基于分层结构的多任务对抗样本归因方法

孙旭; 张文琼; 龙显忠; 李云

doi:10.11959/j.issn.2096-109x.2025009

您当前的位置：

首页 >

文章列表页 >

基于分层结构的多任务对抗样本归因方法

学术论文 | 更新时间：2025-03-20

- 基于分层结构的多任务对抗样本归因方法
- Multi-task adversarial attribution method based on hierarchical structure
- 网络与信息安全学报 2025年11卷第1期页码：92-105
- 作者机构：
  
  南京邮电大学计算机学院，江苏南京 210023
- 作者简介：
  
  [ "孙旭（1999- ），男，江苏连云港人，南京邮电大学硕士生，主要研究方向为对抗样本归因、对抗样本检测。" ]
  [ "张文琼（1998- ），女，山东日照人，南京邮电大学博士生，主要研究方向为机器学习公平性、因果推断。" ]
  [ "龙显忠（1985- ），男，河南信阳人，南京邮电大学副教授，主要研究方向为自监督学习、对抗机器学习。" ]
  [ "李云（1974- ），男，安徽安庆人，南京邮电大学教授、博士生导师，主要研究方向为对抗机器学习、数据挖掘、自然语言处理、模式识别。" ]
- 基金信息：
  
  国家自然科学基金(62476137)
- DOI：10.11959/j.issn.2096-109x.2025009
  中图分类号： TP18
- 收稿：2024-07-30，
  
  修回：2024-09-14，
  
  纸质出版：2025-02-25
- 稿件说明：
移动端阅览
孙旭, 张文琼, 龙显忠, 等. 基于分层结构的多任务对抗样本归因方法[J]. 网络与信息安全学报, 2025, 11(1): 92-105.

SUN X, ZHANG W Q, LONG X Z, et al. Multi-task adversarial attribution method based on hierarchical structure[J]. Chinese Journal of Network and Information Security, 2025, 11(1): 92-105.
孙旭, 张文琼, 龙显忠, 等. 基于分层结构的多任务对抗样本归因方法[J]. 网络与信息安全学报, 2025, 11(1): 92-105. DOI： 10.11959/j.issn.2096-109x.2025009.

SUN X, ZHANG W Q, LONG X Z, et al. Multi-task adversarial attribution method based on hierarchical structure[J]. Chinese Journal of Network and Information Security, 2025, 11(1): 92-105. DOI： 10.11959/j.issn.2096-109x.2025009.

摘要

深度神经网络在计算机视觉的各种任务中表现出优异的性能。然而，它们非常容易受到对抗攻击的威胁，这种攻击是在推理阶段向样本中加入人眼难以察觉的扰动来完成的。为了防御对抗攻击，目前已有部分工作研究对抗样本的欺骗逆向工程，这也被称为对抗样本归因。通过归因生成对抗样本的攻击算法和受害者模型，能够帮助防御者掌握攻击者拥有的知识及其攻击目标，从而设计针对相应攻击最有效的防御算法。已有方法更多地把对抗样本归因转化为单任务学习。随着攻击算法和受害者模型可取范围的扩大，单任务学习面临着组合爆炸问题。为了提升对抗样本归因的准确率及满足不同归因粒度的需求，对攻击算法和受害者模型进行了分层，并利用不同层次之间的依赖关系，提出了一种基于分层结构的多任务对抗样本归因方法。该方法在不同层次同时执行攻击算法和受害者模型的归因任务，并使用分层路径预测学习不同层次之间的依赖关系。实验结果表明，相比其他归因方法，所提方法能够获得更好的归因效果。

Abstract

Deep neural networks have demonstrated superior performance in various computer vision tasks. However

they have been found to be highly susceptible to adversarial attacks

which involve the addition of perturbations to examples during the inference phase that are imperceptible to the human eye. To defend against adversarial attacks

some works have explored the reverse engineering of adversarial examples

known as the adversarial attribution problem. By attributing the attack algorithm and victim model used to generate adversarial examples

defenders can gain insights into the attacker’s knowledge and targets

thereby enabling the design of more effective defense algorithms against corresponding attacks. Existing methods have mostly approached the adversarial attribution problem as a single-task learning problem. However

as the scope of attack algorithms and victim models has expanded

single-task learning has faced the challenge of combinatorial explosion. To improve the accuracy of adversarial attribution and meet the requirements for different attribution granularities

attack algorithms and victim models were layered

and the dependencies between different levels were utilized. A multi-task adversarial attribution method based on a hierarchical structure was proposed. This method simultaneously performed the attribution tasks of attack algorithms and victim models at different levels and employed hierarchical path prediction to learn the dependencies between these levels. Experimental results on multiple datasets demonstrate that the proposed method achieves better attribution performance compared to other attribution methods.

关键词

Keywords

references

HE K M , ZHANG X Y , REN S Q , et al . Deep residual learning for image recognition [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE Press , 2016 : 770 - 778 .

LONG J , SHELHAMER E , DARRELL T . Fully convolutional networks for semantic segmentation [C ] // Proceedings of the IEEE Conference On Computer Vision and Pattern Recognition . Piscataway : IEEE Press , 2015 : 3431 - 3440 .

GIRSHICK R , DONAHUE J , DARRELL T , et al . Rich feature hierarchies for accurate object detection and semantic segmentation [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE Press , 2014 : 580 - 587 .

SZEGEDY C , ZAREMBA W , SUTSKEVER I , et al . Intriguing properties of neural networks [C ] // Proceedings of the 2nd International Conference on Learning Representations . 2014 : 1 - 10 .

潘文雯 , 王新宇 , 宋明黎 , 等 . 对抗样本生成技术综述 [J ] . 软件学报 , 2020 , 31 ( 1 ): 67 - 81 .

PAN W W , WANG X Y , SONG M L , et al . Survey on generating adversarial examples [J ] . Journal of Software , 2020 , 31 ( 1 ): 67 - 81 .

GOODFELLOW I J , SHLENS J , SZEGEDY C . Explaining and harnessing adversarial examples [C ] // Proceedings of the International Conference on Learning Representations . 2018 : 1 - 11 .

KURAKIN A , GOODFELLOW I J , BENGIO S . Artificial intelligence safety and security [M ] . New York : Chapman and Hall/CRC , 2018 : 99 - 112 .

MADRY A , MAKELOV A , SCHMIDT L , et al . Towards deep learning models resistant to adversarial attacks [C ] // Proceedings of the 6th International Conference on Learning Representations . 2018 : 1 - 28 .

GUO C , GARDNER J , YOU Y R , et al . Simple black-box adversarial attacks [C ] // Proceedings of the 36th International Conference on Machine Learning . 2019 : 2484 - 2493 .

ANDRIUSHCHENKO M , CROCE F , FLAMMARION N , et al . Square attack: a query-efficient black-box adversarial attack via random search [C ] // Proceedings of European Conference on Computer Vision . 2020 : 484 - 501 .

BRENDEL W , RAUBER J , BETHGE M . Decision-based adversarial attacks: reliable attacks against black-box machine learning models [C ] // Proceedings of the 6th International Conference on Learning Representations . 2018 : 1 - 12 .

严飞 , 张铭伦 , 张立强 . 基于边界值不变量的对抗样本检测方法 [J ] . 网络与信息安全学报 , 2020 , 6 ( 1 ): 38 - 45 .

YAN F , ZHANG M L , ZHANG L Q . Adversarial examples detection method based on boundary values invariants [J ] . Chinese Journal of Network and Information Security , 2020 , 6 ( 1 ): 38 - 45 .

刘西蒙 , 谢乐辉 , 王耀鹏 , 等 . 深度学习中的对抗攻击与防御 [J ] . 网络与信息安全学报 , 2020 , 6 ( 5 ): 36 - 53 .

LIU X M , XIE L H , WANG Y P , et al . Adversarial attacks and defenses in deep learning [J ] . Chinese Journal of Network and Information Security , 2020 , 6 ( 5 ): 36 - 53 .

GUO Z Y , HAN K J , GE Y , et al . Attribution of adversarial attacks via multi-task learning [C ] // Proceedings of the 30th International Conference on Neural Information Processing . Singapore : Springer Nature Singapore , 2023 : 81 - 94 .

NICHOLSON D A , EMANUELE V . Reverse engineering adversarial attacks with fingerprints from adversarial examples [J ] . arXiv preprint arXiv: 2301.13869 , 2023 .

MOOSAVI-DEZFOOLI S M , FAWZI A , FROSSARD P . Deepfool: a simple and accurate method to fool deep neural networks [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE Press , 2016 : 2574 - 2582 .

CARLINI N , WAGNER D . Towards evaluating the robustness of neural networks [C ] // Proceedings of the IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2017 : 39 - 57 .

MOOSAVI-DEZFOOLI S M , FAWZI A , FAWZI O , et al . Universal adversarial perturbations [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE Press , 2017 : 1765 - 1773 .

CO K T , MUÑOZ-GONZÁLEZ L , KANTHAN L , et al . Universal adversarial robustness of texture and shape-biased models [C ] // Proceedings of 2021 IEEE International Conference on Image Processing (ICIP) . Piscataway : IEEE Press , 2021 : 799 - 803 .

MOAYERI M , FEIZI S . Sample efficient detection and classification of adversarial attacks via self-supervised embeddings [C ] // Proceedings of the IEEE/CVF International Conference on Computer Vision . Piscataway : IEEE Press , 2021 : 7677 - 7686 .

DOTTER M , XIE S , MANVILLE K , et al . Adversarial attack attribution: discovering attributable signals in adversarial ML attacks [C ] // Proceedings of the 35th AAAI Conference on Artificial Intelligence Workshop . 2021 : 1 - 9 .

LI Y . Supervised classification on deep neural network attack toolchains [D ] . Boston : Northeastern University , 2021 .

GUO C , RANA M , CISSE M , et al . Countering adversarial images using input transformations [C ] // Proceedings of International Conference on Learning Representations . 2018 : 1 - 12 .

GUO X , LIU X H , REN Z Y , et al . Hierarchical fine-grained image forgery detection and localization [C ] // Proceedings of the IEEE CVF Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE Press , 2023 : 3155 - 3165 .

KENDALL A , GAL Y , CIPOLLA R . Multi-task learning using un certainty to weigh losses for scene geometry and semantics [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE Press , 2018 : 7482 - 7491 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于双路特征提取和自适应融合的钓鱼网站检测

DNS异常检测：大规模实验分析

FL-IoV：基于联邦学习的综合车联网入侵检测方法

彩色图像隐写分析研究进展

面向强稀疏性移动社交网络的链路预测深度学习方法