基于光学的物理域对抗攻防综述

陈晋音; 赵晓明; 郑海斌; 郭海锋

doi:10.11959/j.issn.2096-109x.2024026

您当前的位置：

首页 >

文章列表页 >

基于光学的物理域对抗攻防综述

综述 | 更新时间：2024-08-14

- 基于光学的物理域对抗攻防综述
- Survey of optical-based physical domain adversarial attacks and defense
- 网络与信息安全学报 2024年10卷第2期页码：1-21
- 作者机构：
  
  1.浙江工业大学网络空间安全研究院，浙江杭州 310023
  2.浙江工业大学信息工程学院，浙江杭州 310023
- 作者简介：
  
  [ "陈晋音（1982- ），女，浙江象山人，浙江工业大学教授，主要研究方向为人工智能安全、图数据挖掘和进化计算。" ]
  [ "赵晓明（2001- ），男，安徽阜阳人，浙江工业大学硕士生，主要研究方向为人工智能安全、深度学习和物理对抗攻击。" ]
  [ "郑海斌（1995- ），男，浙江台州人，浙江工业大学讲师，主要研究方向为深度学习、人工智能安全和图像识别。" ]
  [ "郭海锋（1977- ），男，吉林松原人，浙江工业大学副教授，主要研究方向为智能交通。" ]
- 基金信息：
  
  国家自然科学基金(62072406);浙江省自然科学基金(LDQ23F020001)
- DOI：10.11959/j.issn.2096-109x.2024026
  中图分类号： TP393
- 收稿：2023-11-03，
  
  修回：2024-03-15，
  
  纸质出版：2024-04-15
- 稿件说明：
移动端阅览
陈晋音, 赵晓明, 郑海斌, 等. 基于光学的物理域对抗攻防综述[J]. 网络与信息安全学报, 2024, 10(02): 1-21.

Format: CHEN J Y, ZHAO X M, ZHENG H B, et al. Survey of optical-based physical domain adversarial attacks and defense[J]. Chinese Journal of Network and Information Security, 2024, 10(02): 1-21.
陈晋音, 赵晓明, 郑海斌, 等. 基于光学的物理域对抗攻防综述[J]. 网络与信息安全学报, 2024, 10(02): 1-21. DOI： 10.11959/j.issn.2096-109x.2024026.

Format: CHEN J Y, ZHAO X M, ZHENG H B, et al. Survey of optical-based physical domain adversarial attacks and defense[J]. Chinese Journal of Network and Information Security, 2024, 10(02): 1-21. DOI： 10.11959/j.issn.2096-109x.2024026.

摘要

对抗攻击是指通过在原始输入中植入人眼无法察觉的微小扰动，误导深度学习模型做出错误预测的攻击。与数字域对抗攻击相比，物理域对抗攻击可实现对抗性输入被采集设备捕获并转换为视觉系统内的二值图像之前，将扰动引入输入，对基于深度学习的计算机视觉系统构成了实际安全威胁。基于光学的物理域对抗攻击技术（如使用投影照射）作为一种典型的非侵入性攻击，由于其扰动与现实世界中自然环境产生的影响非常相似，更容易被忽略，从而疏于防护。鉴于它们具有高度的不可见性和可执行性，可对实际系统构成重大甚至致命的威胁。基于现有研究工作，重点介绍和讨论了计算机视觉系统中基于光学的物理域对抗攻击技术，并对现有技术在攻击场景、攻击手段、攻击目标、攻击效果等方面展开详细分析，最后探讨了基于光学的物理域对抗攻击未来潜在研究方向。

Abstract

Deep learning models are misled into making false predictions by adversarial attacks that implant tiny perturbations into the original input

which are imperceptible to the human eye. This poses a huge security threat to computer vision systems that are based on deep learning. Compared to digital-domain adversarial attacks

physical-domain adversarial attacks are enabled to introduce perturbations into the input before the adversarial input is captured by the acquisition device and converted into a binary image within the vision system

posing a real security threat to deep learning-based computer vision systems. Optical-based physical-domain adversarial attack techniques

such as those using projected irradiation as a typical example

are more likely to be overlooked and provided negligible protection due to their perturbations being very similar to effects produced by natural environments in the real world. Given their high degree of invisibility and executability

they could pose a significant or even fatal threat to real systems. Based on existing research work

the introduction and discussion of optical-based physical-domain adversarial attack techniques within computer vision systems were presented. The attack scenarios

tools

goals

and performances of these techniques were compared and analyzed. Potential future research directions for optical-based physical-domain adversarial attacks were also discussed.

关键词

Keywords

references

TAIGMAN Y , YANG M , RANZATO M , et al . DeepFace: closing the gap to human-level performance in face verification [C ] // Proceedings of the 2014 IEEE Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE Press , 2014 : 1701 - 1708 .

ZENG W Y , LUO W J , SUO S , et al . End-to-end interpretable neural motion planner [C ] // Proceedings of the 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . Piscataway : IEEE Press , 2019 : 8652 - 8661 .

YANG T , YI X L , LU S W , et al . Intelligent manufacturing for the process industry driven by industrial artificial intelligence [J ] . Engineering , 2021 , 7 ( 9 ): 1224 - 1230 .

RONNEBERGER O , FISCHER P , BROX T . U-net: convolutional networks for biomedical image segmentation [C ] // International Conference on Medical Image Computing and Computer-Assisted Intervention . Cham : Springer , 2015 : 234 - 241 .

LI Y J , XU X , XIAO J H , et al . Adaptive square attack: fooling autonomous cars with adversarial traffic signs [J ] . IEEE Internet of Things Journal , 2021 , 8 ( 8 ): 6337 - 6347 .

WEI H , TANG H , JIA X M , et al . Physical adversarial attack meets computer vision: a decade survey [EB ] . arXiv preprint , arXiv: 2209.15179 , 2022 .

EYKHOLT K , EVTIMOV I , FERNANDES E , et al . Robust physical-world attacks on deep learning visual classification [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . 2018 : 1625 - 1634 .

WEI X X , GUO Y , YU J . Adversarial sticker: a stealthy attack method in the physical world [J ] . IEEE Transactions on Pattern Analysis and Machine Intelligence , 2023 , 45 ( 3 ): 2711 - 2725 .

SHEN M , YU H , ZHU L H , et al . Effective and robust physical-world attacks on deep learning face recognition systems [J ] . IEEE Transactions on Information Forensics and Security , 2021 , 16 : 4063 - 4077 .

PAUL N , CHUNG C . Application of HDR algorithms to solve direct sunlight problems when autonomous vehicles using machine vision systems are driving into sun [J ] . Computers in Industry , 2018 , 98 : 192 - 196 .

ZHOU Z , TANG D , WANG X F , et al . Invisible mask: practical attacks on face recognition with infrared [J ] . arXiv preprint , arXiv: 1803.04683 , 2018 .

DUAN R J , MAO X F , QIN A K , et al . Adversarial laser beam: effective physical-world attack to DNNs in a blink [C ] // Proceedings of the 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . Piscataway : IEEE Press , 2021 : 16057 - 16066 .

SZEGEDY C , ZAREMBA W , SUTSKEVER I , et al . Intriguing properties of neural networks [EB ] . arXiv preprint , arXiv: 1312.6199 , 2013 .

DELDJOO Y , NOIA T D , MERRA F A . A survey on adversarial recommender systems: from attack/defense strategies to generative adversarial networks [J ] . ACM Computing Surveys (CSUR) , 2021 , 54 ( 2 ): 1 - 38 .

CHAKRABORTY A , ALAM M , DEY V , et al . A survey on adversarial attacks and defences [J ] . CAAI Transactions on Intelligence Technology , 2021 , 6 ( 1 ): 25 - 45 .

AKHTAR N , MIAN A . Threat of adversarial attacks on deep learning in computer vision: a survey [J ] . IEEE Access , 2018 , 6 : 14410 - 14430 .

LIANG H S , HE E L , ZHAO Y Y , et al . Adversarial attack and defense: a survey [J ] . Electronics , 2022 , 11 ( 8 ): 1283 .

AKHTAR N , MIAN A , KARDAN N , et al . Advances in adversarial attacks and defenses in computer vision: a survey [J ] . IEEE Access , 2021 ( 9 ): 155161 - 155196 .

ZHANG X W , ZHENG X L , MAO W J . Adversarial perturbation defense on deep neural networks [J ] . ACM Computing Surveys , 2022 , 54 ( 8 ): 1 - 36 .

GOODFELLOW I J , SHLENS J , SZEGEDY C . Explaining and harnessing adversarial examples [J ] . arXiv preprint , arXiv: 1412.6572 , 2014 .

ZHANG J L , LI C . Adversarial examples: opportunities and challenges [J ] . IEEE Transactions on Neural Networks and Learning Systems , 2020 , 31 ( 7 ): 2578 - 2593 .

CUBUK E D , ZOPH B , SCHOENHOLZ S S , et al . Intriguing properties of adversarial examples [EB ] . arXiv preprint , arXiv: 1711.02846 , 2017 .

PAPERNOT N , MCDANIEL P , JHA S , et al . The limitations of deep learning in adversarial settings [C ] // Proceedings of the 2016 IEEE European Symposium on Security and Privacy (EuroS&P) . Piscataway : IEEE Press , 2016 : 372 - 387 .

SU J W , VARGAS D V , SAKURAI K . One pixel attack for fooling deep neural networks [J ] . IEEE Transactions on Evolutionary Computation , 2019 , 23 ( 5 ): 828 - 841 .

ATHALYE A , CARLINI N , WAGNER D . Obfuscated gradients give a false sense of security: circumventing defenses to adversarial examples [J ] . arXiv preprint , arXiv: 1802.00420 , 2018 .

CARLINI N , WAGNER D . Towards evaluating the robustness of neural networks [C ] // Proceedings of the 2017 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2017 : 39 - 57 .

KURAKIN A , GOODFELLOW I J , BENGIO S . Adversarial examples in the physical world [M ] . Boca Raton, FL : CRC Press , 2018 : 99 - 112 .

YIN B J , WANG W X , YAO T P , et al . Adv-makeup: a new imperceptible and transferable attack on face recognition [EB ] . arXiv preprint , arXiv: 2105.03162 , 2021 .

LIU A S , WANG J K , LIU X L , et al . Bias-based universal adversarial patch attack for automatic check-out [C ] // European Conference on Computer Vision . Cham : Springer , 2020 : 395 - 410 .

HUANG L F , GAO C Y , ZHOU Y Y , et al . Universal physical camouflage attacks on object detectors [C ] // Proceedings of the 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . Piscataway : IEEE Press , 2020 : 717 - 726 .

HU Z H , HUANG S Y , ZHU X P , et al . Adversarial texture for fooling person detectors in the physical world [C ] // Proceedings of the 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . Piscataway : IEEE Press , 2022 : 13297 - 13306 .

NICHOLS N , JASPER R . Projecting trouble: light based adversarial attacks on deep learning classifiers [EB ] . arXiv preprint , arXiv: 1810.10337 , 2018 .

SHEN M , LIAO Z , ZHU L , et al . VLA: a practical visible light-based attack on face recognition systems in physical world [J ] . Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies , 2019 , 3 ( 3 ): 1 - 19 .

NGUYEN D L , ARORA S S , WU Y H , et al . Adversarial light projection attacks on face recognition systems: a feasibility study [C ] // Proceedings of the 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) . Piscataway : IEEE Press , 2020 : 3548 - 3556 .

SUN J C , CAO Y L , CHEN Q A , et al . Towards robust LiDAR-based perception in autonomous driving: general black-box adversarial sensor attack and countermeasures [EB ] . arXiv preprint , arXiv: 2006.16974 , 2020 .

MAN Y M , LI M , GERDES R . GhostImage: remote perception attacks against camera-based image classification systems [J ] . arXiv preprint , arXiv: 2001.07792 , 2020 .

LOVISOTTO G , TURNER H , SLUGANOVIC I , et al . SLAP: improving physical adversarial examples with short-lived adversarial perturbations [EB ] . arXiv preprint , arXiv: 2007.04137 , 2020 .

ZHU X P , LI X , LI J M , et al . Fooling thermal infrared pedestrian detectors in real world using small bulbs [J ] . Proceedings of the AAAI Conference on Artificial Intelligence , 2021 , 35 ( 4 ): 3616 - 3624 .

PONY R , NAEH I , MANNOR S . Over-the-air adversarial flickering attacks against video recognition networks [C ] // Proceedings of the 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . Piscataway : IEEE Press , 2021 : 515 - 524 .

GNANASAMBANDAM A , SHERMAN A M , CHAN S H . Optical adversarial attack [C ] // Proceedings of the 2021 IEEE/CVF International Conference on Computer Vision Workshops (ICCVW) . Piscataway : IEEE Press , 2021 : 92 - 101 .

HU C , WANG Y , TILIWALIDI K , et al . Adversarial laser spot: robust and covert physical-world attack to dnns [C ] // Asian Conference on Machine Learning . PMLR , 2023 : 483 - 498 .

ZHOU C , YAN Q B , SHI Y , et al . DoubleStar: long-range attack towards depth estimation based obstacle avoidance in autonomous systems [EB ] . arXiv preprint , arXiv: 2110.03154 , 2021 .

HU C Y , SHI W W , LI W . Adversarial neon beam: a light-based physical attack to DNNs [EB ] . arXiv preprint , arXiv: 2204.00853 , 2022 .

ZHONG Y Q , LIU X M , ZHAI D M , et al . Shadows can be dangerous: stealthy and effective physical-world adversarial attack by natural phenomenon [C ] // Proceedings of the 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . Piscataway : IEEE Press , 2022 : 15324 - 15333 .

HUANG B Y , LING H B . SPAA: stealthy projector-based adversarial attacks on deep image classifiers [C ] // Proceedings of the 2022 IEEE Conference on Virtual Reality and 3D User Interfaces (VR) . Piscataway : IEEE Press , 2022 : 534 - 542 .

DAIMO R Y , ONO S . Projection-based physical adversarial attack for monocular depth estimation [J ] . IEICE Transactions on Information and Systems , 2023 , 106.( 1 ): 31 - 35 .

WEN H , CHANG S , ZHOU L . Light projection-based physical-world vanishing attack against car detection [C ] // ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) . IEEE , 2023 : 1 - 5 .

LI Y J , LI Y Q , DAI X L , et al . Physical-world optical adversarial attacks on 3D face recognition [EB ] . arXiv preprint , arXiv: 2205.13412 , 2022 .

LI J C , SCHMIDT F R , KOLTER J Z . Adversarial camera stickers: a physical camera-based attack on deep learning systems [J ] . arXiv preprint , arXiv: 1904.00759 , 2019 .

MAN Y , LI M , Gerdes R . Poster: perceived adversarial examples [C ] // IEEE Symposium on Security and Privacy . 2019 .

ZOLFI A , KRAVCHIK M , ELOVICI Y , et al . The translucent patch: a physical and universal attack on object detectors [C ] // Proceedings of the 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . Piscataway : IEEE Press , 2021 : 15227 - 15236 .

SAYLES A , HOODA A , GUPTA M , et al . Invisible perturbations: physical adversarial examples exploiting the rolling shutter effect [C ] // Proceedings of the 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . Piscataway : IEEE Press , 2021 : 14661 - 14670 .

PHAN B , MANNAN F , HEIDE F . Adversarial imaging pipelines [C ] // Proceedings of the 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . Piscataway : IEEE Press , 2021 : 16046 - 16056 .

CHEN Z J , LIN P X , JIANG Z L , et al . An illumination modulation-based adversarial attack against automated face recognition system [C ] // International Conference on Information Security and Cryptology . Cham : Springer , 2021 : 53 - 69 .

HU C Y , SHI W W . Adversarial zoom lens: a novel physical-world attack to DNNs [J ] . arXiv preprint , arXiv: 2206.12251 , 2022 .

KIM K , KIM J , SONG S , et al . Engineering pupil function for optical adversarial attacks [J ] . Optics Express , 2022 , 30 ( 5 ): 6500 - 6518 .

HAYES J . On visible adversarial perturbations & digital watermarking [C ] // Proceedings of the 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) . Piscataway : IEEE Press , 2018 : 1678 - 16787 .

NASEER M , KHAN S , PORIKLI F . Local gradients smoothing: defense against localized adversarial attacks [C ] // Proceedings of the 2019 IEEE Winter Conference on Applications of Computer Vision (WACV) . Piscataway : IEEE Press , 2019 : 1300 - 1307 .

CHOU E , TRAMÈR F , PELLEGRINO G . SentiNet: detecting localized universal attacks against deep learning systems [C ] // Proceedings of the 2020 IEEE Security and Privacy Workshops (SPW) . Piscataway : IEEE Press , 2020 : 48 - 54 .

MCCOVD M , PARK W , CHEN S , et al . Minority reports defense: defending against adversarial patches [C ] // International Conference on Applied Cryptography and Network Security . Cham : Springer International Publishing , 2020 : 564 - 582 .

RAJU R , LIPASTI M . BlurNet: defense by filtering the feature maps [EB ] . arXiv preprint , arXiv: 1908.02256 , 2019 .

LI F T , LIU X K , ZHANG X L , et al . Detecting localized adversarial examples: a generic approach using critical region analysis [C ] // Proceedings of the IEEE INFOCOM 2021 - IEEE Conference on Computer Communications . Piscataway : IEEE Press , 2021 : 1 - 10 .

LIU J , LEVINE A , LAU C P , et al . Segment and complete: defending object detectors against adversarial patch attacks with robust patch detection [EB ] . arXiv preprint , arXiv: 2112.04532 , 2021 .

KANG C X , DONG Y P , WANG Z Y , et al . DIFFender: diffusion-based adversarial defense against patch attacks [EB ] . arXiv preprint , arXiv: 2306.09124 , 2023 .

WU T , TONG L , VOROBEYCHIK Y . Defending against physically realizable attacks on image classification [EB ] . arXiv preprint , arXiv: 1909.09552 , 2019 .

RAO S , STUTZ D , SCHIELE B . Adversarial training against location-optimized adversarial patches [M ] . Cham : Springer International Publishing , 2020 : 429 - 448 .

CHIANG P , NI R , ABDELKADER A , et al . Certified defenses for adversarial patches [EB ] . arXiv preprint arXiv: 2003.06693 , 2020 .

ZHANG Z Y , YUAN B , MCCOYD M , et al . Clipped BagNet: defending against sticker attacks with clipped bag-of-features [C ] // Proceedings of the 2020 IEEE Security and Privacy Workshops (SPW) . Piscataway : IEEE Press , 2020 : 55 - 61 .

LEVINE A , FEIZI S . (De)randomized smoothing for certifiable defense against patch attacks [J ] . arXiv preprint , arXiv: 2002.10733 , 2020 .

JI N , FENG Y F , XIE H D , et al . Adversarial YOLO: defense human detection patch attacks via detecting adversarial patches [EB ] . arXiv preprint , arXiv: 2103.08860 , 2021 .

METZEN J H , FINNIE N , HUTMACHER R . Meta adversarial training against universal patches [J ] . arXiv e-preprint , arXiv: 2101.11453 , 2021 .

MU N , WAGNER D . Defending against adversarial patches with robust self-attention [C ] // ICML 2021 Workshop on Uncertainty and Robustness in Deep Learning . 2021 .

XIANG C , BHAGOJI A N , SEHWAG V , et al . PatchGuard: a provably robust defense against adversarial patches via small receptive fields and masking [C ] // 30th USENIX Security Symposium (USENIX Security 21). 2021 : 2237 - 2254 .

HUANG Y , LI Y . Zero-shot certified defense against adversarial patches with vision transformers [EB ] . arXiv preprint , arXiv: 2111.10481 , 2021 .

METZEN J H , YATSURA M . Efficient certified defenses against patch attacks on image classifiers [EB ] . arXiv preprint , arXiv: 2102.04154 , 2021 .

HAN H S , XU K D , HU X , et al . ScaleCert: scalable certified defense against adversarial patches with sparse superficial layer [EB ] . arXiv preprint , arXiv: 2110.14120 , 2021 .

LO S Y , PATEL V M . Defending against multiple and unforeseen adversarial videos [J ] . IEEE Transactions on Image Processing , 2022 , 31 : 962 - 973 .

CHEN Z , LI B , XU J , et al . Towards practical certifiable patch defense with vision transformer [C ] // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 2022 : 15148 - 15158 .

SALMAN H , JAIN S , WONG E , et al . Certified patch robustness via smoothed vision transformers [C ] // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 2022 : 15137 - 15147 .

YATSURA M , SAKMANN K , HUA N G , et al . Certified defences against adversarial patch attacks on semantic segmentation [EB ] . arXiv preprint , arXiv: 2209.05980 , 2022 .

GUREL N M , QI X , RIMANIC L , et al . Knowledge enhanced machine learning pipeline against diverse adversarial attacks [C ] // International Conference on Machine Learning . PMLR , 2021 : 3976 - 3987 .

CHEN X Y , LI X Y , ZHOU Y , et al . DDDM: a brain-inspired framework for robust classification [EB ] . arXiv preprint , arXiv: 2205.10117 , 2022 .

DZIUGAITE G K , GHAHRAMANI Z . A study of the effect of JPG compression on adversarial images [EB ] . arXiv , preprint, arXiv: 1608.00853 , 2016 .

GUO C , RANA M , CISSE M , et al . Countering adversarial images using input transformations [EB ] . arxXiv preprint arXiv: 1711.00117 , 2017 .

JIA X J , WEI X X , CAO X C , et al . ComDefend: an efficient image compression model to defend adversarial examples [C ] // Proceedings of the 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . Piscataway : IEEE Press , 2019 : 6077 - 6085 .

NIE W , GUO B , HUANG Y , et al . Diffusion models for adversarial purification [EB ] . arXiv preprint , arXiv: 2205.07460 , 2022 .

COHEN J M , ROSENFELD E , KOLTER J Z . Certified adversarial robustness via randomized smoothing [J ] . CoRR , 2019 , abs/1902. 02918 : 1310 - 1320 .

DONG Q L , CAO C J , FU Y W . Incremental transformer structure enhanced image inpainting with masking positional encoding [C ] // Proceedings of the 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . Piscataway : IEEE Press , 2022 : 11348 - 11358 .

CARLINI N , WAGNER D . Towards evaluating the robustness of neural networks [C ] // Proceedings of the 2017 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2017 : 39 - 57 .

GOODFELLOW I J , SHLENS J , SZEGEDY C . Explaining and harnessing adversarial examples [EB ] . arXiv preprint , arXiv: 1412.6572 , 2014 .

MADRY A , MAKELOV A , SCHMIDT L , et al . Towards deep learning models resistant to adversarial attacks [EB ] . arXiv preprint , arXiv: 1706.06083 , 2017 .

ZHAO S J , WANG X Z , WEI X X . Mitigating the accuracy-robustness trade-off via multi-teacher adversarial distillation [EB ] . arXiv preprint , arXiv: 2306.16170 , 2023 .

BRENDEL W , BETHGE M . Approximating CNNs with Bag-of-local-Features models works surprisingly well on ImageNet [EB ] . arXiv preprint , arXiv: 1904.00760 , 2019 .

DOSOVITSKIY A , BEYER L , KOLESNIKOV A , et al . An image is worth 16x16 words: transformers for image recognition at scale [J ] . arXiv preprint , arXiv: 2010.11929 , 2020 .

WEI X X , ZHAO S J . Revisiting the trade-off between accuracy and robustness via weight distribution of filters [EB ] . arXiv preprint , arXiv: 2306.03430 , 2023 .

WONG E , KOLTER Z . Provable defenses against adversarial examples via the convex outer adversarial polytope [C ] // International conference on machine learning . PMLR , 2018 : 5286 - 5295 .

GOWAL S , DVIJOTHAM K D , STANFORTH R , et al . Scalable verified training for provably robust image classification [C ] // Proceedings of the IEEE/CVF International Conference on Computer Vision . 2019 : 4842 - 4851 .

ELSAYED G , SHANKAR S , CHEUNG B , et al . Adversarial examples that fool both computer vision and time-limited humans [J ] . Advances in Neural Information Processing Systems , 2018 , 31 .

ROITMAN J D , SHADLEN M N . Response of neurons in the lateral intraparietal area during a combined visual discrimination reaction time task [J ] . The Journal of Neuroscience , 2002 , 22 ( 21 ): 9475 - 9489 .

HINTON G E , SRIVASTAVA N , KRIZHEVSKY A , et al . Improving neural networks by preventing co-adaptation of feature detectors [EB ] . arXiv preprint , arXiv: 1207.0580 , 2012 .

KRIZHEVSKY A , HINTON G . Learning multiple layers of features from tiny images [J ] . 2009 .

STALLKAMP J , SCHLIPSING M , SALMEN J , et al . Man vs . computer: benchmarking machine learning algorithms for traffic sign recognition [J ] . Neural Networks , 2012 , 32 : 323 - 332 .

RUSSAKOVSKY O , DENG J , SU H , et al . ImageNet large scale visual recognition challenge [J ] . International Journal of Computer Vision , 2015 , 115 ( 3 ): 211 - 252 .

LIN T Y , MAIRE M , BELONGIE S , et al . Microsoft COCO: common objects in context [M ] . Cham : Springer International Publishing , 2014 : 740 - 755 .

KARPATHY A , TODERICI G , SHETTY S , et al . Large-scale video classification with convolutional neural networks [C ] // Proceedings of the 2014 IEEE Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE Press , 2014 : 1725 - 1732 .

YU F , XIAN W , CHEN Y , et al . Bdd100k: a diverse driving video database with scalable annotation tooling [EB ] . arXiv preprint , arXiv: 1805 .04687, 2 ( 5 ): 6 , 2018 .

YI D , LEI Z , LIAO S C , et al . Learning face representation from scratch [EB ] . arXiv preprint , arXiv: 1411.7923 , 2014 .

LIU Z W , LUO P , WANG X G , et al . Deep learning face attributes in the wild [C ] // Proceedings of the 2015 IEEE International Conference on Computer Vision (ICCV) . Piscataway : IEEE Press , 2015 : 3730 - 3738 .

GEIGER A , LENZ P , URTASUN R . Are we ready for autonomous driving? The KITTI vision benchmark suite [C ] // Proceedings of the 2012 IEEE Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE Press , 2012 : 3354 - 3361 .

MAYER N , ILG E , HÄUSSER P , et al . A large dataset to train convolutional networks for disparity, optical flow, and scene flow estimation [C ] // Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) . Piscataway : IEEE Press , 2016 : 4040 - 4048 .

曹灿 , 司强 , 游雪松 , 等 . 针对人脸识别的物理对抗攻击研究综述 [J ] . 数据与计算发展前沿 , 2023 , 5 ( 3 ): 49 - 65 .

CAO C , SI Q , YOU X S , et al . A survey on physical adversarial attacks towards face recognition [J ] . Frontiers of Data & Computing , 2023 , 5 ( 3 ): 49 - 65 .

马晨 , 沈超 , 蔺琛皓 , 等 . 针对自动驾驶智能模型的攻击与防御 [J ] . 计算机学报 , 2024 : 1 - 22 .

MA C , SHEN C , LIN C H , et al . Attacks and defenses for autonomous driving intelligence models [J ] . Chinese Journal of Computers , 2024 : 1 - 22 .

CZAJA W , FENDLEY N , PEKALA M , et al . Adversarial examples in remote sensing [C ] // Proceedings of the 26th ACM SIGSPATIAL International Conference on Advances in Geographic Information Systems . 2018 : 408 - 411 .

ADHIKARI A , HOLLANDER R D , TOLIOS I , et al . Adversarial patch camouflage against aerial detection [C ] // Artificial Intelligence and Machine Learning in Defense Applications II . SPIE , 2020 , 11543 : 77 - 86 .

DU A , CHEN B , CHIN T J , et al . Physical adversarial attacks on an aerial imagery object detector [EB ] . arXiv preprint , arXiv: 2108.11765 , 2021 .

浏览量

137

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

深度学习中对抗样本的构造及防御研究

基于双路特征提取和自适应融合的钓鱼网站检测

DNS异常检测：大规模实验分析

FL-IoV：基于联邦学习的综合车联网入侵检测方法

基于分层结构的多任务对抗样本归因方法