Using Honeypots to Catch Adversarial Attacks on Neural Networks

In our work, we explore a new honeypot approach to protect DNN models. We intentionally inject honeypot weaknesses in the classification manifold that attract attackers searching for adversarial examples. Attackers optimization algorithms gravitate towards trapdoors, leading them to produce attacks similar to trapdoors in the feature space. We introduce trapdoors & describe an implementation of a trapdoor-enabled defense. We analytically prove that trapdoors shape the computation of adversarial attacks so that attack inputs will have feature representations very similar to those of trapdoors. We experimentally show that trapdoor-protected models can detect, with high accuracy, adversarial examples generated by state-of-the-art attacks. These results generalize across classification domains, including image, facial, & traffic-sign recognition. We also present significant results measuring trapdoors? robustness against customized adaptive attacks (countermeasures).