Researchers create noisy neural networks to foil AI adversarial attacks

Advances in the design of artificial neural networks have led to breakthroughs in many applications in computer vision, audio recognition, medical diagnostics, and more. These neural networks have demonstrated remarkable success in tasks such as image classification, speech recognition, and disease detection, often achieving or even surpassing human-level performance. They have transformed industries, enabling the development of self-driving cars, enhancing the accuracy of voice assistants, and assisting doctors in diagnosing diseases more effectively.

However, despite their impressive capabilities, neural networks are not without their vulnerabilities. One of the most concerning challenges in the field of deep learning is their susceptibility to being fooled by adversarial attacks.

This means that even tiny, imperceptible changes to the input data – like changing a pixel - can cause a neural network to make grossly incorrect predictions, often with high confidence. For example, a classifier trained to recognize everyday objects might confidently misclassify a stop sign as a speed limit sign if a few pixels are subtly altered. This phenomenon has raised concerns about the reliability of neural networks in safety-critical applications, such as autonomous vehicles and medical diagnostics.

To address this vulnerability, researchers have explored various strategies, one of which involves introducing noise into the first few layers of the neural network. By doing so, they aim to make the network more robust to slight variations in input data. Noise injection can help prevent neural networks from relying too heavily on small, irrelevant details in the input, forcing them to learn more general and resilient features. This approach has shown promise in mitigating the susceptibility of neural networks to adversarial attacks and unexpected variations in input, making them more reliable and trustworthy in real-world scenarios.

But the cat-and-mouse game continues, with attackers turning their attention to the inner layers of neural networks. Rather than subtly changing inputs, these attacks leverage knowledge of the inner workings of the network to trick it by providing inputs that are far from what is expected, but with the introduction of specific artifacts, to get a desired result.

These situations have been more difficult to safeguard against because it was believed that introducing random noise into the inner layers would negatively impact the performance of the network under normal conditions. But a pair of researchers at the University of Tokyo have recently published a paper refuting this common belief.

The team first devised an adversarial attack against a neural network that targeted the inner, hidden layers to cause it to misclassify input images. Finding that this attack was successful against the network, they could use it to test the utility of their next technique — inserting random noise into the network’s inner layers. It was found that this simple modification of the neural network made it robust against the attack, indicating that this type of approach can be leveraged to boost the adaptability and defensive capabilities of future neural networks.

While the approach was found to be quite useful, the work is not yet finished.

As it stands, the method is only proven to work against one particular type of attack. Moreover, one of the team members noted that “future attackers might try to consider attacks that can escape the feature-space noise we considered in this research. Indeed, attack and defense are two sides of the same coin; it’s an arms race that neither side will back down from, so we need to continually iterate, improve and innovate new ideas in order to protect the systems we use every day.”

As we rely on Artificial Intelligence (AI) more and more for critical applications, the robustness of neural networks against both unexpected data and intentional attacks will only grow in importance. We can hope for more innovation in this area in the months and years to come.