  This study developed a generative adversarial network (GAN)-based defense
method for traffic sign classification in an autonomous vehicle (AV), referred
to as the attack-resilient GAN (AR-GAN). The novelty of the AR-GAN lies in (i)
assuming zero knowledge of adversarial attack models and samples and (ii)
providing consistently high traffic sign classification performance under
various adversarial attack types. The AR-GAN classification system consists of
a generator that denoises an image by reconstruction, and a classifier that
classifies the reconstructed image. The authors have tested the AR-GAN under
no-attack and under various adversarial attacks, such as Fast Gradient Sign
Method (FGSM), DeepFool, Carlini and Wagner (C&W), and Projected Gradient
Descent (PGD). The authors considered two forms of these attacks, i.e., (i)
black-box attacks (assuming the attackers possess no prior knowledge of the
classifier), and (ii) white-box attacks (assuming the attackers possess full
knowledge of the classifier). The classification performance of the AR-GAN was
compared with several benchmark adversarial defense methods. The results showed
that both the AR-GAN and the benchmark defense methods are resilient against
black-box attacks and could achieve similar classification performance to that
of the unperturbed images. However, for all the white-box attacks considered in
this study, the AR-GAN method outperformed the benchmark defense methods. In
addition, the AR-GAN was able to maintain its high classification performance
under varied white-box adversarial perturbation magnitudes, whereas the
performance of the other defense methods dropped abruptly at increased
perturbation magnitudes.
