Turning Swords into Shields: Defense Against Adversarial Examples by Using Trojan Attacks

Deep neural networks (DNNs) are inherently vulnerable to adversarial examples, which present significant challenges for their reliable deployment in safety-critical applications. Although several defense strategies have been proposed to mitigate this vulnerability, their effectiveness is frequently undermined by white-box attacks, where adversaries exploit detailed knowledge of the underlying defense mechanisms. In this paper, we propose SNARE, a novel defense mechanism designed to effectively mitigate the impact of white-box adversaries. Instead of merely masking the inherent vulnerabilities of DNNs, SNARE strategically introduces intentionally introduced vulnerabilities, thereby guiding attackers toward predictable attack patterns that can be effectively mitigated. By embedding a plug-and-play module into the target model, SNARE deliberately engineers vulnerabilities that serve as decoys, directing adversaries to produce adversarial examples with specific characteristics. These features show discernible patterns that are consistently detectable, thereby enabling accurate identification of adversarial examples. The module can be seamlessly integrated into different model architectures without altering their essential functionality. Experimental results demonstrate that SNARE surpasses existing state-of-the-art defense techniques across numerous benchmarks.