《電子技術(shù)應(yīng)用》
您所在的位置:首頁(yè) > 其他 > 設(shè)計(jì)應(yīng)用 > 從頻域角度重新分析對(duì)抗樣本
從頻域角度重新分析對(duì)抗樣本
信息技術(shù)與網(wǎng)絡(luò)安全 5期
丁 燁1,,王 杰1,,宛 齊1,,廖 清2
(1.東莞理工學(xué)院 網(wǎng)絡(luò)空間安全學(xué)院,廣東 東莞523820,; 2.哈爾濱工業(yè)大學(xué)(深圳) 計(jì)算機(jī)科學(xué)與技術(shù)學(xué)院,廣東 深圳518055)
摘要: 目前在空間域上關(guān)于對(duì)抗樣本的研究成果已經(jīng)相當(dāng)成熟,但是在頻域上的相關(guān)工作卻是十分缺乏,。從頻域的角度對(duì)對(duì)抗樣本進(jìn)行深入的研究,,發(fā)現(xiàn)對(duì)抗樣本在DCT域上表現(xiàn)出了高度可識(shí)別的偽影,并利用這些偽影信息訓(xùn)練了一個(gè)基于頻域的對(duì)抗樣本檢測(cè)器CNN-DCT,,結(jié)果表明,,對(duì)于常見的對(duì)抗樣本在數(shù)據(jù)集CIFAR-10和SVHN上都能達(dá)到98%的檢測(cè)準(zhǔn)確率。此外,,針對(duì)對(duì)抗樣本在頻域上存在的偽影,,也提出一種通用的改進(jìn)算法IAA-DCT來(lái)解決。簡(jiǎn)而言之,,本文不僅填充了對(duì)抗樣本在頻域上工作的缺少,,也改進(jìn)了對(duì)抗攻擊算法在頻域上存在偽影的弊端。
中圖分類號(hào): TP391
文獻(xiàn)標(biāo)識(shí)碼: A
DOI: 10.19358/j.issn.2096-5133.2022.05.009
引用格式: 丁燁,,王杰,,宛齊,等. 從頻域角度重新分析對(duì)抗樣本[J].信息技術(shù)與網(wǎng)絡(luò)安全,,2022,,41(5):59-65,76.
Analysis of adversarial examples from frequency domain
Ding Ye1,,Wang Jie1,,Wan Qi1,Liao Qing2
(1.School of Cyberspace Security,,Dongguan University of Technology,,Dongguan 523820,China,; 2.School of Computer Science and Technology,,Harbin Institute of Technology(Shenzhen),Shenzhen 518055,,China)
Abstract: Research on adversarial examples in spatial domain is well studied, but related works in frequency domain is scarce. In this paper, we conduct thorough study of adversarial examples in frequency domain and find that adversarial examples exhibit highly identifiable artifacts in Discrete cosine transform(DCT) domain. Hence, a frequency domain-based adversarial example detector, CNN-DCT, is trained based on such artifact information, and the results achieve 98% detection accuracy for common adversarial examples on both CIFAR-10 and SVHN datasets. In addition, a general improved algorithm, IAA-DCT, is also proposed to address the artifacts that exist in the frequency domain for the adversarial examples. In conclusion, this paper not only provides studies of adversarial examples in frequency domain, but also improves the disadvantages of the adversarial attack algorithm with artifacts in the frequency domain.
Key words : adversarial example,;frequency domain;discrete cosine transform(DCT) domain,;adversarial attack

0 引言

對(duì)抗攻擊通過在深度學(xué)習(xí)模型中加入人類視覺上無(wú)法察覺的擾動(dòng),,被稱為對(duì)抗樣本[1]。對(duì)抗樣本可以使模型受到干擾而產(chǎn)生錯(cuò)誤的分類,,從而導(dǎo)致錯(cuò)誤類別的置信度大于正確類別的置信度,。隨著深度學(xué)習(xí)在不同的任務(wù)上取得優(yōu)異性能,如人臉識(shí)別,、自動(dòng)駕駛,、會(huì)議記錄等,對(duì)人類社會(huì)進(jìn)步帶來(lái)了巨大的貢獻(xiàn)。然而在許多的研究工作中,,對(duì)抗攻擊被證明可以在圖像,、視頻、語(yǔ)音等領(lǐng)域的深度學(xué)習(xí)中執(zhí)行惡意任務(wù),,從而造成重大的安全問題,。

為了解決對(duì)抗攻擊帶來(lái)的影響,避免這種惡意的攻擊,,研究者們開始了對(duì)對(duì)抗攻擊的防御工作,。對(duì)抗防御主要分為兩個(gè)方面,一個(gè)方面是直接改進(jìn)模型而讓現(xiàn)有的對(duì)抗攻擊方法失效,,如防御性蒸餾[2],。另外一個(gè)方面是進(jìn)行對(duì)抗樣本的檢測(cè)。關(guān)于對(duì)抗檢測(cè)的研究主要集中在圖像域中對(duì)圖片特征處理,,如Xu等人[3]提出了一種基于特征壓縮的對(duì)抗樣本檢測(cè)方法,;Joel等人[4]在頻譜上綜合分析了現(xiàn)有的攻擊方法和數(shù)據(jù)集,發(fā)現(xiàn)大部分的對(duì)抗樣本在頻域都出現(xiàn)了嚴(yán)重的偽影,,并且在頻域空間這些偽影數(shù)據(jù)可以分離,,從而能夠分類識(shí)別。



本文詳細(xì)內(nèi)容請(qǐng)下載:http://forexkbc.com/resource/share/2000004248





作者信息:

丁  燁1,,王  杰1,,宛  齊1,廖  清2

(1.東莞理工學(xué)院 網(wǎng)絡(luò)空間安全學(xué)院,,廣東 東莞523820,;

2.哈爾濱工業(yè)大學(xué)(深圳) 計(jì)算機(jī)科學(xué)與技術(shù)學(xué)院,廣東 深圳518055)


此內(nèi)容為AET網(wǎng)站原創(chuàng),,未經(jīng)授權(quán)禁止轉(zhuǎn)載,。