浏览全部资源
扫码关注微信
Received：30 May 2022，
Revised：16 September 2022，
Accepted：23 September 2022，
Published：16 March 2023
移动端阅览
目的
2
对抗样本严重干扰了深度神经网络的正常工作。现有的对抗样本检测方案虽然能准确区分正常样本与对抗样本，但是无法判断具体的对抗攻击方法。对此，提出一种基于多质量因子压缩误差的对抗样本攻击方法识别方案，利用对抗噪声对JPEG压缩的敏感性实现攻击方法的识别。
方法
2
首先使用卷积层模拟JPEG压缩、解压缩过程中的颜色转换和空频域变换，实现JPEG误差在图形处理器(graphic processing unit，GPU)上的并行提取。提出多因子误差注意力机制，在计算多个质量因子压缩误差的同时，依据样本差异自适应调整各质量因子误差分支的权重。以特征统计层为基础提出注意力特征统计层。多因子误差分支的输出经融合卷积后，获取卷积层多维特征的同时计算特征权重，从而形成高并行对抗攻击方法识别模型。
结果
2
本文以ImageNet图像分类数据集为基础，使用8种攻击方法生成了15个子数据集，攻击方法识别率在91%以上；在快速梯度符号法(fast gradient sign method，FGSM)和基本迭代法(basic iterative method，BIM)数据集上，噪声强度识别成功率超过96%；在对抗样本检测任务中，检测准确率达到96%。
结论
2
所提出的多因子误差注意力模型综合利用了对抗噪声的分布差异及其对JPEG压缩的敏感性，不仅取得了优异的对抗攻击方法识别效果，而且对于对抗噪声强度识别、对抗样本检测等任务有着优越表现。
Objective
2
Artificial intelligence (AI) technique based deep neural networks (DNNs) have facilitated image classification and human-facial recognition intensively. However
recent studies have shown that DNNs is vulunerable to small changes for input images. However
DNN-misclassified is caused derived of injecting small adversarial noise into the input sample
such an artificially designed anomalous example
called an adversarial example. Recent detection of adversarial examples can be used to get higher accuracy. But
to determine the level of deep neural network security and implement targeted defense strategies
the classification of attack methods is required to be developed further. The adversarial examples mainly consist two categories: 1) white-box and 2) black-box attacks. A white-box attack is oriented for all information about the target neural network-prior. The attacker can obtain information about the gradient of the loss function of the example and query the output of the target neural network and other information. A black-box attack concerns that the attacker can query the input and output information of the target neural network only. The white-box attack method is mainly implemented by querying the gradient of the network. Black-box attacks are mainly divided into two approaches: 1) bounded query and 2) gradient estimation. It is still challenged for the adversarial attack method used by attackers although existing adversarial example detection schemes can distinguish adversarial examples from natural ones accurately. JPEG compression is a commonly used lossy compression method for images processing. Its compression and decompression process can be linked to errors in relevant to truncation
rounding
color space conversion
as well as quantization. To deal with the heterogeneity for compression
the quantization step uses different quantization tables and a large variation is produced in the magnitude of the error.
Method
2
To classify adversarial examples' generation methods
we develop a multi-factor error attention model. To classify examples from multiple attack methods
the JPEG errors are injected into a neural network. To achieve parallel extraction of JPEG errors on graphic processing unit (GPU)
JPEG compression and decompression processes are simulated in terms of DNN components. Multiple error branches are employed to alleviate multiple attempts of quality factors. A multi-factor error attention mechanism is proposed
which can balance the multisample-differentiated weights of each quality factor error branch. The feature statistical layer is used to calculate the high-dimensional feature vectors of the feature map. An attention mechanism is added to the feature statistical layer
and a attention-based feature statistical layer is proposed. The attention mechanism is beneficial for the feature values to adaptively modify the ratio between them. The peak-convolutional layer-derived feature map output is fed to the attention-based feature statistical layer for each channel. To optimize an efficient model for classifying adversarial examples' generation methods
the output of the multi-factor error branches is fused and sent into convolutional layers
then input into the attention-related feature statistical layer.
Result
2
We develop 15 ImageNet image classification dataset-based sub-datasets in terms of 8 popular attack methods. The fast gradient sign method (FGSM) and basic iterative method (BIM)-generated adversarial examples are composed of 4 sub-datasets of perturbation coefficients of 2
4
6
and 8. The Bandits-based adversarial examples are organized by two sub-datasets of versions L
2
and L
∞
. Each sub-dataset is involved of 10 000 training examples and 2 000 test examples. The overall dataset consists of 15 sub-datasets
the attack method recognition rate is above 91%. The accuracy of noise intensity detection is above 96% on the FGSM and BIM datasets. In the adversarial sample detection task
the detection accuracy reaches 96%. The experiments show that the multi-factor feature attention network can not only classify adversarial attack methods in high accuracy
but also has its potentials for noise intensity recognition and adversarial examples' detection tasks. The comparative analysis demonstrate that our model proposed is not significantly degraded from existing schemes for the adversarial example detection task.
Conclusion
2
A multi-factor error attention model is developed for adversarial example classification. Our initial is dominated to the JPEG errors-aided for adversarial sample detection. The proposed model can simplify the extraction of JPEG compression-decompression errors and puts them on the GPU for parallel extraction. The error branch attention mechanism can be used to balance the weights adaptively between the error branches. The attention-linked feature statistical layer enriches the feature types and balances them adaptively.
Akhtar N and Mian A. 2018. Threat of adversarial attacks on deep learning in computer vision: a survey. IEEE Access, 6: 14410-14430 [DOI: 10.1109/ACCESS.2018.2807385]
Brendel W, Rauber J and Bethge M. 2018. Decision-based adversarial attacks: reliable attacks against black-box machine learning models//Proceedings of the 6th International Conference on Learning Representations. Vancouver, Canada: OpenReview. net
Brendel W, Rauber J, Kümmerer M, Ustyuzhaninov I and Bethge M. 2019. Accurate, reliable and fast robustness evaluation//Proceedings of the 33rd International Conference on Neural Information Processing Systems. Vancouver, Canada: [s. n.]: 1152
Carlini N and Wagner D. 2017. Towards evaluating the robustness of neural networks//2017 IEEE Symposium on Security and Privacy (SP). San Jose, USA: IEEE: 39-57 [ DOI: 10.1109/SP.2017.49 http://dx.doi.org/10.1109/SP.2017.49 ]
Carrara B, Becarelli R, Caldelli R, Falchi F and Amato G. 2019. Adversarial examples detection in features distance spaces//Proceedings of 2019 European Conference on Computer Vision (ECCV). Munich, Germany: Springer: 313-327 [ DOI: 10.1007/978-3-030-11012-3_26 http://dx.doi.org/10.1007/978-3-030-11012-3_26 ]
Chen H B, Zhao L, Zhang H M, Wang Z Z, Zuo Z W, Li A L, Xing W and Lu D M. 2021. Diverse image style transfer via invertible cross-space mapping//Proceedings of 2021 IEEE/CVF International Conference on Computer Vision (ICCV). Montreal, Canada: IEEE: 6363-6372 [ DOI: 10.1109/ICCV48922.2021.01461 http://dx.doi.org/10.1109/ICCV48922.2021.01461 ]
Feinman R, Curtin R R, Shintre S and Gardner A B. 2017. Detecting adversarial samples from artifacts [EB/OL]. [2022-05-30] . https://arxiv.org/pdf/1703.00410.pdf https://arxiv.org/pdf/1703.00410.pdf
Fridrich J and Kodovsky J. 2012. Rich models for steganalysis of digital images. IEEE Transactions on Information Forensics and Security, 7(3): 868-882 [DOI: 10.1109/TIFS.2012.2190402]
Gao S H, Cheng M M, Zhao K, Zhang X Y, Yang M H and Torr P. 2021. Res2 Net: a new multi-scale backbone architecture. IEEE Transactions on Pattern Analysis and Machine Intelligence, 43(2): 652-662 [DOI: 10.1109/TPAMI.2019.2938758]
Goodfellow I J, Shlens J and Szegedy C. 2015. Explaining and harnessing adversarial examples//Proceedings of the 3rd International Conference on Learning Representations. San Diego, USA: [s. n.]
Grosse K, Manoharan P, Papernot N, Backes M and McDaniel P. 2017. On the (statistical) detection of adversarial examples [EB/OL]. [2022-05-30] . https://arxiv.org/pdf/1702.06280v2.pdf https://arxiv.org/pdf/1702.06280v2.pdf
Hu J, Shen L and Sun G. 2018. Squeeze-and-excitation networks//Proceedings of 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Salt Lake City, USA: IEEE: 7132-7141 [ DOI: 10.1109/CVPR.2018.00745 http://dx.doi.org/10.1109/CVPR.2018.00745 ]
Hu L Q, Kan M N, Shan S G and Chen X L. 2022. Large pose face recognition with morphing field learning. Journal of Image and Graphics, 27(7): 2171-2184
胡蓝青, 阚美娜, 山世光, 陈熙霖. 2022. 面向大姿态人脸识别的正面化形变场学习. 中国图象图形学报, 27(7): 2171-2184 [DOI: 10.11834/jig.210011]
Ilyas A, Engstrom L and Madry A. 2019. Prior convictions: black-box adversarial attacks with bandits and priors//Proceedings of the 7th International Conference on Learning Representations. New Orleans, USA: OpenReview. net
Jaderberg M, Simonyan K, Zisserman A and Kavukcuoglu K. 2015. Spatial transformer networks//Proceedings of the 28th International Conference on Neural Information Processing Systems. Montreal, Canada: MIT Press: 2017-2025
Kurakin A, Goodfellow I J and Bengio S. 2017. Adversarial examples in the physical world//Proceedings of the 5th International Conference on Learning Representations. Toulon, France: OpenReview. net
Li X and Li F X. 2017. Adversarial examples detection in deep networks with convolutional filter statistics//Proceedings of 2017 IEEE International Conference on Computer Vision (ICCV). Venice, Italy: IEEE: 5775-5783 [ DOI: 10.1109/ICCV.2017.615 http://dx.doi.org/10.1109/ICCV.2017.615 ]
Lin M, Chen Q and Yan S C. 2014. Network in network [EB/OL]. [2022-05-30] . https://arxiv.org/pdf/1312.4400v3.pdf https://arxiv.org/pdf/1312.4400v3.pdf
Liu J Y, Zhang W M, Zhang Y W, Hou D D, Liu Y J, Zha H Y and Yu N H. 2019. Detection based defense against adversarial examples from the steganalysis point of view//Proceedings of 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). Long Beach, USA: IEEE: 4820-4829 [ DOI: 10.1109/CVPR.2019.00496 http://dx.doi.org/10.1109/CVPR.2019.00496 ]
Madry A, Makelov A, Schmidt L, Tsipras D and Vladu A. 2018. Towards deep learning models resistant to adversarial attacks//Proceedings of the 6th International Conference on Learning Representations. Vancouver, Canada: OpenReview. net
Moosavi-Dezfooli S M, Fawzi A and Frossard P. 2016. DeepFool: a simple and accurate method to fool deep neural networks//2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR). Las Vegas, USA: IEEE: 2574-2582 [ DOI: 10.1109/CVPR.2016.282 http://dx.doi.org/10.1109/CVPR.2016.282 ]
Papernot N, McDaniel P, Wu X, Jha S and Swami A. 2016. Distillation as a defense to adversarial perturbations against deep neural networks//Proceedings of 2016 IEEE Symposium on Security and Privacy (SP). San Jose, USA: IEEE: 582-597 [ DOI: 10.1109/SP.2016.41 http://dx.doi.org/10.1109/SP.2016.41 ]
Rony J, Hafemann L G, Oliveira L S, Ayed I B, Sabourin R and Granger E. 2019. Decoupling direction and norm for efficient gradient-based L 2 adversarial attacks and defenses//Proceedings of 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). Long Beach, USA: IEEE: 4317-4325 [ DOI: 10.1109/CVPR.2019.00445 http://dx.doi.org/10.1109/CVPR.2019.00445 ].
Schöttle P, Schlögl A, Pasquini C and Böhme R. 2018. Detecting adversarial examples——a lesson from multimedia security//Proceedings of the 26th European Signal Processing Conference (EUSIPCO). Rome, Italy: IEEE: 947-951 [ DOI: 10.23919/EUSIPCO.2018.8553164 http://dx.doi.org/10.23919/EUSIPCO.2018.8553164 ]
Simonyan K and Zisserman A. 2015. Very deep convolutional networks for large-scale image recognition//Proceedings of the 3rd International Conference on Learning Representations. San Diego, USA: [s. n.]
Wang J W, Wang H, Li J, Luo X Y, Shi Y Q and Jha S K. 2020. Detecting double JPEG compressed color images with the same quantization matrix in spherical coordinates. IEEE Transactions on Circuits and Systems for Video Technology, 30(8): 2736-2749 [DOI: 10.1109/TCSVT.2019.2922309]
Wang J W, Zhao J J, Yin Q L, Luo X Y, Zheng Y H, Shi Y Q and Jha S K. 2022. SmsNet: a new deep convolutional neural network model for adversarial example detection. IEEE Transactions on Multimedia,24: 230-244 [DOI: 10.1109/TMM.2021.3050057]
Woo S, Park J, Lee J Y and Kweon I S. 2018. CBAM: convolutional block attention module//Proceedings of the 15th European Conference on Computer Vision (ECCV). Munich, Germany: Springer: 3-19 [ DOI: 10.1007/978-3-030-01234-2_1 http://dx.doi.org/10.1007/978-3-030-01234-2_1 ]
Zhang Y, Luo X Y, Wang J W, Lu W, Yang C F and Liu F L. 2022. Research progress on digital image robust steganography. Journal of Image and Graphics, 27(1): 3-26
张祎, 罗向阳, 王金伟, 卢伟, 杨春芳, 刘粉林. 2022. 数字图像鲁棒隐写综述. 中国图象图形学报, 27(1): 3-26 [DOI: 10.11834/jig.210449]
Zhao J J and Wang J W. 2021. Lightweight DCT-like domain forensics model for adversarial example//Proceedings of the 19th International Workshop on Digital Watermarking. Melbourne, Australia: Springer: 265-279 [ DOI: 10.1007/978-3-030-69449-4_20 http://dx.doi.org/10.1007/978-3-030-69449-4_20 ]
Zou J H, Duan Y X, Ren C L, Qiu J Y, Zhou X Y and Pan Z S. 2022. Perturbation initialization, adam-nesterov and quasi-hyperbolic momentum for adversarial examples. Acta Electronica Sinica, 50(1): 207-216
邹军华, 段晔鑫, 任传伦, 邱俊洋, 周星宇, 潘志松. 2022. 基于噪声初始化、Adam-Nesterov方法和准双曲动量方法的对抗样本生成方法. 电子学报, 50(1): 207-216 [DOI: 10.12263/DZXB.20200839]
相关文章
相关作者
相关机构
京公网安备11010802024621