基于双曲正切和矩的免疫防御

扫码查看

原文链接

万方数据
维普

中文摘要：对抗样本的发现与研究证实了深度神经网络的脆弱性.如果不对对抗样本的生成加以约束,那么触手可及的图像将不再安全并随时可能对不鲁棒的深度神经网络构成威胁.然而,现有的对抗防御主要旨在防止对抗样本成功攻击深度神经网络,而不是防止对抗样本的生成.因此,本文提出了一种新颖的对抗防御机制,该机制被称为免疫防御.免疫防御通过主动地在原始图像上添加难以察觉的扰动使得攻击者无法针对该图像制作出有效的对抗样本,从而同时保护了图像和深度神经网络.这种良性的扰动被称为免疫扰动,添加了免疫扰动的图像被称为免疫样本.在白盒免疫防御中,本文提出了双曲正切免疫防御(Hyperbolic Tangent Immune Defense,HTID)以制作高分类准确率、高防御性能和高视觉质量的白盒免疫样本;在黑盒免疫防御中,提出了基于矩的免疫防御(Moment-based Immune Defense,MID)以提升免疫样本的可迁移性,从而确保免疫样本对未知对抗攻击的防御性能.此外,本文还提出了免疫率以更加准确地衡量免疫样本的防御性能.在CIFAR-10、MNIST、STL-10和Caltech-256数据集上的大量实验表明,HTID和MID制作的免疫样本具有高分类准确率,在Inception-v3、ResNet-50、LeNet-5和Model C上的准确率均达到了 100.0％,比原始准确率平均高出10.5％.制作的免疫样本同时具有高视觉质量,其SSIM最低为0.822,最高为0.900.实验也表明MID有着比HTID更高的可迁移性,MID在四个数据集上针对AdvGAN制作的免疫样本防御其他11种对抗攻击的平均免疫率分别为62.1％、52.1％、56.8％和 48.7％,这比 HTID 高出 15.0％、10.8％、17.5％和 15.7％.

外文标题：Immune Defense Based on Hyperbolic Tangent and Moments

外文摘要：The vulnerability of deep neural networks to adversarial examples has been confirmed.If the generation of adversarial examples is unregulated,images within reach are no longer secure and pose a threat to non-robust DNNs.However,existing adversarial defenses primarily aim at preventing adversarial examples from attacking deep neural networks successfully,rather than preventing their generation.Therefore,we propose a novel adversarial defense mechanism,which is referred to as immune defense.This mechanism applies carefully designed quasi-imperceptible perturbations to the raw images to prevent the generation of adversarial examples for the raw images thereby protecting both images and deep neural networks.Such perturbations are referred to as immune perturbations,and these perturbed images are referred to as immune examples.In the white-box immune defense,we propose Hyperbolic Tangent Immune Defense(HTID)to craft white-box immune examples with high classification accuracy,defensive performance,and visual quality.In the black-box immune defense,we propose Moment-based Immune Defense(MID)to enhance the transferability of immune examples,so as to ensure the defensive performance against unknown adversarial attacks.In addition,we propose immune rate to more accurately measure the defensive performance of immune examples.Extensive experiments on CIFAR-10,MNIST,STL-10,and Caltech-256 show that the immune examples crafted by HTID and MID have high classification accuracy,which reaches 100.0％and is 10.5％higher than the original accuracy on average.The immune examples also have high visual quality with SSIM between 0.822 and 0.900.The experiments also show that MID has higher transferability than HTID.The average immune rates of the immune examples crafted by MID against AdvGAN to defend against other 11 adversarial attacks on the two datasets are 62.1％,52.1％,56.8％and 48.7％,which are 15.0％,10.8％,17.5％and 15.7％higher than HTID,respectively.

外文关键词：

deep neural networkadversarial exampleadversarial defenseimmune defensetransferability

作者：

吴昊、王金伟、罗向阳、马宾

展开 >

作者单位：

南京信息工程大学计算机学院南京 210044

南京信息工程大学数字取证教育部工程研究中心南京 210044

中国人民解放军战略支援部队信息工程大学网络空间安全学院郑州 450001

齐鲁工业大学网络空间安全学院济南 250353

展开 >

关键词：

深度神经网络对抗样本对抗防御免疫防御可迁移性

基金：

国家自然科学基金国家自然科学基金国家自然科学基金国家自然科学基金国家自然科学基金国家自然科学基金国家自然科学基金中国中原科技创新领军人才项目基金河南省网络空间态势感知重点实验室开放课题基金

项目编号：

6207225062172435U1804263U20B2065618722037180211061802212214200510019HNTS2022002

出版年：

2024

DOI：

10.11897/SP.J.1016.2024.01786

计算机学报

中国计算机学会中国科学院计算技术研究所

计算机学报

CSTPCD北大核心

影响因子：3.18

ISSN：0254-4164

年,卷(期)：2024.47(8)

参考文献量1