Adversarial patch defense algorithm based on PatchTracker

Zhenjie XIAO; Shiyu HUANG; Feng YE; Liqing HUANG; Tianqiang HUANG

doi:10.11959/j.issn.2096-109x.2024009

您当前的位置：

首页 >

文章列表页 >

Adversarial patch defense algorithm based on PatchTracker

Papers | 更新时间：2024-06-03

- Adversarial patch defense algorithm based on PatchTracker
- Chinese Journal of Network and Information Security Vol. 10, Issue 1, Pages: 169-180(2024)
- 作者机构：
  
  1. 福建师范大学计算机与网络空间安全学院，福建福州 350117
  2. 数字福建大数据安全技术研究所，福建福州 350117
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2024009
  CLC： TP393
- Online First：2024-02，
  
  Published：25 February 2024
- 稿件说明：
移动端阅览
Zhenjie XIAO, Shiyu HUANG, Feng YE, et al. Adversarial patch defense algorithm based on PatchTracker[J]. Chinese Journal of Network and Information Security, 2024, 10(1): 169-180.
DOI：

Zhenjie XIAO, Shiyu HUANG, Feng YE, et al. Adversarial patch defense algorithm based on PatchTracker[J]. Chinese Journal of Network and Information Security, 2024, 10(1): 169-180. DOI： 10.11959/j.issn.2096-109x.2024009.

摘要

基于深度神经网络的目标检测技术已经广泛应用于各领域，然而，通过对抗补丁攻击在图像中添加局部扰动，以此来误导深度神经网络，对基于目标检测技术的视觉系统构成了严重威胁。针对这一问题，利用对抗补丁和图像背景的语义差异性，提出了一种基于PatchTracker的对抗补丁防御算法，该算法由上游补丁检测器与下游数据增强模块组成。上游补丁检测器使用带有注意力机制的YOLOV5（you only look once-v5）确定对抗补丁所在位置，有助于提高对小尺度对抗补丁的检测精度；将检测区域用合适的像素值覆盖以抹除对抗补丁，上游补丁检测器不仅能够有效降低对抗样本的攻击性，而且不依赖大规模的训练数据；下游数据增强模块通过改进模型训练范式，提高下游目标检测器的鲁棒性；将抹除补丁后的图像输入经过数据增强的下游 YOLOV5 目标检测模型。在公开的 TT100K 交通标志数据集上进行了交叉验证，实验表明，与未采取防御措施相比，所提算法能够有效防御多种类型的通用对抗补丁攻击，在检测对抗补丁图像时的mAP（mean average precision）提高65%左右，有效地改善了小尺度对抗补丁的漏检情况。与现有算法比较，所提算法有效提高了神经网络在检测对抗样本时的准确率。此外，所提算法不涉及下游模型结构的修改，具有良好的兼容性。

Abstract

The application of deep neural networks in target detection has been widely adopted in various fields.However

the introduction of adversarial patch attacks

which add local perturbations to images to mislead deep neural networks

poses a significant threat to target detection systems based on vision techniques.To tackle this issue

an adversarial patch defense algorithm based on PatchTracker was proposed

leveraging the semantic differences between adversarial patches and image backgrounds.This algorithm comprised an upstream patch detector and a downstream data enhancement module.The upstream patch detector employed a YOLOV5 (you only look once-v5) model with attention mechanism to determine the locations of adversarial patches

thereby improving the detection accuracy of small-scale adversarial patches.Subsequently

the detected regions were covered with appropriate pixel values to remove the adversarial patches.This module effectively reduced the impact of adversarial examples without relying on extensive training data.The downstream data enhancement module enhanced the robustness of the target detector by modifying the model training paradigm.Finally

the image with removed patches was input into the downstream YOLOV5 target detection model

which had been enhanced through data augmentation.Cross-validation was performed on the public TT100K traffic sign dataset.Experimental results demonstrated that the proposed algorithm effectively defended against various types of generic adversarial patch attacks when compared to situations without defense measures.The algorithm improves the mean average precision (mAP) by approximately 65% when detecting adversarial patch images

effectively reducing the false negative rate of small-scale adversarial patches.Moreover

compared to existing algorithms

this approach significantly enhances the accuracy of neural networks in detecting adversarial samples.Additionally

the method exhibited excellent compatibility as it does not require modification of the downstream model structure.

关键词

Keywords

references

SZEGEDY C , ZAREMBA W , SUTSKEVER I , et al . Intriguing properties of neural networks [C ] // Proceedings of International Conference on Learning Representations (ICLR) . 2014 .

GOODFELLOW I J , SHLENS J , SZEGEDY C . Explaining and harnessing adversarial examples [C ] // Proceedings of International Conference on Learning Representations (ICLR) . 2015 .

ZHU L , WANG X , KE Z , et al . BiFormer:vision transformer with bi-level routing attention [C ] // Proceedings of Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . 2023 : 10323 - 10333 .

DEVRIES T , TAYLOR G W . Improved regularization of convolutional neural networks with cutout [J ] . arXiv preprint arXiv:1708.04552 , 2017 .

KURAKIN A , GOODFELLOW I J , BENGIO S . Adversarial examples in the physical world [C ] // Proceedings of International Conference on Learning Representations (ICLR) . 2017 .

MADRY A , MAKELOV A , SCHMIDT L , et al . Towards deep learning models resistant to adversarial attacks [C ] // Proceedings of International Conference on Learning Representations(ICLR) . 2018 .

DONG Y , LIAO F , PANG T , et al . Boosting adversarial attacks with momentum [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) . 2018 : 9185 - 9193 .

BROWN T B , MANÉ D , ROY A , et al . Adversarial patch [J ] . arXiv preprint arXiv:1712.09665 , 2017 .

KARMON D , ZORAN D , GOLDBERG Y . Lavan:Localized and visible adversarial noise [C ] // Proceedings of International Conference on Machine Learning (ICML) . 2018 : 3903 - 3911 .

EYKHOLT K , EVTIMOV I , FERNANDES E , et al . Robust physical-world attacks on deep learning visual classification [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) . 2018 : 1625 - 1634 .

YANG C , KORTYLEWSKI A , XIE C , et al . Patchattack:A black-box texture-based attack with reinforcement learning [C ] // Proceedings of European Conference on Computer Vision (ECCV) . 2020 : 681 - 698 .

SUBRAMANYA A , PILLAI V , PIRSIAVASH H . Fooling network interpretation in image classification [C ] // Proceedings of the IEEE/CVF International Conference on Computer Vision (CVPR) . 2019 : 2020 - 2029 .

SELVARAJU R R , COGSWELL M , DAS A , et al . Grad-CAM:Visual explanations from deep networks via gradient-based localization [C ] // Proceedings of the IEEE International Conference on Computer Vision (ICCV) . 2017 : 618 - 626 .

LIU X , YANG H , LIU Z , et al . Dpatch:An adversarial patch attack on object detectors [C ] // 2019 . AAAI Workshop on Artificial Intelligence Safety (SafeAI) , 2019 .

LEE M , KOLTER Z . On physical adversarial patches for object detection [J ] . arXiv preprint arXiv:1906.11897 , 2019 .

WU S , DAI T , XIA S T . DPAttack:Diffused patch attacks against universal object detection [J ] . arXiv preprint arXiv:2010.11679 , 2020 .

HUANG H , WANG Y , CHEN Z , et al . RPAttack:Refined patch attack on general object detectors [C ] // Proceedings of 2021 IEEE International Conference on Multimedia and Expo (ICME) . 2021 : 1 - 6 .

ZHAO Y , YAN H , WEI X . Object hider:Adversarial patch attack against object detectors [C ] // Proceedings of Conference on Information and Knowledge Management (CIKM) . 2020 : 28 - 31 .

SHARIF M , BHAGAVATULA S , BAUER L , et al . Accessorize to a crime:Real and stealthy attacks on state-of-the-art face recognition [C ] // Proceedings of the 2016 ACM Sigsac Conference on Computer and Communications Security . 2016 : 1528 - 1540 .

YANG X , WEI F , ZHANG H , et al . Design and interpretation of universal adversarial patches in face detection [C ] // Proceedings of European Conference on Computer Vision (ECCV) . 2020 : 174 - 191 .

THYS S , VAN RANST W , GOEDEMÉ T . Fooling automated surveillance cameras:adversarial patches to attack person detection [C ] // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) . 2019 : 49 - 55 .

HU Y C T , KUNG B H , TAN D S , et al . Naturalistic physical adversarial patch for object detectors [C ] // Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) . 2021 : 7848 - 7857 .

HUANG H , CHEN Z , CHEN H , et al . T-SEA:Transfer-based self-ensemble attack on object detection [C ] // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . 2023 : 20514 - 20523 .

NASEER M , KHAN S , PORIKLI F . Local gradients smoothing:Defense against localized adversarial attacks [C ] // Proceedings of 2019 IEEE Winter Conference on Applications of Computer Vision (WACV) . 2019 : 1300 - 1307 .

HAYES J . On visible adversarial perturbations ＆ digital watermarking [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) . 2018 : 1597 - 1604 .

CHOU E , TRAMER F , PELLEGRINO G . SentiNet:Detecting localized universal attacks against deep learning systems [C ] // Proceedings of 2020 IEEE Security and Privacy Workshops (SPW) . 2020 : 48 - 54 .

XIANG C , MAHLOUJIFAR S , MITTAL P . {PatchCleanser}:Certifiably robust defense against adversarial patches for any image classifier [C ] // Proceedings of 31st USENIX Security Symposium (USENIX Security 22) . 2022 : 2065 - 2082 .

LIU J , LEVINE A , LAU C P , et al . Segment and complete:Defending object detectors against adversarial patch attacks with robust patch detection [C ] // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . 2022 : 14973 - 14982 .

RAO S , STUTZ D , SCHIELE B . Adversarial training against location-adamized adversarial patches [C ] // Proceedings of European Conference on Computer Vision (ECCV) . 2020 : 429 - 448 .

JI N , FENG Y F , XIE H , et al . Adversarial yolo:Defense human detection patch attacks via detecting adversarial patches [J ] . arXiv preprint arXiv:2103.08860 , 2021 .

ZHANG Z , YUAN B , MCCOYD M , et al . Clipped bagnet:Defending against sticker attacks with clipped bag-of- features [C ] // Proceedings of 2020 IEEE Security and Privacy Workshops (SPW) . 2020 : 55 - 61 .

XIANG C , BHAGOJI A N , SEHWAG V , et al . {PatchGuard}:a provably robust defense against adversarial patches via small receptive fields and masking [C ] // Proceedings of 30th USENIX Security Symposium (USENIX Security 21) . 2021 : 2237 - 2254 .

KINGMA D P , BA J . Adam:A method for stochastic adamization [C ] // Proceedings of International Conference on Learning Representations (ICLR) . 2015 .

DZIUGAITE G K , GHAHRAMANI Z , ROY D M . A study of the effect of JPG compression on adversarial images [J ] . arXiv preprint arXiv:1608.00853 , 2016 .

TARCHOUN B , BEN KHALIFA A , MAHJOUB M A , et al . Jedi:entropy-based localization and removal of adversarial patches [C ] // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 2023 : 4087 - 4095 .

LIU J , LEVINE A , LAU C P , et al . Segment and complete:defending object detectors against adversarial patch attacks with robust patch detection [C ] // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 2022 : 14973 - 14982 .

Views

134

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Review on the safety of LIDAR-based point cloud object detection

Double adversarial attack against license plate recognition system

Adversarial attacks and defenses in deep learning

Related Author

XIANG Sheng

LIAO Danxin

CHEN Jinyin

ZHENG Haibin

Xianyi CHEN

Jun GU

Kai YAN

Dong JIANG

Related Institution

College of Information Engineering, Zhejiang University of Technology

Institute of Cyberspace Security, Zhejiang University of Technology

Engineering Research Center of Digital Forensics, Ministry of Education, Nanjing University of Information Science and Technology

The State Key Laboratory of Integrated Services Networks, Xidian University

College of Mathematics and Computer Science,Fuzhou University

⁰