Adversarial Attacks and Defense on an Aircraft Classification Model Using a Generative Adversarial Network

As artificial intelligence becomes increasingly popular, so too does the frequency it is attacked. One area where artificial intelligence models are being embraced heavily is avionics, where it is used in a variety of areas including intrusion detection, surveillance, radar, navigation, and more. These networks are vulnerable to a number of attacks, one of which being the adversarial attack. Adversarial attacks aim to perturb the input to the image classification model, which can lead to output misclassifications, lowering the overall model accuracy. This paper will demonstrate how such an attack can lower the accuracy of a convolutional neural network (CNN) trained on an aircraft image dataset. The perturbed inputs will be generated by a generative adversarial network (GAN) trained on the same dataset as the CNN. GANs consist of two neural networks, a generator and a discriminator. The generator will continually create new images based off of the dataset, while the discriminator decides whether or not the image is generated or from the reference dataset. This forms a feedback loop, where the generator continues to improve based on the output of the discriminator. Once trained, the outputs of the GAN will be used to misclassify the trained CNN in an attempt to lower the model's accuracy. Following this, adversarial defenses such as feature squeezing and random smoothing will be discussed. These defenses attempt to mitigate the damage done by an attack, usually by adapting the model, modifying the input, or modifying the data the model is trained on. This can cause the accuracy of the model to slightly fall from its original accuracy, but with the benefit of being more resilient to adversarial attacks. We analyze this tradeoff and highlight the advantages of adversarial training in learning-enabled avionics systems.