Deep Learning (DL) and Deep Neural Networks (DNNs) are widely used in various
domains. However, adversarial attacks can easily mislead a neural network and
lead to wrong decisions. Defense mechanisms are highly preferred in
safety-critical applications. In this paper, firstly, we use the gradient class
activation map (GradCAM) to analyze the behavior deviation of the VGG-16
network when its inputs are mixed with adversarial perturbation or Gaussian
noise. In particular, our method can locate vulnerable layers that are
sensitive to adversarial perturbation and Gaussian noise. We also show that the
behavior deviation of vulnerable layers can be used to detect adversarial
examples. Secondly, we propose a novel NoiseCAM algorithm that integrates
information from globally and pixel-level weighted class activation maps. Our
algorithm is susceptible to adversarial perturbations and will not respond to
Gaussian random noise mixed in the inputs. Third, we compare detecting
adversarial examples using both behavior deviation and NoiseCAM, and we show
that NoiseCAM outperforms behavior deviation modeling in its overall
performance. Our work could provide a useful tool to defend against certain
adversarial attacks on deep neural networks.

本论文使用 “梯度类激活图”(GradCAM) 数据分析了深度学习中的 “VGG-16” 网络在遭受对抗性干扰和高斯噪声的影响下的行为偏差，并针对这种情况提出了基于噪声加权类激活图的新算法 “NoiseCAM”，该算法不易受到对抗性干扰的干扰。研究结果表明，NoiseCAM 的整体性能优于行为偏差建模方法，可以提供一种有用的工具来防御深度神经网络的某些对抗攻击。