference region.