基于多维特征图知识蒸馏的对抗样本防御方法

邱宝琳; 易平

doi:10.11959/j.issn.2096-109x.2022012

您当前的位置：

首页 >

文章列表页 >

基于多维特征图知识蒸馏的对抗样本防御方法

专栏：网络攻击与防御技术 | 更新时间：2024-06-03

- 基于多维特征图知识蒸馏的对抗样本防御方法
- Adversarial examples defense method based on multi-dimensional feature maps knowledge distillation
- 网络与信息安全学报 2022年8卷第2期页码：88-99
- 作者机构：
- 作者简介：
  
  [ "邱宝琳（1995− ），男，山东潍坊人，上海交通大学硕士生，主要研究方向为人工智能安全和对抗样本" ]
  [ "易平（1969− ），男，河南洛阳人，博士，上海交通大学副教授，主要研究方向为人工智能安全和网络对抗" ]
- 基金信息：
  
  国家重点研发计划;The National Key R＆D Program of China(2019YFB1405000)
- DOI：10.11959/j.issn.2096-109x.2022012
  中图分类号： TP309
- 网络首发：2022-04，
  
  纸质出版：2022-04-15
- 稿件说明：
移动端阅览
邱宝琳, 易平. 基于多维特征图知识蒸馏的对抗样本防御方法[J]. 网络与信息安全学报, 2022,8(2):88-99.

Baolin QIU, Ping YI. Adversarial examples defense method based on multi-dimensional feature maps knowledge distillation[J]. Chinese Journal of Network and Information Security, 2022, 8(2): 88-99.
邱宝琳, 易平. 基于多维特征图知识蒸馏的对抗样本防御方法[J]. 网络与信息安全学报, 2022,8(2):88-99. DOI： 10.11959/j.issn.2096-109x.2022012.

Baolin QIU, Ping YI. Adversarial examples defense method based on multi-dimensional feature maps knowledge distillation[J]. Chinese Journal of Network and Information Security, 2022, 8(2): 88-99. DOI： 10.11959/j.issn.2096-109x.2022012.

摘要

计算机视觉领域倾向使用深度神经网络完成识别任务，但对抗样本会导致网络决策异常。为了防御对抗样本，主流的方法是对模型进行对抗训练。对抗训练存在算力高、训练耗时长的缺点，其应用场景受限。提出一种基于知识蒸馏的对抗样本防御方法，将大型数据集学习到的防御经验复用到新的分类任务中。在蒸馏过程中，教师模型和学生模型结构一致，利用模型特征图向量作为媒介进行经验传递，并只使用干净样本训练。使用多维度特征图强化语义信息的表达，并且提出一种基于特征图的注意力机制，将特征依据重要程度赋予权重，增强蒸馏效果。所提算法在 Cifar100、Cifar10 等开源数据集上进行实验，使用FGSM（fast gradient sign method）、PGD（project gradient descent）、C＆amp;W（Carlini-Wagner attack）等算法进行白盒攻击，测试实验效果。所提方法在 Cifar10 干净样本的准确率超过对抗训练，接近模型在干净样本正常训练的准确率。在L2距离的PGD攻击下，所提方法效果接近对抗训练，显著高于正常训练。而且其学习成本小，即使添加注意力机制和多维度特征图等优化方案，算力需求依然远小于对抗训练，是一种轻量级的对抗防御方法。知识蒸馏作为一种神经网络学习方案，不仅能够学习正常样本的决策经验，而且可以提取鲁棒性特征。使用少量数据生成准确而鲁棒的模型，可以提高泛化能力，减少对抗训练带来的成本。

Abstract

The neural network approach has been commonly used in computer vision tasks.However

adversarial examples are able to make a neural network generate a false prediction.Adversarial training has been shown to be an effective approach to defend against the impact of adversarial examples.Nevertheless

it requires high computing power and long training time thus limiting its application scenarios.An adversarial examples defense method based on knowledge distillation was proposed

reusing the defense experience from the large datasets to new classification tasks.During distillation

teacher model has the same structure as student model and the feature map vector was used to transfer experience

and clean samples were used for training.Multi-dimensional feature maps were utilized to enhance the semantic information.Furthermore

an attention mechanism based on feature map was proposed

which boosted the effect of distillation by assigning weights to features according to their importance.Experiments were conducted over cifar100 and cifar10 open-source dataset.And various white-box attack algorithms such as FGSM (fast gradient sign method)

PGD (project gradient descent) and C＆amp;W (Carlini-Wagner attack) were applied to test the experimental results.The accuracy of the proposed method on Cifar10 clean samples exceeds that of adversarial training and is close to the accuracy of the model trained on clean samples.Under the PGD attack of L2 distance

the efficiency of the proposed method is close to that of adversarial training

which is significantly higher than that of normal training.Moreover

the proposed method is a light-weight adversarial defense method with low learning cost.The computing power requirement is far less than that of adversarial training even if optimization schemes such as attention mechanism and multi-dimensional feature map are added.Knowledge distillation can learn the decision-making experience of normal samples and extract robust features as a neural network learning scheme.It uses a small amount of data to generate accurate and robust models

improves generalization

and reduces the cost of adversarial training.

关键词

Keywords

references

SZEGEDY C , ZAREMBA W , SUTSKEVER I , et al . Intriguing properties of neural networks [J ] . arXiv preprint arXiv:1312.6199 , 2013 .

XU K D , ZHANG G Y , LIU S J , et al . Adversarial T-shirt evading person detectors in a physical world [C ] // Proceedings of Computer Vision - ECCV 2020 . 2020 : 665 - 681 .

HE K M , ZHANG X Y , REN S Q , et al . Deep residual learning for image recognition [C ] // Proceedings of 2016 IEEE Conference on Computer Vision and Pattern Recognition . 2016 : 770 - 778 .

SZEGEDY C , VANHOUCKE V , IOFFE S , et al . Rethinking the inception architecture for computer vision [C ] // Proceedings of 2016 IEEE Conference on Computer Vision and Pattern Recognition . 2016 : 2818 - 2826 .

HINTON G E , VINYALS O , DEAN J . Distilling the knowledge in a neural network [J ] . arXiv preprint arXiv:1503.02531 , 2015 .

ZHOU B L , KHOSLA A , LAPEDRIZA A , et al . Learning deep features for discriminative localization [C ] // Proceedings of 2016 IEEE Conference on Computer Vision and Pattern Recognition . 2016 : 2921 - 2929 .

易平 , 王科迪 , 黄程 , 等 . 人工智能对抗攻击研究综述 [J ] . 上海交通大学学报 , 2018 , 52 ( 10 ): 1298 - 1306 .

YI P , WANG K D , HUANG C , et al . Adversarial attacks in artificial intelligence:a survey [J ] . Journal of Shanghai Jiao Tong University , 2018 , 52 ( 10 ): 1298 - 1306 .

王科迪 , 易平 . 人工智能对抗环境下的模型鲁棒性研究综述 [J ] . 信息安全学报 , 2020 , 5 ( 3 ): 13 - 22 .

WANG K D , YI P . A survey on model robustness under adversarial example [J ] . Journal of Cyber Security , 2020 , 5 ( 3 ): 13 - 22 .

GOODFELLOW I J , SHLENS J , SZEGEDY C . Explaining and harnessing adversarial examples [J ] . arXiv preprint arXiv:1412.6572 , 2014 .

KURAKIN A , GOODFELLOW I , BENGIO S . Adversarial machine learning at scale [J ] . arXiv preprint arXiv:1611.01236 , 2016 .

DONG Y P , LIAO F Z , PANG T Y , et al . Boosting adversarial attacks with momentum [C ] // Proceedings of 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition . 2018 : 9185 - 9193 .

MADRY A , MAKELOV A , SCHMIDT L , et al . Towards deep learning models resistant to adversarial attacks [J ] . arXiv preprint arXiv:1706.06083 , 2017 .

MOOSAVI-DEZFOOLI S M , FAWZI A , FROSSARD P . DeepFool:a simple and accurate method to fool deep neural networks [C ] // Proceedings of 2016 IEEE Conference on Computer Vision and Pattern Recognition . 2016 : 2574 - 2582 .

SU J W , VARGAS D V , SAKURAI K . One pixel attack for fooling deep neural networks [J ] . IEEE Transactions on Evolutionary Computation , 2019 , 23 ( 5 ): 828 - 841 .

CARLINI N , WAGNER D . Towards evaluating the robustness of neural networks [C ] // Proceedings of 2017 IEEE Symposium on Security and Privacy . 2017 : 39 - 57 .

KANNAN H , KURAKIN A , GOODFELLOW I . Adversarial logit pairing [J ] . arXiv preprint arXiv:1803.06373 , 2018 .

WANG Y , ZOU D , YI J , et al . Improving adversarial robustness requires revisiting misclassified examples [C ] // Proceedings of International Conference on Learning Representations . 2019 .

XIE C , WANG J , ZHANG Z , et al . Mitigating adversarial effects through randomization [J ] . arXiv preprint arXiv:1711.01991 , 2017 .

XIE C H , WU Y X , VAN DER MAATEN L , et al . Feature denoising for improving adversarial robustness [C ] // Proceedings of 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . 2019 : 501 - 509 .

XU W L , EVANS D , QI Y J . Feature squeezing:detecting adversarial examples in deep neural networks [J ] . arXiv preprint arXiv:1704.01155 , 2017 .

MA S Q , LIU Y Q , TAO G H , et al . Nic:detecting adversarial samples with neural network invariant checking [C ] // Proceedings of the 26th Network and Distributed System Security Symposium (NDSS 2019) . 2019 .

GOLDBLUM M , FOWL L , FEIZI S , et al . Adversarially robust distillation [J ] . Proceedings of the AAAI Conference on Artificial Intelligence , 2020 , 34 ( 4 ): 3996 - 4003 .

SHAFAHI A , SAADATPANAH P , ZHU C , et al . Adversarially robust transfer learning [J ] . arXiv preprint arXiv:1905.08232 , 2019 .

SHAFAHI A , NAJIBI M , GHIASI A , et al . Adversarial training for free! [J ] . arXiv preprint arXiv:1904.12843 , 2019 .

SELVARAJU R R , COGSWELL M , DAS A , et al . Grad-CAM:visual explanations from deep networks via gradient-based localization [J ] . International Journal of Computer Vision , 2020 , 128 ( 2 ): 336 - 359 .

CHATTOPADHAY A , SARKAR A , HOWLADER P , et al . Grad-CAM++:generalized gradient-based visual explanations for deep convolutional networks [C ] // Proceedings of 2018 IEEE Winter Conference on Applications of Computer Vision . 2018 : 839 - 847 .

WANG Y D , ZHANG J , KAN M N , et al . Self-supervised equivariant attention mechanism for weakly supervised semantic segmentation [C ] // Proceedings of 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . 2020 : 12272 - 12281 .

LIN M , CHEN Q , YAN S . Network in network [J ] . arXiv preprint arXiv:1312.4400 , 2013 .

BOTTOU L , . Large-scale machine learning with stochastic gradient descent [C ] // Proceedings of COMPSTAT'2010 . 2010 .

浏览量

407

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于双路特征提取和自适应融合的钓鱼网站检测

DNS异常检测：大规模实验分析

FL-IoV：基于联邦学习的综合车联网入侵检测方法

基于分层结构的多任务对抗样本归因方法

彩色图像隐写分析研究进展