@article {340, title = {Benford{\textquoteright}s law: what does it say on adversarial images?}, journal = {Journal of Visual Communication and Image Representation}, volume = {93}, year = {2023}, chapter = {103818}, abstract = {

Convolutional neural networks (CNNs) are fragile to small perturbations in the input images. These networks are thus prone to malicious attacks that perturb the inputs to force a misclassification. Such slightly manipulated images aimed at deceiving the classifier are known as adversarial images. In this work, we investigate statistical differences between natural images and adversarial ones. More precisely, we show that employing a proper image transformation and for a class of adversarial attacks, the distribution of the leading digit of the pixels in adversarial images deviates from Benford\&$\#$39;s law. The stronger the attack, the more distant the resulting distribution is from Benford\&$\#$39;s law. Our analysis provides a detailed investigation of this new approach that can serve as a basis for alternative adversarial example detection methods that do not need to modify the original CNN classifier neither work on the raw high-dimensional pixels as features to defend against attacks.

}, issn = {1047-3203}, doi = {10.1016/j.jvcir.2023.103818}, url = {https://www.sciencedirect.com/science/article/pii/S1047320323000688}, author = {Jo{\~a}o G. Zago and Eric A. Antonelo and Fabio L. Baldissera and Rodrigo T. Saad} } @proceedings {329, title = {It is double pleasure to deceive the deceiver: disturbing classifiers against adversarial attacks}, journal = {2020 IEEE International Conference on Systems, Man, and Cybernetics (SMC)}, year = {2020}, pages = {160-165}, abstract = {

Convolutional neural networks (CNNs) for image classification can be fragile to small perturbations in the images they ought to classify. This fragility exposes CNNs to malicious attacks, resulting in safety concerns in many application domains. In this paper, we propose a simple yet efficient strategy for decreasing the effectiveness of black-box attacks that need to sequentially query the classifier network in order to build an attack. The general idea consists of applying controlled random disturbances (noise) at the softmax output layer of neural network classifiers, changing the confidence scores according to a set of design requirements. To evaluate this defense strategy, we employ a CNN, trained on the MNIST data set, and attack it with a black-box attack method from the literature called ZOO. The results show that our defense strategy: a) decreases the attack success rate of the adversarial examples; and b) forces the attack algorithm to insert larger perturbations in the input images.

}, doi = {10.1109/SMC42975.2020.9282889}, author = {Jo{\~a}o G. Zago and Eric A. Antonelo and Fabio L. Baldissera and Rodrigo T. Saad} } @proceedings {antonelo2006, title = {Modular Neural Network and Classical Reinforcement Learning for Autonomous Robot Navigation: Inhibiting Undesirable Behaviors}, journal = {Proceedings of the International Joint Conference on Neural Networks (IJCNN)}, year = {2006}, month = {Jul.}, pages = {498-505}, publisher = {IEEE}, address = {Vancouver, BC}, abstract = {

Classical reinforcement learning mechanisms and a modular neural network are unified to conceive an intelligent autonomous system for mobile robot navigation. The conception aims at inhibiting two common navigation deficiencies: generation of unsuitable cyclic trajectories and ineffectiveness in risky configurations. Different design apparatuses are considered to compose a system to tackle with these navigation difficulties, for instance: 1) neuron parameter to simultaneously memorize neuron activities and function as a learning factor, 2) reinforcement learning mechanisms to adjust neuron parameters (not only synapse weights), and 3) a inner-triggered reinforcement. Simulation results show that the proposed system circumvents difficulties caused by specific environment configurations, improving the relation between collisions and captures.

}, keywords = {reinforcement learning}, isbn = {0-7803-9490-9}, doi = {10.1109/IJCNN.2006.246723}, url = {https://ieeexplore.ieee.org/document/1716134/}, author = {Eric A Antonelo and Albert-Jan Baerlvedt and Thorsteinn Rognvaldsson and Mauricio Figueiredo} } @proceedings {antonelo2005, title = {Intelligent autonomous navigation for mobile robots: spatial concept acquisition and object discrimination}, journal = {Proceedings of the 6th IEEE International Symposium on Computational Intelligence in Robotics and Automation}, year = {2005}, pages = {553-557}, publisher = {IEEE}, address = {Helsinki, Finland}, abstract = {

An autonomous system able to construct its own navigation strategy for mobile robots is proposed. The navigation strategy is molded from navigation experiences (succeeding as the robot navigates) according to a classical reinforcement learning procedure. The autonomous system is based on modular hierarchical neural networks. Initially the navigation performance is poor (many collisions occur). Computer simulations show that after a period of learning the autonomous system generates efficient obstacle avoidance and target seeking behaviors. Experiments also offer support for concluding that the autonomous system develops a variety of object discrimination capability and of spatial concepts.

}, issn = {0-7803-9355-4}, doi = {10.1109/CIRA.2005.1554335}, url = {https://ieeexplore.ieee.org/document/1554335/}, author = {Eric A Antonelo and Mauricio Figueiredo and Albert-Jan Baerlvedt and Rodrigo Calvo} }