一种基于进化策略和注意力机制的黑盒对抗攻击算法
作者:
作者单位:

作者简介:

黄立峰(1990-),男,博士生,CCF学生会员,主要研究领域为对抗学习,自主感知定位.
廖泳贤(1996-),女,硕士生,主要研究领域为对抗训练,计算机视觉.
庄文梓(1997-),男,硕士生,主要研究领域为对抗训练,计算机视觉.
刘宁(1973-),男,博士,教授,博士生导师,CCF专业会员,主要研究领域为对抗学习,自主感知定位.

通讯作者:

刘宁,E-mail:liuning2@mail.sysu.edu.cn

中图分类号:

TP18

基金项目:

国家自然科学基金(61772567);中央高校基本科研业务费专项资金(19lgjc11)


Black-box Adversarial Attack Method Based on Evolution Strategy and Attention Mechanism
Author:
Affiliation:

Fund Project:

National Natural Science Foundation of China (61772567); Fundamental Research Funds for the Central Universities (19lgjc11)

  • 摘要
  • |
  • 图/表
  • |
  • 访问统计
  • |
  • 参考文献
  • |
  • 相似文献
  • |
  • 引证文献
  • |
  • 资源附件
  • |
  • 文章评论
    摘要:

    深度神经网络在许多计算机视觉任务中都取得了优异的结果,并在不同领域中得到了广泛应用.然而研究发现,在面临对抗样本攻击时,深度神经网络表现得较为脆弱,严重威胁着各类系统的安全性.在现有的对抗样本攻击中,由于黑盒攻击具有模型不可知性质和查询限制等约束,更接近实际的攻击场景.但现有的黑盒攻击方法存在攻击效率较低与隐蔽性弱的缺陷,因此提出了一种基于进化策略的黑盒对抗攻击方法.该方法充分考虑了攻击过程中梯度更新方向的分布关系,自适应学习较优的搜索路径,提升攻击的效率.在成功攻击的基础上,结合注意力机制,基于类间激活热力图将扰动向量分组和压缩优化,减少在黑盒攻击过程中积累的冗余扰动,增强优化后的对抗样本的不可感知性.通过与其他4种最新的黑盒对抗攻击方法(AutoZOOM、QL-attack、FD-attak、D-based attack)在7种深度神经网络上进行对比,验证了该方法的有效性与鲁棒性.

    Abstract:

    Since deep neural networks (DNNs) have provided state-of-the-art results for different computer vision tasks, they are utilized as the basic backbones to be employed in many domains. Nevertheless, DNNs have been demonstrated to be vulnerable to adversarial attacks in recent researches, which will threaten the security of different DNN-based systems. Compared with white-box adversarial attacks, black-box attacks are more similar to the realistic scenarios under the constraints like lacking knowledge of model and limited queries. However, existing methods under black-box scenarios not only require a large amount of model queries, but also are perceptible from human vision system. To address these issues, this study proposes a novel method based on evolution strategy, which improves the attack performance by considering the inherent distribution of updated gradient direction. It helps the proposed method in sampling effective solutions with higher probabilities as well as learning better searching paths. In order to make generated adversarial example less perceptible and reduce the redundant perturbations after a successful attacking, the proposed method utilizes class activation mapping to group the perturbations by introducing the attention mechanism, and then compresses the noise group by group while ensure that the generated images can still fool the target model. Extensive experiments on seven DNNs with different structures suggest the superiority of the proposed method compared with the state-of-the-art black-box adversarial attack approaches (i.e., AutoZOOM, QL-attack, FD-attack, and D-based attack).

    参考文献
    相似文献
    引证文献
引用本文

黄立峰,庄文梓,廖泳贤,刘宁.一种基于进化策略和注意力机制的黑盒对抗攻击算法.软件学报,2021,32(11):3512-3529

复制
分享
文章指标
  • 点击次数:
  • 下载次数:
  • HTML阅读次数:
  • 引用次数:
历史
  • 收稿日期:2019-09-29
  • 最后修改日期:2020-04-02
  • 录用日期:
  • 在线发布日期: 2021-11-05
  • 出版日期:
您是第位访问者
版权所有:中国科学院软件研究所 京ICP备05046678号-3
地址:北京市海淀区中关村南四街4号,邮政编码:100190
电话:010-62562563 传真:010-62562533 Email:jos@iscas.ac.cn
技术支持:北京勤云科技发展有限公司

京公网安备 11040202500063号