基于PatchTracker的对抗补丁防御算法

肖镇杰; 黄诗瑀; 叶锋; 黄丽清; 黄添强

doi:10.11959/j.issn.2096-109x.2024009

您当前的位置：

首页 >

文章列表页 >

基于PatchTracker的对抗补丁防御算法

学术论文 | 更新时间：2024-06-03

- 基于PatchTracker的对抗补丁防御算法
- Adversarial patch defense algorithm based on PatchTracker
- 网络与信息安全学报 2024年10卷第1期页码：169-180
- 作者机构：
  
  1. 福建师范大学计算机与网络空间安全学院，福建福州 350117
  2. 数字福建大数据安全技术研究所，福建福州 350117
- 作者简介：
  
  [ "肖镇杰（2000− ），男，福建泉州人，福建师范大学硕士生，主要研究方向为计算机视觉" ]
  [ "黄诗瑀（1999− ），男，福建厦门人，福建师范大学硕士生，主要研究方向为对抗性深度学习和数字媒体取证" ]
  [ "叶锋（1978− ），男，福建福州人，博士，福建师范大学副教授，主要研究方向为计算机视觉和视频图像编码" ]
  [ "黄丽清（1991− ），女，福建莆田人，博士，福建师范大学讲师，主要研究方向为视频图像超分辨、去模糊处理和数字媒体取证" ]
  [ "黄添强（1971− ），男，福建莆田人，博士，福建师范大学教授、博士生导师，主要研究方向为机器学习安全和数字媒体取证" ]
- 基金信息：
  
  国家自然科学基金;The National Natural Science Foundation of China(62072106);福建省创新战略研究计划项目;Fujian Innovation Strategy Research Pro-gram Project(2023R0156)
- DOI：10.11959/j.issn.2096-109x.2024009
  中图分类号： TP393
- 网络首发：2024-02，
  
  纸质出版：2024-02-25
- 稿件说明：
移动端阅览
肖镇杰, 黄诗瑀, 叶锋, 等. 基于PatchTracker的对抗补丁防御算法[J]. 网络与信息安全学报, 2024,10(1):169-180.

Zhenjie XIAO, Shiyu HUANG, Feng YE, et al. Adversarial patch defense algorithm based on PatchTracker[J]. Chinese Journal of Network and Information Security, 2024, 10(1): 169-180.
肖镇杰, 黄诗瑀, 叶锋, 等. 基于PatchTracker的对抗补丁防御算法[J]. 网络与信息安全学报, 2024,10(1):169-180. DOI： 10.11959/j.issn.2096-109x.2024009.

Zhenjie XIAO, Shiyu HUANG, Feng YE, et al. Adversarial patch defense algorithm based on PatchTracker[J]. Chinese Journal of Network and Information Security, 2024, 10(1): 169-180. DOI： 10.11959/j.issn.2096-109x.2024009.

摘要

基于深度神经网络的目标检测技术已经广泛应用于各领域，然而，通过对抗补丁攻击在图像中添加局部扰动，以此来误导深度神经网络，对基于目标检测技术的视觉系统构成了严重威胁。针对这一问题，利用对抗补丁和图像背景的语义差异性，提出了一种基于PatchTracker的对抗补丁防御算法，该算法由上游补丁检测器与下游数据增强模块组成。上游补丁检测器使用带有注意力机制的YOLOV5（you only look once-v5）确定对抗补丁所在位置，有助于提高对小尺度对抗补丁的检测精度；将检测区域用合适的像素值覆盖以抹除对抗补丁，上游补丁检测器不仅能够有效降低对抗样本的攻击性，而且不依赖大规模的训练数据；下游数据增强模块通过改进模型训练范式，提高下游目标检测器的鲁棒性；将抹除补丁后的图像输入经过数据增强的下游 YOLOV5 目标检测模型。在公开的 TT100K 交通标志数据集上进行了交叉验证，实验表明，与未采取防御措施相比，所提算法能够有效防御多种类型的通用对抗补丁攻击，在检测对抗补丁图像时的mAP（mean average precision）提高65%左右，有效地改善了小尺度对抗补丁的漏检情况。与现有算法比较，所提算法有效提高了神经网络在检测对抗样本时的准确率。此外，所提算法不涉及下游模型结构的修改，具有良好的兼容性。

Abstract

The application of deep neural networks in target detection has been widely adopted in various fields.However

the introduction of adversarial patch attacks

which add local perturbations to images to mislead deep neural networks

poses a significant threat to target detection systems based on vision techniques.To tackle this issue

an adversarial patch defense algorithm based on PatchTracker was proposed

leveraging the semantic differences between adversarial patches and image backgrounds.This algorithm comprised an upstream patch detector and a downstream data enhancement module.The upstream patch detector employed a YOLOV5 (you only look once-v5) model with attention mechanism to determine the locations of adversarial patches

thereby improving the detection accuracy of small-scale adversarial patches.Subsequently

the detected regions were covered with appropriate pixel values to remove the adversarial patches.This module effectively reduced the impact of adversarial examples without relying on extensive training data.The downstream data enhancement module enhanced the robustness of the target detector by modifying the model training paradigm.Finally

the image with removed patches was input into the downstream YOLOV5 target detection model

which had been enhanced through data augmentation.Cross-validation was performed on the public TT100K traffic sign dataset.Experimental results demonstrated that the proposed algorithm effectively defended against various types of generic adversarial patch attacks when compared to situations without defense measures.The algorithm improves the mean average precision (mAP) by approximately 65% when detecting adversarial patch images

effectively reducing the false negative rate of small-scale adversarial patches.Moreover

compared to existing algorithms

this approach significantly enhances the accuracy of neural networks in detecting adversarial samples.Additionally

the method exhibited excellent compatibility as it does not require modification of the downstream model structure.

关键词

Keywords

references

SZEGEDY C , ZAREMBA W , SUTSKEVER I , et al . Intriguing properties of neural networks [C ] // Proceedings of International Conference on Learning Representations (ICLR) . 2014 .

GOODFELLOW I J , SHLENS J , SZEGEDY C . Explaining and harnessing adversarial examples [C ] // Proceedings of International Conference on Learning Representations (ICLR) . 2015 .

ZHU L , WANG X , KE Z , et al . BiFormer:vision transformer with bi-level routing attention [C ] // Proceedings of Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . 2023 : 10323 - 10333 .

DEVRIES T , TAYLOR G W . Improved regularization of convolutional neural networks with cutout [J ] . arXiv preprint arXiv:1708.04552 , 2017 .

KURAKIN A , GOODFELLOW I J , BENGIO S . Adversarial examples in the physical world [C ] // Proceedings of International Conference on Learning Representations (ICLR) . 2017 .

MADRY A , MAKELOV A , SCHMIDT L , et al . Towards deep learning models resistant to adversarial attacks [C ] // Proceedings of International Conference on Learning Representations(ICLR) . 2018 .

DONG Y , LIAO F , PANG T , et al . Boosting adversarial attacks with momentum [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) . 2018 : 9185 - 9193 .

BROWN T B , MANÉ D , ROY A , et al . Adversarial patch [J ] . arXiv preprint arXiv:1712.09665 , 2017 .

KARMON D , ZORAN D , GOLDBERG Y . Lavan:Localized and visible adversarial noise [C ] // Proceedings of International Conference on Machine Learning (ICML) . 2018 : 3903 - 3911 .

EYKHOLT K , EVTIMOV I , FERNANDES E , et al . Robust physical-world attacks on deep learning visual classification [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) . 2018 : 1625 - 1634 .

YANG C , KORTYLEWSKI A , XIE C , et al . Patchattack:A black-box texture-based attack with reinforcement learning [C ] // Proceedings of European Conference on Computer Vision (ECCV) . 2020 : 681 - 698 .

SUBRAMANYA A , PILLAI V , PIRSIAVASH H . Fooling network interpretation in image classification [C ] // Proceedings of the IEEE/CVF International Conference on Computer Vision (CVPR) . 2019 : 2020 - 2029 .

SELVARAJU R R , COGSWELL M , DAS A , et al . Grad-CAM:Visual explanations from deep networks via gradient-based localization [C ] // Proceedings of the IEEE International Conference on Computer Vision (ICCV) . 2017 : 618 - 626 .

LIU X , YANG H , LIU Z , et al . Dpatch:An adversarial patch attack on object detectors [C ] // 2019 . AAAI Workshop on Artificial Intelligence Safety (SafeAI) , 2019 .

LEE M , KOLTER Z . On physical adversarial patches for object detection [J ] . arXiv preprint arXiv:1906.11897 , 2019 .

WU S , DAI T , XIA S T . DPAttack:Diffused patch attacks against universal object detection [J ] . arXiv preprint arXiv:2010.11679 , 2020 .

HUANG H , WANG Y , CHEN Z , et al . RPAttack:Refined patch attack on general object detectors [C ] // Proceedings of 2021 IEEE International Conference on Multimedia and Expo (ICME) . 2021 : 1 - 6 .

ZHAO Y , YAN H , WEI X . Object hider:Adversarial patch attack against object detectors [C ] // Proceedings of Conference on Information and Knowledge Management (CIKM) . 2020 : 28 - 31 .

SHARIF M , BHAGAVATULA S , BAUER L , et al . Accessorize to a crime:Real and stealthy attacks on state-of-the-art face recognition [C ] // Proceedings of the 2016 ACM Sigsac Conference on Computer and Communications Security . 2016 : 1528 - 1540 .

YANG X , WEI F , ZHANG H , et al . Design and interpretation of universal adversarial patches in face detection [C ] // Proceedings of European Conference on Computer Vision (ECCV) . 2020 : 174 - 191 .

THYS S , VAN RANST W , GOEDEMÉ T . Fooling automated surveillance cameras:adversarial patches to attack person detection [C ] // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) . 2019 : 49 - 55 .

HU Y C T , KUNG B H , TAN D S , et al . Naturalistic physical adversarial patch for object detectors [C ] // Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) . 2021 : 7848 - 7857 .

HUANG H , CHEN Z , CHEN H , et al . T-SEA:Transfer-based self-ensemble attack on object detection [C ] // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . 2023 : 20514 - 20523 .

NASEER M , KHAN S , PORIKLI F . Local gradients smoothing:Defense against localized adversarial attacks [C ] // Proceedings of 2019 IEEE Winter Conference on Applications of Computer Vision (WACV) . 2019 : 1300 - 1307 .

HAYES J . On visible adversarial perturbations ＆ digital watermarking [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) . 2018 : 1597 - 1604 .

CHOU E , TRAMER F , PELLEGRINO G . SentiNet:Detecting localized universal attacks against deep learning systems [C ] // Proceedings of 2020 IEEE Security and Privacy Workshops (SPW) . 2020 : 48 - 54 .

XIANG C , MAHLOUJIFAR S , MITTAL P . {PatchCleanser}:Certifiably robust defense against adversarial patches for any image classifier [C ] // Proceedings of 31st USENIX Security Symposium (USENIX Security 22) . 2022 : 2065 - 2082 .

LIU J , LEVINE A , LAU C P , et al . Segment and complete:Defending object detectors against adversarial patch attacks with robust patch detection [C ] // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . 2022 : 14973 - 14982 .

RAO S , STUTZ D , SCHIELE B . Adversarial training against location-adamized adversarial patches [C ] // Proceedings of European Conference on Computer Vision (ECCV) . 2020 : 429 - 448 .

JI N , FENG Y F , XIE H , et al . Adversarial yolo:Defense human detection patch attacks via detecting adversarial patches [J ] . arXiv preprint arXiv:2103.08860 , 2021 .

ZHANG Z , YUAN B , MCCOYD M , et al . Clipped bagnet:Defending against sticker attacks with clipped bag-of- features [C ] // Proceedings of 2020 IEEE Security and Privacy Workshops (SPW) . 2020 : 55 - 61 .

XIANG C , BHAGOJI A N , SEHWAG V , et al . {PatchGuard}:a provably robust defense against adversarial patches via small receptive fields and masking [C ] // Proceedings of 30th USENIX Security Symposium (USENIX Security 21) . 2021 : 2237 - 2254 .

KINGMA D P , BA J . Adam:A method for stochastic adamization [C ] // Proceedings of International Conference on Learning Representations (ICLR) . 2015 .

DZIUGAITE G K , GHAHRAMANI Z , ROY D M . A study of the effect of JPG compression on adversarial images [J ] . arXiv preprint arXiv:1608.00853 , 2016 .

TARCHOUN B , BEN KHALIFA A , MAHJOUB M A , et al . Jedi:entropy-based localization and removal of adversarial patches [C ] // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 2023 : 4087 - 4095 .

LIU J , LEVINE A , LAU C P , et al . Segment and complete:defending object detectors against adversarial patch attacks with robust patch detection [C ] // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 2022 : 14973 - 14982 .

浏览量

134

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于激光雷达的点云目标检测安全性综述

针对车牌识别系统的双重对抗攻击

深度学习中的对抗攻击与防御