• 论文 • 上一篇    下一篇

一种面向图像识别的神经网络通用扰动生成算法

李祥坤1,杨争峰1,曾霞2,刘志明2   

  1. 1. 华东师范大学计算机科学与软件工程学院,上海 200062;2. 西南大学计算机与信息科学学院, 重庆 400715
  • 出版日期:2019-12-25 发布日期:2020-03-20

李祥坤,杨争峰,曾霞,刘志明. 一种面向图像识别的神经网络通用扰动生成算法[J]. 系统科学与数学, 2019, 39(12): 1944-1963.

LI Xiangkun, YANG Zhengfeng, ZENG Xia, LIU Zhiming. An Approach to Generate Universal Adversarial Perturbation for Deep Neural Networks in Image Recognization[J]. Journal of Systems Science and Mathematical Sciences, 2019, 39(12): 1944-1963.

An Approach to Generate Universal Adversarial Perturbation for Deep Neural Networks in Image Recognization

LI Xiangkun1, YANG Zhengfeng1 ,ZENG Xia2 ,LIU Zhiming2   

  1. 1.School of Computer Science and Software Engineering, East China Normal University,  Shanghai 200062; 2. College of Computer and Information Science, Southwest University, Chongqing 400715
  • Online:2019-12-25 Published:2020-03-20

近年来, 基于深度神经网络的图像识别技术表现出良好的性能, 然而研究表明神经网络容易受到对抗扰动攻击而发生分类错误, 施加一个小的通用扰动就能使神经网络在整个数据集上失效. 为构建更加健壮的神经网络, 对通用扰动生成的研究显得至关重要. 通用扰动生成问题要求得到一个扰动向量对整个数据集产生指定扰动率的攻击效果, 相较于单张图片扰动生成问题其约束条件更严格, 计算难度更大. 目前已有算法得到的通用扰动范数较大, 容易被人眼识别. 文章基于优化理论提出新的通用扰动生成算法, 在达到指定扰动率的同时能产生更小的通用扰动. 算法结合PCA降维思想克服了问题的规模性带来的困难; 然后利用单张对抗扰动向量的均值叠加随机噪声, 得到满足扰动率的初始通用扰动; 最后改进梯度下降方法在保证扰动率的同时得到更小的通用扰动. 实验表明, 该方法可有效攻击各类先进神经网络: 在达到相同扰动率的情况下, 所得通用扰动的范数较Uni. Perturbation算法的结果平均降低了54\%.

Recently, image recognization based on deep neural network has achieved good performance. However, research shows that neural networks are susceptible to adversarial attacks in the form of small perturbations to images, and a universal adversarial perturbation can even fool a network on the complete data set. Therefore, it is necessary to study the universal perturbation generation problem for constructing more robust neural networks. Universal perturbation generation aims to find a single pertubation that attacks the whole data set. Compared with image-specific pertubation generation, it requires more strict constraints and has higher computational complexity. Current methods produce universal perturbations with large norms perceptible to human vision. Based on optimization theory, this paper presents a new method which computes smaller universal perturbations under specified perturbation rate. The poposed algorithm first incorporates PCA (principal component analysis) to reduce problem dimension for good scalability; then by the superposition of mean image-specific pertubation and random noise, an initial universal perturbation satisfying the perturbation rate requirement can be obtained; finally, the norm of universal perburtation is reduced based on improved gradient descent method. Experiments demonstrate that the proposed approach can attack various state-of-the-art neural networks effectively: With the same pertubation rate, the norm of the pertubation given by the proposed method is 54\% smaller than the Uni. Perturbation algorithm on average.

()
No related articles found!
阅读次数
全文


摘要