Abstract Deep neural networks (DNNs) are vulnerable to adversarial attacks that generate adversarial examples by adding small perturbations to the clean images. To combat adversarial attacks, the two main defense methods used are denoising and adversarial training. However, both methods result in the DNN having lower classification accuracy for clean images than conventionally trained DNN models. To overcome this problem, we propose a hybrid adversarial training (HAT) method that trains the denoising network and DNN model simultaneously. The proposed HAT method uses both clean images and adversarial examples denoised by the denoising network and non-denoised clean images and adversarial examples to train the DNN model. The results of experiments conducted on the MNIST, CIFAR-10, CIFAR-100, and GTSRB datasets show that the HAT method results in a higher classification accuracy than both conventional training with a denoising network and previous adversarial training methods. They also indicate that training with the HAT method results in average improvements in robustness of 0.84%, 27.33%, 28.99%, and 17.61% against adversarial attacks compared with several state-of-the-art adversarial training methods on the MNIST, CIFAR-10, CIFAR-100, and GTSRB datasets, respectively. Thus, the proposed HAT method results in improved robustness for DNNs against a wider range of adversarial attacks.

Deep neural networks (DNNs) have become increasingly effective in difficult machine learning tasks, such as image classification, speech recognition, and natural language processing. Face recognition (FR) using DNNs shows high performance and is widely used in various domains such as payment systems and immigration inspection. However, DNNs are vulnerable to adversarial examples generated by adding a small amount of noise to an original sample, resulting in misclassification by the DNNs. In this study, we attempt to deceive state-of-the-art FR by attaching noise markers on a face in the real world. To deceive an FR model in the real world, we address challenges in the attack process, including selection of locations of noise markers, the differences between colors of digital noise markers and those of noise markers after printing, the differences between the colors of noise markers that are attached to the face and those of noise markers after a picture is taken, and the differences between the locations of digital noise markers and those of noise markers that are attached to the face. In experiments, we generate noise markers considering these challenges and show that state-of-the-art FR can be deceived by attaching a maximum of 10 noise markers to a face. This can cause a security risk for FR models using DNNs.