• 论文 •

### 一种面向图像识别的神经网络通用扰动生成算法

1. 1. 华东师范大学计算机科学与软件工程学院,上海 200062;2. 西南大学计算机与信息科学学院, 重庆 400715
• 出版日期:2019-12-25 发布日期:2020-03-20

LI Xiangkun, YANG Zhengfeng, ZENG Xia, LIU Zhiming. An Approach to Generate Universal Adversarial Perturbation for Deep Neural Networks in Image Recognization[J]. Journal of Systems Science and Mathematical Sciences, 2019, 39(12): 1944-1963.

### An Approach to Generate Universal Adversarial Perturbation for Deep Neural Networks in Image Recognization

LI Xiangkun1， YANG Zhengfeng1 ，ZENG Xia2 ，LIU Zhiming2

1. 1.School of Computer Science and Software Engineering, East China Normal University,  Shanghai 200062; 2. College of Computer and Information Science, Southwest University, Chongqing 400715
• Online:2019-12-25 Published:2020-03-20

Recently, image recognization based on deep neural network has achieved good performance. However, research shows that neural networks are susceptible to adversarial attacks in the form of small perturbations to images, and a universal adversarial perturbation can even fool a network on the complete data set. Therefore, it is necessary to study the universal perturbation generation problem for constructing more robust neural networks. Universal perturbation generation aims to find a single pertubation that attacks the whole data set. Compared with image-specific pertubation generation, it requires more strict constraints and has higher computational complexity. Current methods produce universal perturbations with large norms perceptible to human vision. Based on optimization theory, this paper presents a new method which computes smaller universal perturbations under specified perturbation rate. The poposed algorithm first incorporates PCA (principal component analysis) to reduce problem dimension for good scalability; then by the superposition of mean image-specific pertubation and random noise, an initial universal perturbation satisfying the perturbation rate requirement can be obtained; finally, the norm of universal perburtation is reduced based on improved gradient descent method. Experiments demonstrate that the proposed approach can attack various state-of-the-art neural networks effectively: With the same pertubation rate, the norm of the pertubation given by the proposed method is 54\% smaller than the Uni. Perturbation algorithm on average.

()
 No related articles found!