| 本文已被：浏览 1774次 下载 3242次 |
码上扫一扫！ |
|
|
| 基于生成对抗网络的目标检测黑盒迁移攻击算法 |
|
陆宇轩1, 刘泽禹2, 罗咏刚3, 邓森友1, 江天3, 马金燕3, 董胤蓬1,2
|
|
1.北京瑞莱智慧科技有限公司, 北京 100089;2.清华大学 计算机科学与技术系, 北京 100084;3.重庆长安汽车软件科技有限公司, 重庆 400021
|
|
| 摘要: |
| 目标检测被广泛应用到自动驾驶、工业、医疗等各个领域. 利用目标检测算法解决不同领域中的关键任务逐渐成为主流. 然而基于深度学习的目标检测模型在对抗样本攻击下, 模型的鲁棒性存在严重不足, 通过加入微小扰动构造的对抗样本很容易使模型预测出错. 这极大地限制了目标检测模型在关键安全领域的应用. 在实际应用中的模型普遍是黑盒模型, 现有的针对目标检测模型的黑盒攻击相关研究不足, 存在鲁棒性评测不全面, 黑盒攻击成功率较低, 攻击消耗资源较高等问题. 针对上述问题, 提出基于生成对抗网络的目标检测黑盒攻击算法, 所提算法利用融合注意力机制的生成网络直接输出对抗扰动, 并使用替代模型的损失和所提的类别注意力损失共同优化生成网络参数, 可以支持定向攻击和消失攻击两种场景. 在Pascal VOC数据集和MS COCO数据集上的实验结果表明, 所提方法比目前攻击方法的黑盒迁移攻击成功率更高, 并且可以在不同数据集之间进行迁移攻击. |
| 关键词: 对抗攻击 目标检测 黑盒迁移攻击 生成对抗网络 注意力损失 |
| DOI：10.13328/j.cnki.jos.006937 |
| 分类号:TP391 |
| 基金项目: |
|
| Black-box Transferable Attack Method for Object Detection Based on GAN |
|
LU Yu-Xuan1, LIU Ze-Yu2, LUO Yong-Gang3, DENG Sen-You1, JIANG Tian3, MA Jin-Yan3, DONG Yin-Peng1,2
|
|
1.Beijing RealAI Intelligent Technology Co. Ltd., Beijing 100089, China;2.Department of Computer Science and Technology, Tsinghua University, Beijing 100084, China;3.Chongqing Changan Automobile Software Technology Co. Ltd., Chongqing 400021, China
|
| Abstract: |
| Object detection is widely used in various fields such as autonomous driving, industry, and medical care. Using the object detection algorithm to solve key tasks in different fields has gradually become the main method. However, the robustness of the object detection model based on deep learning is seriously insufficient under the attack of adversarial samples. It is easy to make the model prediction wrong by adding the adversarial samples constructed by small perturbations, which greatly limits the application of the object detection model in key security fields. In practical applications, the models are black-box models. Related research on black-box attacks against object detection models is relatively lacking, and there are many problems such as incomplete robustness evaluation, low attack success rate of black-box, and high resource consumption. To address the aforementioned issues, this study proposes a black-box object detection attack algorithm based on a generative adversarial network. The algorithm uses the generative network fused with an attention mechanism to output the adversarial perturbations and employs the alternative model loss and the category attention loss to optimize the generated network parameters, which can support two scenarios of target attack and vanish attack. A large number of experiments are conducted on the Pascal VOC and the MSCOCO datasets. The results demonstrate that the proposed method has a higher black-box transferable attack success rate and can perform transferable attacks between different datasets. |
| Key words: adversarial attack object detection black-box transferable attack generative adversarial network (GAN) attention loss |
