基于图像重构的MNIST对抗样本防御算法

秦中元; 贺兆祥; 李涛; 陈立全

doi:10.11959/j.issn.2096-109x.2021095

您当前的位置：

首页 >

文章列表页 >

基于图像重构的MNIST对抗样本防御算法

学术论文 | 更新时间：2024-06-03

- 基于图像重构的MNIST对抗样本防御算法
- Adversarial example defense algorithm for MNIST based on image reconstruction
- 网络与信息安全学报 2022年8卷第1期页码：86-94
- 作者机构：
  
  1. 东南大学网络空间安全学院，江苏南京 211189
  2. 网络通信与安全紫金山实验室，江苏南京 211189
- 作者简介：
  
  [ "秦中元（1974− ），男，河南安阳人，博士，东南大学副教授，主要研究方向为人工智能安全、无线网络安全" ]
  [ "贺兆祥（1995− ），男，山东临沂人，东南大学硕士生，主要研究方向为人工智能安全、无线网络安全" ]
  [ "李涛（1984− ），男，江苏镇江人，博士，东南大学副教授，主要研究方向为可信计算、移动终端安全、内生安全" ]
  [ "陈立全（1976− ），男，广西玉林人，博士，东南大学教授、博士生导师，主要研究方向为移动信息安全、物联网系统与安全、云计算及大数据安全" ]
- 基金信息：
  
  国家重点研发计划;The National Key R＆D Program of China(2020YFE0200600);国家自然科学基金资助项目;The National Natural Science Foundation of China(61601113)
- DOI：10.11959/j.issn.2096-109x.2021095
  中图分类号： TP393
- 网络首发：2022-02，
  
  纸质出版：2022-02-15
- 稿件说明：
移动端阅览
秦中元, 贺兆祥, 李涛, 等. 基于图像重构的MNIST对抗样本防御算法[J]. 网络与信息安全学报, 2022,8(1):86-94.

Zhongyuan QIN, Zhaoxiang HE, Tao LI, et al. Adversarial example defense algorithm for MNIST based on image reconstruction[J]. Chinese Journal of Network and Information Security, 2022, 8(1): 86-94.
秦中元, 贺兆祥, 李涛, 等. 基于图像重构的MNIST对抗样本防御算法[J]. 网络与信息安全学报, 2022,8(1):86-94. DOI： 10.11959/j.issn.2096-109x.2021095.

Zhongyuan QIN, Zhaoxiang HE, Tao LI, et al. Adversarial example defense algorithm for MNIST based on image reconstruction[J]. Chinese Journal of Network and Information Security, 2022, 8(1): 86-94. DOI： 10.11959/j.issn.2096-109x.2021095.

摘要

随着深度学习的应用普及，其安全问题越来越受重视，对抗样本是在原有图像中添加较小的扰动，即可造成深度学习模型对图像进行错误分类，这严重影响深度学习技术的发展。针对该问题，分析现有对抗样本的攻击形式和危害，由于现有防御算法存在缺点，提出一种基于图像重构的对抗样本防御方法，以达到有效防御对抗样本的目的。该防御方法以 MNIST 为测试数据集，核心思路是图像重构，包括中心方差最小化和图像缝合优化，中心方差最小化只针对图像中心区域进行处理；图像缝合优化将重叠区域纳入补丁块选取的考量，并以补丁块的1/2大小作为重叠区域。使用FGSM、BIM、DeepFool以及C＆amp;W攻击方式生成对抗样本来测试两种方式的防御性能，并与现有的3种图像重构防御方式（裁剪与缩放、位深度压缩和JPEG 压缩）效果对比。实验结果表明，所提中心方差最小化和图像缝合优化算法，对现有常见对抗样本的攻击起到了较好的防御效果。图像缝合优化对4种攻击算法生成的样本分类正确率都达到了75%以上，中心方差最小化的防御效果在70%左右。而用作对比的3种图像重构算法则对不同攻击算法的防御效果不稳定，整体分类正确率不足60%。所提中心方差最小化和图像缝合优化两种图像重构防御算法达到了有效防御对抗样本的目的，通过实验说明了所提防御算法在不同对抗样本攻击算法中的防御效果，另外，将其他图像重构算法与所提算法进行比较，说明了所提算法具有良好的防御性能。

Abstract

With the popularization of deep learning

more and more attention has been paid to its security issues.The adversarial sample is to add a small disturbance to the original image

which can cause the deep learning model to misclassify the image

which seriously affects the performance of deep learning technology.To address this challenge

the attack form and harm of the existing adversarial samples were analyzed.An adversarial examples defense method based on image reconstruction was proposed to effectively detect adversarial examples.The defense method used MNIST as the test data set.The core idea was image reconstruction

including central variance minimization and image quilting optimization.The central variance minimization was only processed for the central area of the image.The image quilting optimization incorporated the overlapping area into the patch block selection.Considered and took half the size of the patch as the overlap area.Using FGSM

BIM

DeepFool and C＆amp;W attack methods to generate adversarial samples to test the defense performance of the two methods

and compare with the existing three image reconstruction defense methods (cropping and scaling

bit depth compression and JPEG compression).The experimental results show that the central variance minimization and image quilting optimization algorithms proposed have a satisfied defense effect against the attacks of existing common adversarial samples.Image quilting optimization achieves over 75% classification accuracy for samples generated by the four attack algorithms

and the defense effect of minimizing central variance is around 70%.The three image reconstruction algorithms used for comparison have unstable defense effects on different attack algorithms

and the overall classification accuracy rate is less than 60%.The central variance minimization and image quilting optimization proposed achieve the purpose of effectively defending against adversarial samples.The experiments illustrate the defense effect of the proposed defense algorithm in different adversarial sample attack algorithms.The comparison between the reconstruction algorithm and the algorithm shows that the proposed scheme has good defense performance.

关键词

Keywords

references

SIMONVAN K , ZISSERMAN A . Very deep convolutional networks for large-scale image recognition [C ] // Proceedings of 3rd International Conference on Learning Representations (ICLR 2015) . 2015 .

EYKHOLT K , EVTIMOV I , FERNANDES E , et al . Robust physical-world attacks on deep learning visual classification [C ] // Proceedings of 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . 2018 .

SZEGEDY C , ZAREMBA W , SUTSKEVER I , et al . Intriguing properties of neural networks [C ] // Proceedings of 2nd International Conference on Learning Representations (ICLR 2014) . 2014 .

SHARIF M , BHAGAVATULA S , BAUER L , et al . Accessorize to a crime:Real and stealthy attacks on state-of-the-art face recognition [C ] // Proceedings of the 2016 ACM SIGSAC Conference . 2016 .

PRASAD A , SUGGALA A S , BALAKRISHNAN S , et al . Robust estimation via robust gradient estimation [J ] . Journal of the Royal Statistical Society Series B , 2020 , 82 ( 3 ): 601 - 627 .

宋蕾 , 马春光 , 段广晗 . 机器学习安全及隐私保护研究进展 [J ] . 网络与信息安全学报 , 2018 , 4 ( 8 ): 1 - 11 .

SONG L , MA C G , DUAN G H . Machine learning security and privacy:a survey [J ] . Chinese Journal of Network and Information Security , 2018 , 4 ( 8 ): 1 - 11 .

GOODFELLOW I J , SHLENS J , SZEGEDY C . Explaining and harnessing adversarial examples [C ] // Proceedings of 3rd International Conference on Learning Representations (ICLR 2015) . 2015 .

KURAKIN A , GOODFELLOW I J , BENGIO S . Adversarial examples in the physical world [C ] // Proceedings of 5th International Conference on Learning Representations (ICLR 2017) . 2017 .

MOOSAVI-DEZFOOLI S , FAWZI A , FROSSARD P . DeepFool:a simple and accurate method to fool deep neural networks [C ] // Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition . 2016 : 2574 - 2582 .

CARLINI N , WAGNER D . Towards evaluating the robustness of neural networks [C ] // Proceedings of 2017 IEEE Symposium on Security and Privacy (SP) . 2017 .

LECUN Y , BOTTOU L . Gradient-based learning applied to document recognition [C ] // Proceedings of the IEEE . 1998 : 2278 - 2324 .

SZEGEDY C , LIU W , JIA Y , et al . Going deeper with convolutions [C ] // Proceedings of IEEE Conference on Computer Vision and Pattern Recognition (CVPR 2015) . 2015 .

刘西蒙 , 谢乐辉 , 王耀鹏 , 等 . 深度学习中的对抗攻击与防御 [J ] . 网络与信息安全学报 , 2020 , 6 ( 5 ): 36 - 53 .

LIU X M , XIE L H , WANG Y P , et al . Adversarial at tacks and defenses in deep learning [J ] . Chinese Journal of Network and Information Security , 2020 , 6 ( 5 ): 36 - 53 .

DZIUGAITE G K , GHAHRAMANI Z , ROY D M . A study of the effect of JPG compression on adversarial images [C ] // Proceedings of 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) . 2016 .

严飞 , 张铭伦 , 张立强 . 基于边界值不变量的对抗样本检测方法 [J ] . 网络与信息安全学报 , 2020 , 6 ( 1 ): 38 - 45 .

YAN F , ZHANG M L , ZHANG L Q . Adversarial examples detection method based on boundary values invariants [J ] . Chinese Journal of Network and Information Security , 2020 , 6 ( 1 ): 38 - 45 .

LU J . No need to worry about adversarial examples in object detection in autonomous vehicles [EB ] .

GUO C , RANA M , CISSE M , et al . Countering adversarial images using input transformations [C ] // The 6th International Conference on Learning Representations (ICLR 2018) . 2018 .

EFROS A A , FREEMAN W T . Image quilting for texture synthesis and transfer [C ] // Proceedings of the ACM SIGGRAPH Conference on Computer Graphics . 2001 : 341 - 346 .

BOYKOV Y , VEKSLER O , ZABIH R . Fast approximate energy minimization via graph cuts [J ] . IEEE Transactions on Pattern Analysis and Machine Intelligence , 2001 , 23 ( 11 ): 1222 - 1239 .

浏览量

542

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

深度学习中对抗样本的构造及防御研究

基于双路特征提取和自适应融合的钓鱼网站检测

DNS异常检测：大规模实验分析

FL-IoV：基于联邦学习的综合车联网入侵检测方法

针对音频分类的跨表征可迁移对抗样本生成方法