Adversarial detection based on feature invariant in license plate recognition systems

ZHU Xiaoyu; TANG Peng; ZHANG Haochen; QIU Weidong; HUANG Zheng

doi:10.11959/j.issn.2096-109x.2024080

您当前的位置：

首页 >

文章列表页 >

Adversarial detection based on feature invariant in license plate recognition systems

Papers | 更新时间：2025-02-06

- Adversarial detection based on feature invariant in license plate recognition systems
- Chinese Journal of Network and Information Security Vol. 10, Issue 6, Pages: 59-70(2024)
- 作者机构：
  
  上海交通大学网络空间安全学院，上海 200240
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2024080
  CLC： TP393
- Received：20 January 2024，
  
  Revised：2024-03-19，
  
  Published：25 December 2024
- 稿件说明：
移动端阅览
朱孝羽, 唐鹏, 张浩臣, 等. 车牌识别系统中基于特征不变量的对抗检测[J]. 网络与信息安全学报, 2024, 10(6): 59-70.

ZHU X Y, TANG P, ZHANG H C, et al. Adversarial detection based on feature invariant in license plate recognition systems[J]. Chinese Journal of Network and Information Security, 2024, 10(6): 59-70.
朱孝羽, 唐鹏, 张浩臣, 等. 车牌识别系统中基于特征不变量的对抗检测[J]. 网络与信息安全学报, 2024, 10(6): 59-70. DOI： 10.11959/j.issn.2096-109x.2024080.

ZHU X Y, TANG P, ZHANG H C, et al. Adversarial detection based on feature invariant in license plate recognition systems[J]. Chinese Journal of Network and Information Security, 2024, 10(6): 59-70. DOI： 10.11959/j.issn.2096-109x.2024080.

摘要

深度神经网络已成为人们日常生活的重要部分。但研究人员发现，深度神经网络容易受到对抗样本的威胁，使网络模型发生错误分类等异常行为。对抗样本的存在极大地威胁了深度神经网络的应用，特别是在对于安全性需求非常敏感的场景，如车牌识别系统。目前，大部分现有的对抗样本防御和检测技术对某些特定类型的对抗攻击可以呈现出很好的效果，但通常情况下，它们并不能对所有类型的对抗攻击都具有通用性。针对真实场景下车牌识别系统的对抗样本攻击，通过分析神经网络在干净样本上训练的内在变化和干净样本之间的维度复杂度，提出了基于神经网络不变量和局部固有维数不变量的特征不变量无监督对抗样本检测系统，称为特征不变量对抗检测（feature invariant adversarial detection， FIAD）。该研究将本检测系统部署到广泛使用的开源车牌识别系统HyperLPR和EasyPR中，并以真实的中国车牌数据集（Chinese city parking dataset， CCPD）对该检测系统进行了广泛的实验。对11种不同类型的攻击进行实验，结果表明，相比其他4种先进的检测方法，FIAD可以在更低的假阳率下有效地检测所有攻击，且平均检测准确率始终高达99%。因此，FIAD对各种类型的对抗攻击具有良好的通用性。

Abstract

Deep neural networks have become an integral part of people's daily lives. However

researchers observed that these networks were susceptible to threats from adversarial samples

leading to abnormal behaviors such as misclassification by the network model. The presence of adversarial samples poses a significant threat to the application of deep neural networks

especially in security-sensitive scenarios like license plate recognition systems. Presently

most existing defense and detection technologies against adversarial samples show promising results for specific types of adversarial attacks. However

they often lack generality in addressing all types of adversarial attacks. In response to adversarial sample attacks on real-world license plate recognition systems

an unsupervised adversarial sample detection system named FIAD was proposed

which was based on analyzing the inherent variations in neural networks trained on clean samples and the dimensional complexity between clean samples. FIAD utilized neural network invariants and local intrinsic dimensionality invariants for effective sample detection. The detection system was deployed into widely used open-source license plate recognition systems

HyperLPR and EasyPR

and extensive experiments were conducted using the real dataset CCPD. The results from experiments involving 11 different types of attacks indicate that

compared to 4 other advanced detection methods

FIAD can effectively detect all these attacks at a lower false positive rate

with an accuracy consistently reaching 99%. Therefore

FIAD exhibits good generality against various types of adversarial attacks.

关键词

Keywords

references

ZHAO H S , JIA J Y , KOLTUN V . Exploring self-attention for image recognition [C ] // Proceedings of the 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . Piscataway : IEEE Press , 2020 : 10073 - 10082 .

LI J Y . Recent advances in end-to-end automatic speech recognition [EB ] . arXiv Preprint , arXiv: 2111.01690 , 2022 .

LUO W H , XING J L , MILAN A , et al . Multiple object tracking: a literature review [J ] . Artificial Intelligence , 2021 ( 293 ): 103448 .

GEHR T , MIRMAN M , DRACHSLER-COHEN D , et al . AI2: safety and robustness certification of neural networks with abstract interpretation [C ] // Proceedings of the 2018 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2018 : 3 - 18 .

YAN J , YU J , XIAOXIAO . HyperLPR3 - high performance license plate recognition framework [EB ] . 2023 .

LIURUOZE , MICOOZ , JSXYHELU , et al . An easy, flexible, and accurate plate recognition project for Chinese licenses in unconstrained situations [EB ] . 2023 .

GOODFELLOW L J , SHLENS J , SZEGEDY C . Explaining and harnessing adversarial examples [EB ] . arXiv PreprintarXiv: 1412.6572 , 2014 .

ALDAHDOOH A , HAMIDOUCHE W , FEZZA S A , et al . Adversarial example detection for DNN models: a review and experimental comparison [J ] . Artificial Intelligence Review , 2022 , 55 ( 6 ): 4403 - 4462 .

MADRY A , MAKELOV A , SCHMIDT L , et al . Towards deep learning models resistant to adversarial attacks [EB ] . arXiv Preprint arXiv: 1706.06083 , 2017 .

BORKAR T , HEIDE F , KARAM L . Defending against universal attacks through selective feature regeneration [C ] // Proceedings of the 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . Piscataway : IEEE Press , 2020 : 706 - 716 .

LIAO F Z , LIANG M , DONG Y P , et al . Defense against adversarial attacks using high-level representation guided denoiser [C ] // Proceedings of the 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE Press , 2018 : 1778 - 1787 .

PAPERNOT N , MCDANIEL P , GOODFELLOW I , et al . Practical black-box attacks against machine learning [C ] // Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security . New York : ACM , 2017 : 506 - 519 .

PAPERNOT N , MCDANIEL P , JHA S , et al . The limitations of deep learning in adversarial settings [C ] // Proceedings of the 2016 IEEE European Symposium on Security and Privacy (EuroS&P) . Piscataway : IEEE Press , 2016 : 372 - 387 .

MA X J , LI B , WANG Y S , et al . Characterizing adversarial subspaces using local intrinsic dimensionality [EB ] . arXiv Preprint arXiv: 1801.02613 , 2018 .

XU W L , EVANS D , QI Y J . Feature squeezing: detecting adversarial examples in deep neural networks [C ] // Proceedings 2018 Network and Distributed System Security Symposium . Reston, VA : Internet Society , 2018 .

MA S Q , LIU Y Q , TAO G H , et al . NIC: detecting adversarial samples with neural network invariant checking [C ] // Proceedings 2019 Network and Distributed System Security Symposium . Reston, VA : Internet Society , 2019 .

XU Z B , YANG W , MENG A J , et al . Towards end-to-end license plate detection and recognition: a large dataset and baseline [C ] // Proceedings of the Computer Vision-ECCV 2018: 15th European Conference , Munich, Germany, September 8-14, 2018 , Proceedings, Part XIII . New York : ACM , 2018 : 261 - 277 .

CARLINI N , WAGNER D . Towards evaluating the robustness of neural networks [C ] // Proceedings of the 2017 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2017 : 39 - 57 .

KURAKIN A , GOODFELLOW L , BENGIO S . Adversarial examples in the physical world [M ] . Artificial Intelligence Safety and Security : Chapman and Hall/CRC Press , 2018 .

MOOSAVI-DEZFOOLI S M , FAWZI A , FROSSARD P . DeepFool: a simple and accurate method to fool deep neural networks [C ] // Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) . Piscataway : IEEE Press , 2016 : 2574 - 2582 .

PEI K X , CAO Y Z , YANG J F , et al . DeepXplore: automated whitebox testing of deep learning systems [C ] // Proceedings of the 26th Symposium on Operating Systems Principles . New York : ACM , 2017 : 1 - 18 .

LIU Y Q , MA S Q , AAFER Y , et al . Trojaning attack on neural networks [C ] // Proceedings 2018 Network and Distributed System Security Symposium . Reston, VA : Internet Society , 2018 .

MAO X F , CHEN Y F , WANG S H , et al . Composite adversarial attacks [C ] // Proceedings of the AAAI Conference on Artificial Intelligence , 2021 , 35 ( 10 ): 8884 - 8892 .

MUSTAFA A , KHAN S H , HAYAT M , et al . Image super-resolution as a defense against adversarial attacks [J ] . IEEE Transactions on Image Processing: A Publication of the IEEE Signal Processing Society , 2019 : 1711 - 1724 .

KHERCHOUCHE A , FEZZA S A , HAMIDOUCHE W , et al . Detection of adversarial examples in deep neural networks with natural scene statistics [C ] // Proceedings of the 2020 International Joint Conference on Neural Networks (IJCNN) . Piscataway : IEEE Press , 2020 : 1 - 7 .

ZUO F , ZENG Q . Exploiting the sensitivity of L2 adversarial examples to erase-and-restore [C ] // Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security . New York : ACM , 2021 : 40 - 51 .

ALDAHDOOH A , HAMIDOUCHE W , DÉFORGES O . Revisiting model's uncertainty and confidences for adversarial example detection [J ] . Applied Intelligence , 2023 , 53 ( 1 ): 509 - 531 .

LI X , LI F X . Adversarial examples detection in deep networks with convolutional filter statistics [C ] // Proceedings of the 2017 IEEE International Conference on Computer Vision (ICCV) . Piscataway : IEEE Press , 2017 : 5775 - 5783 .

COHEN G , SAPIRO G , GIRYES R . Detecting adversarial samples using influence functions and nearest neighbors [C ] // Proceedings of the 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . Piscataway : IEEE Press , 2020 : 14441 - 14450 .

LIANG B , LI H C , SU M Q , et al . Detecting adversarial image examples in deep neural networks with adaptive noise reduction [J ] . IEEE Transactions on Dependable and Secure Computing , 2021 , 18 ( 1 ): 72 - 85 .

ENISER H F , CHRISTAKIS M , WÜSTHOLZ V . RAID: randomized adversarial-input detection for neural networks [EB ] . arXiv Preprint arXiv: 2002.02776 , 2020 .

MENG D Y , CHEN H . MagNet: a two-pronged defense against adversarial examples [C ] // Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2017 : 135 - 147 .

FREITAS S , CHEN S T , WANG Z J , et al . UnMask: adversarial detection and defense through robust feature alignment [C ] // Proceedings of the 2020 IEEE International Conference on Big Data . Piscataway : IEEE Press , 2020 : 1081 - 1088 .

BIGGIO B , ROLI F . Wild patterns: ten years after the rise of adversarial machine learning [J ] . Pattern Recognition , 2018 , 84 ( C ): 317 - 331 .

AMSALEG L , CHELLY O , FURON T , et al . Estimating local intrinsic dimensionality [C ] // Proceedings of the 21th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining . New York : ACM , 2015 : 29 - 38 .

ALAM S , SONBHADRA S K , AGARWAL S , et al . One-class support vector classifiers: a survey [J ] . Knowledge-Based Systems , 2020 ( 196 ): 105754 .

QIAN Y G , MA D F , WANG B , et al . Spot evasion attacks: adversarial examples for license plate recognition systems with convolutional neural networks [J ] . Computers & Security , 2020 , 95 : 101826 .

ZHANG J , XIE Z , SUN J , et al . CSUST Chinese traffic sign detection benchmark [EB ] . 2024 .

ZHANG J M , WANG W , LU C Q , et al . Lightweight deep network for traffic sign classification [J ] . Annals of Telecommunications , 2020 , 75 ( 7 ): 369 - 379 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Double adversarial attack against license plate recognition system

Carrier-independent deep optical watermarking algorithm

Android malware detection method based on deep neural network

Design method of secure computing protocol for deep neural network

Related Author

Zhangjie FU

Linfeng XU

Dong JIANG

Kai YAN

Jun GU

Xianyi CHEN

Feng WANG

Nenghai YU

Related Institution

Engineering Research Center of Digital Forensics, Ministry of Education, Nanjing University of Information Science and Technology

The State Key Laboratory of Integrated Services Networks, Xidian University

School of Cyber Science and Technology, University of Science and Technology of China

CAS Key Laboratory of Electromagnetic Space Information, University of Science and Technology of China

College of Cryptogram Engineering,Information Engineering University

⁰