Complete Defense Framework to Protect Deep Neural Networks against Adversarial Examples

Figure 1

The illustration of an adversarial example with noticeable and unnoticeable perturbations. (a) The legitimate image is classified as “ringlet butterfly” with 98.1% confidence. (b) and (d) show the noticeable and unnoticeable adversarial perturbations, respectively. The corresponding adversarial images generated by fast gradient sign and Carlini & Wagner methods are misclassified as “starfish” with 97.6% confidence (c) and “chickadee” with 95.2% confidence (e) Note the different colors in (b) and (d) represent the average pixel values of three channels of the residual image which is the difference between adversarial and legitimate images. The color close to blue means the small difference and the color close to orange means the large difference so that they can be distinguished between noticeable and unnoticeable perturbations (the pixel values of legitimate and adversarial images range from 0 to 255).