English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

We propose a scheme for defending against adversarial attacks by suppressingthe largest eigenvalue of the Fisher information matrix (FIM). Our startingpoint is one explanation on the rationale of adversarial examples. Based on theidea of the difference between a benign sample and its adversarial example ismeasured by the Euclidean norm, while the difference between theirclassification probability densities at the last (softmax) layer of the networkcould be measured by the Kullback-Leibler (KL) divergence, the explanationshows that the output difference is a quadratic form of the input difference.If the eigenvalue of this quadratic form (a.k.a. FIM) is large, the outputdifference becomes large even when the input difference is small, whichexplains the adversarial phenomenon. This makes the adversarial defensepossible by controlling the eigenvalues of the FIM. Our solution is adding oneterm representing the trace of the FIM to the loss function of the originalnetwork, as the largest eigenvalue is bounded by the trace. Our defensivescheme is verified by experiments using a variety of common attacking methodson typical deep neural networks, e.g. LeNet, VGG and ResNet, with datasetsMNIST, CIFAR-10, and German Traffic Sign Recognition Benchmark (GTSRB). Our newnetwork, after adopting the novel loss function and retraining, has aneffective and robust defensive capability, as it decreases the fooling ratio ofthe generated adversarial examples, and remains the classification accuracy ofthe original network.

Defending Against Adversarial Attacks by Suppressing the Largest Eigenvalue of Fisher Information Matrix