[4I2-GS-11] AI and Society:

[4I2-GS-11-02] An Attempt to Rectify Adversarial Examples by Re-attacking Using Japanese Character Type Conversion

〇Kazuki Akimoto¹, Hiiro Uchiyama¹, Fumiya Morimoto¹, Satoshi Ono¹ (1. Kagoshima University)

[[Online]]

Keywords:DNN, NLP, Adversarial Examples, Adversarial Defense

Deep neural networks (DNNs) have made remarkable progress in a wide range of fields such as image processing, speech recognition, and natural language processing, and their high performance has led to various applications. On the other hand, recent studies have revealed that DNNs are vulnerable to misrecognition of Adversarial Examples (AEs), an input sample that has been maliciously modified. DNNs for Japanese language processing also have similar vulnerabilities, and such vulnerabilities can be a serious obstacle to applying DNNs to real-world problems. Currently, there has been insufficient research on adversary defense against DNNs for Japanese language processing, and as far as the authors have been able to determine, there has been no research on defense methods that take advantage of the characteristics of the Japanese language. This study proposes an adversarial defense method using re-attack, aiming to improve the robustness of Japanese processing models against AEs. The proposed method corrects the classification results of AEs without distinguishing between benign samples and AEs. The proposed method employs conversion between character types unique to Japanese. Experiments confirmed that the proposed method can rectify the classification results of AEs while maintaining the accuracy of benign samples.