Colour Space Defence: Simple, Intuitive, but Effective

Abstract

Deep neural networks (DNNs) are widely applied in autonomous intelligent systems. However, DNNs are vulnerable to adversarial attacks from exclusively crafted input images, leading to performance degradation such as wrong classifications. A wrong classification made by an AIS could result in severe and possibly lethal consequences. While several existing works proposed applying classic computer vision techniques to adversarial defense, these methods generally deteriorate the input information to a considerable extent. To re-store model performances while minimising such deterioration, we propose a novel method for adversarial defence named Colour Space Defence. We first demonstrated the weak transferability of adversarial information across different colour spaces. We then proposed to defend against adversarial examples by ensembling models trained in multiple colour spaces. Experiments have verified the validity of Colour Space Defence in maintaining performances on clean images. In most cases of defence, this method outperformed several of its comparators.