车牌识别系统中基于特征不变量的对抗检测

朱孝羽; 唐鹏; 张浩臣; 邱卫东; 黄征

doi:10.11959/j.issn.2096-109x.2024080

您当前的位置：

首页 >

文章列表页 >

车牌识别系统中基于特征不变量的对抗检测

学术论文 | 更新时间：2025-02-06

- 车牌识别系统中基于特征不变量的对抗检测
- Adversarial detection based on feature invariant in license plate recognition systems
- 网络与信息安全学报 2024年10卷第6期页码：59-70
- 作者机构：
  
  上海交通大学网络空间安全学院，上海 200240
- 作者简介：
  
  [ "朱孝羽（2000- ），女，湖北宜昌人，上海交通大学硕士生，主要研究方向为人工智能安全、联邦学习。" ]
  [ "唐鹏（1992- ），男，江西抚州人，上海交通大学助理研究员，主要研究方向为人工智能安全、隐私保护。" ]
  [ "张浩臣（1999- ），男，江西九江人，上海交通大学硕士生，主要研究方向为人工智能安全。" ]
  [ "邱卫东（1973- ），男，江西修水人，上海交通大学教授、博士生导师，主要研究方向为计算机取证、密码分析、人工智能安全、大数据隐私保护。" ]
  [ "黄征（1975- ），男，四川南充人，博士，上海交通大学副教授，主要研究方向为隐私保护、计算机视觉、人工智能安全。" ]
- 基金信息：
  
  国家重点研发计划;The National Key R＆D Program of China(2023YFB3106501)
- DOI：10.11959/j.issn.2096-109x.2024080
  中图分类号： TP393
- 收稿：2024-01-20，
  
  修回：2024-03-19，
  
  纸质出版：2024-12-25
- 稿件说明：
移动端阅览
朱孝羽, 唐鹏, 张浩臣, 等. 车牌识别系统中基于特征不变量的对抗检测[J]. 网络与信息安全学报, 2024, 10(6): 59-70.

ZHU X Y, TANG P, ZHANG H C, et al. Adversarial detection based on feature invariant in license plate recognition systems[J]. Chinese Journal of Network and Information Security, 2024, 10(6): 59-70.
朱孝羽, 唐鹏, 张浩臣, 等. 车牌识别系统中基于特征不变量的对抗检测[J]. 网络与信息安全学报, 2024, 10(6): 59-70. DOI： 10.11959/j.issn.2096-109x.2024080.

ZHU X Y, TANG P, ZHANG H C, et al. Adversarial detection based on feature invariant in license plate recognition systems[J]. Chinese Journal of Network and Information Security, 2024, 10(6): 59-70. DOI： 10.11959/j.issn.2096-109x.2024080.

摘要

深度神经网络已成为人们日常生活的重要部分。但研究人员发现，深度神经网络容易受到对抗样本的威胁，使网络模型发生错误分类等异常行为。对抗样本的存在极大地威胁了深度神经网络的应用，特别是在对于安全性需求非常敏感的场景，如车牌识别系统。目前，大部分现有的对抗样本防御和检测技术对某些特定类型的对抗攻击可以呈现出很好的效果，但通常情况下，它们并不能对所有类型的对抗攻击都具有通用性。针对真实场景下车牌识别系统的对抗样本攻击，通过分析神经网络在干净样本上训练的内在变化和干净样本之间的维度复杂度，提出了基于神经网络不变量和局部固有维数不变量的特征不变量无监督对抗样本检测系统，称为特征不变量对抗检测（feature invariant adversarial detection， FIAD）。该研究将本检测系统部署到广泛使用的开源车牌识别系统HyperLPR和EasyPR中，并以真实的中国车牌数据集（Chinese city parking dataset， CCPD）对该检测系统进行了广泛的实验。对11种不同类型的攻击进行实验，结果表明，相比其他4种先进的检测方法，FIAD可以在更低的假阳率下有效地检测所有攻击，且平均检测准确率始终高达99%。因此，FIAD对各种类型的对抗攻击具有良好的通用性。

Abstract

Deep neural networks have become an integral part of people's daily lives. However

researchers observed that these networks were susceptible to threats from adversarial samples

leading to abnormal behaviors such as misclassification by the network model. The presence of adversarial samples poses a significant threat to the application of deep neural networks

especially in security-sensitive scenarios like license plate recognition systems. Presently

most existing defense and detection technologies against adversarial samples show promising results for specific types of adversarial attacks. However

they often lack generality in addressing all types of adversarial attacks. In response to adversarial sample attacks on real-world license plate recognition systems

an unsupervised adversarial sample detection system named FIAD was proposed

which was based on analyzing the inherent variations in neural networks trained on clean samples and the dimensional complexity between clean samples. FIAD utilized neural network invariants and local intrinsic dimensionality invariants for effective sample detection. The detection system was deployed into widely used open-source license plate recognition systems

HyperLPR and EasyPR

and extensive experiments were conducted using the real dataset CCPD. The results from experiments involving 11 different types of attacks indicate that

compared to 4 other advanced detection methods

FIAD can effectively detect all these attacks at a lower false positive rate

with an accuracy consistently reaching 99%. Therefore

FIAD exhibits good generality against various types of adversarial attacks.

关键词

Keywords

references

ZHAO H S , JIA J Y , KOLTUN V . Exploring self-attention for image recognition [C ] // Proceedings of the 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . Piscataway : IEEE Press , 2020 : 10073 - 10082 .

LI J Y . Recent advances in end-to-end automatic speech recognition [EB ] . arXiv Preprint , arXiv: 2111.01690 , 2022 .

LUO W H , XING J L , MILAN A , et al . Multiple object tracking: a literature review [J ] . Artificial Intelligence , 2021 ( 293 ): 103448 .

GEHR T , MIRMAN M , DRACHSLER-COHEN D , et al . AI2: safety and robustness certification of neural networks with abstract interpretation [C ] // Proceedings of the 2018 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2018 : 3 - 18 .

YAN J , YU J , XIAOXIAO . HyperLPR3 - high performance license plate recognition framework [EB ] . 2023 .

LIURUOZE , MICOOZ , JSXYHELU , et al . An easy, flexible, and accurate plate recognition project for Chinese licenses in unconstrained situations [EB ] . 2023 .

GOODFELLOW L J , SHLENS J , SZEGEDY C . Explaining and harnessing adversarial examples [EB ] . arXiv PreprintarXiv: 1412.6572 , 2014 .

ALDAHDOOH A , HAMIDOUCHE W , FEZZA S A , et al . Adversarial example detection for DNN models: a review and experimental comparison [J ] . Artificial Intelligence Review , 2022 , 55 ( 6 ): 4403 - 4462 .

MADRY A , MAKELOV A , SCHMIDT L , et al . Towards deep learning models resistant to adversarial attacks [EB ] . arXiv Preprint arXiv: 1706.06083 , 2017 .

BORKAR T , HEIDE F , KARAM L . Defending against universal attacks through selective feature regeneration [C ] // Proceedings of the 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . Piscataway : IEEE Press , 2020 : 706 - 716 .

LIAO F Z , LIANG M , DONG Y P , et al . Defense against adversarial attacks using high-level representation guided denoiser [C ] // Proceedings of the 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE Press , 2018 : 1778 - 1787 .

PAPERNOT N , MCDANIEL P , GOODFELLOW I , et al . Practical black-box attacks against machine learning [C ] // Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security . New York : ACM , 2017 : 506 - 519 .

PAPERNOT N , MCDANIEL P , JHA S , et al . The limitations of deep learning in adversarial settings [C ] // Proceedings of the 2016 IEEE European Symposium on Security and Privacy (EuroS&P) . Piscataway : IEEE Press , 2016 : 372 - 387 .

MA X J , LI B , WANG Y S , et al . Characterizing adversarial subspaces using local intrinsic dimensionality [EB ] . arXiv Preprint arXiv: 1801.02613 , 2018 .

XU W L , EVANS D , QI Y J . Feature squeezing: detecting adversarial examples in deep neural networks [C ] // Proceedings 2018 Network and Distributed System Security Symposium . Reston, VA : Internet Society , 2018 .

MA S Q , LIU Y Q , TAO G H , et al . NIC: detecting adversarial samples with neural network invariant checking [C ] // Proceedings 2019 Network and Distributed System Security Symposium . Reston, VA : Internet Society , 2019 .

XU Z B , YANG W , MENG A J , et al . Towards end-to-end license plate detection and recognition: a large dataset and baseline [C ] // Proceedings of the Computer Vision-ECCV 2018: 15th European Conference , Munich, Germany, September 8-14, 2018 , Proceedings, Part XIII . New York : ACM , 2018 : 261 - 277 .

CARLINI N , WAGNER D . Towards evaluating the robustness of neural networks [C ] // Proceedings of the 2017 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2017 : 39 - 57 .

KURAKIN A , GOODFELLOW L , BENGIO S . Adversarial examples in the physical world [M ] . Artificial Intelligence Safety and Security : Chapman and Hall/CRC Press , 2018 .

MOOSAVI-DEZFOOLI S M , FAWZI A , FROSSARD P . DeepFool: a simple and accurate method to fool deep neural networks [C ] // Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) . Piscataway : IEEE Press , 2016 : 2574 - 2582 .

PEI K X , CAO Y Z , YANG J F , et al . DeepXplore: automated whitebox testing of deep learning systems [C ] // Proceedings of the 26th Symposium on Operating Systems Principles . New York : ACM , 2017 : 1 - 18 .

LIU Y Q , MA S Q , AAFER Y , et al . Trojaning attack on neural networks [C ] // Proceedings 2018 Network and Distributed System Security Symposium . Reston, VA : Internet Society , 2018 .

MAO X F , CHEN Y F , WANG S H , et al . Composite adversarial attacks [C ] // Proceedings of the AAAI Conference on Artificial Intelligence , 2021 , 35 ( 10 ): 8884 - 8892 .

MUSTAFA A , KHAN S H , HAYAT M , et al . Image super-resolution as a defense against adversarial attacks [J ] . IEEE Transactions on Image Processing: A Publication of the IEEE Signal Processing Society , 2019 : 1711 - 1724 .

KHERCHOUCHE A , FEZZA S A , HAMIDOUCHE W , et al . Detection of adversarial examples in deep neural networks with natural scene statistics [C ] // Proceedings of the 2020 International Joint Conference on Neural Networks (IJCNN) . Piscataway : IEEE Press , 2020 : 1 - 7 .

ZUO F , ZENG Q . Exploiting the sensitivity of L2 adversarial examples to erase-and-restore [C ] // Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security . New York : ACM , 2021 : 40 - 51 .

ALDAHDOOH A , HAMIDOUCHE W , DÉFORGES O . Revisiting model's uncertainty and confidences for adversarial example detection [J ] . Applied Intelligence , 2023 , 53 ( 1 ): 509 - 531 .

LI X , LI F X . Adversarial examples detection in deep networks with convolutional filter statistics [C ] // Proceedings of the 2017 IEEE International Conference on Computer Vision (ICCV) . Piscataway : IEEE Press , 2017 : 5775 - 5783 .

COHEN G , SAPIRO G , GIRYES R . Detecting adversarial samples using influence functions and nearest neighbors [C ] // Proceedings of the 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . Piscataway : IEEE Press , 2020 : 14441 - 14450 .

LIANG B , LI H C , SU M Q , et al . Detecting adversarial image examples in deep neural networks with adaptive noise reduction [J ] . IEEE Transactions on Dependable and Secure Computing , 2021 , 18 ( 1 ): 72 - 85 .

ENISER H F , CHRISTAKIS M , WÜSTHOLZ V . RAID: randomized adversarial-input detection for neural networks [EB ] . arXiv Preprint arXiv: 2002.02776 , 2020 .

MENG D Y , CHEN H . MagNet: a two-pronged defense against adversarial examples [C ] // Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2017 : 135 - 147 .

FREITAS S , CHEN S T , WANG Z J , et al . UnMask: adversarial detection and defense through robust feature alignment [C ] // Proceedings of the 2020 IEEE International Conference on Big Data . Piscataway : IEEE Press , 2020 : 1081 - 1088 .

BIGGIO B , ROLI F . Wild patterns: ten years after the rise of adversarial machine learning [J ] . Pattern Recognition , 2018 , 84 ( C ): 317 - 331 .

AMSALEG L , CHELLY O , FURON T , et al . Estimating local intrinsic dimensionality [C ] // Proceedings of the 21th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining . New York : ACM , 2015 : 29 - 38 .

ALAM S , SONBHADRA S K , AGARWAL S , et al . One-class support vector classifiers: a survey [J ] . Knowledge-Based Systems , 2020 ( 196 ): 105754 .

QIAN Y G , MA D F , WANG B , et al . Spot evasion attacks: adversarial examples for license plate recognition systems with convolutional neural networks [J ] . Computers & Security , 2020 , 95 : 101826 .

ZHANG J , XIE Z , SUN J , et al . CSUST Chinese traffic sign detection benchmark [EB ] . 2024 .

ZHANG J M , WANG W , LU C Q , et al . Lightweight deep network for traffic sign classification [J ] . Annals of Telecommunications , 2020 , 75 ( 7 ): 369 - 379 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

针对车牌识别系统的双重对抗攻击

载体独立的深度光照水印算法

基于深度神经网络的Android恶意软件检测方法

面向深度神经网络的安全计算协议设计方法