基于网络结构自动搜索的对抗样本防御方法研究

doi:10.3969/j.issn.1671-1122.2022.03.008

信息网络安全 ›› 2022, Vol. 22 ›› Issue (3): 70-77.doi: 10.3969/j.issn.1671-1122.2022.03.008

基于网络结构自动搜索的对抗样本防御方法研究

郑耀昊¹^,², 王利明¹(), 杨婧¹

1. 中国科学院信息工程研究所,北京 100093
2. 中国科学院大学网络空间安全学院,北京 100049

收稿日期:2021-09-19 出版日期:2022-03-10 发布日期:2022-03-28
通讯作者: 王利明 E-mail:wangliming@iie.ac.cn
作者简介:郑耀昊（1995—）,男,浙江,硕士研究生,主要研究方向为人工智能安全|王利明（1978—）,男,北京,正高级工程师,博士,主要研究方向为云计算安全、智能安全|杨婧（1984—）,女,山西,高级工程师,博士,主要研究方向为网络安全、数据安全分析
基金资助:
国家重点研发计划(2017YFB1010004)

A Defense Method against Adversarial Attacks Based on Neural Architecture Search

ZHENG Yaohao¹^,², WANG Liming¹(), YANG Jing¹

1. Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China
2. School of Cyber Security, University of Chinese Academy of Sciences, Beijing 100049, China

Received:2021-09-19 Online:2022-03-10 Published:2022-03-28
Contact: WANG Liming E-mail:wangliming@iie.ac.cn

摘要/Abstract

摘要：

针对图像分类任务中存在的对抗样本攻击使图像分类器分类出错导致深度学习模型不可信的问题,文章提出一种基于网络结构自动搜索的对抗样本防御方法。该方法利用强化学习的思想,将搜索防御网络建模成智能体的行为。通过搜索空间的定义、搜索策略的设计以及网络性能的评估,控制网络自动搜索可以得到性能最优的图像重构网络,将对抗样本恢复成自然图片从而达到防御对抗攻击的目的。经实验验证,该方法有效地将对抗样本进行了重构,降低了其攻击性,从而保证分类器的分类正确率。

关键词: 网络结构搜索, 图像分类, 对抗样本, 深度学习

Abstract:

Aiming at the problem that the neural networks are easy to misclassify under the attack of adversarial examples in the task of image classification, which leads to the unreliability of deep learning models, this paper proposed a defense method against adversarial attacks based on neural architecture search. This method used reinforcement learning to model the search of defense network as the behavior of the agent. Through the definition of search space, the design of search strategy, and the evaluation of subnetwork performance, the search network can automatically obtain the best performance network to reconstruct adversarial images and restore them to natural images, achieving the purpose of defense against adversarial attacks. The experimental results show that the method can effectively reconstruct illegal examples, and make them lose aggressiveness, and consequently ensure the classification accuracy of the classifier.

Key words: neural architecture search, image classification, adversarial attack, deep learning

中图分类号:

TP309

郑耀昊, 王利明, 杨婧. 基于网络结构自动搜索的对抗样本防御方法研究[J]. 信息网络安全, 2022, 22(3): 70-77.

ZHENG Yaohao, WANG Liming, YANG Jing. A Defense Method against Adversarial Attacks Based on Neural Architecture Search[J]. Netinfo Security, 2022, 22(3): 70-77.

图/表 8

图1

表1

图2

图3

图4

表2

图5

图6

参考文献 16

[1]	TRAMÈ R F, KURAKIN A, PAPERNOT N, et al. Ensemble Adversarial Training: Attacks and Defenses[EB/OL]. https://arxiv.org/abs/1705.07204, 2017-05-19.
[2]	LU Jiajun, ISSARANON T, FORSYTH D A. SafetyNet: Detecting and Rejecting Adversarial Examples Robustly [C]//IEEE. IEEE International Conference on Computer Vision, October 22-29, 2017, Venice, Italy. New York: IEEE, 2017: 446-454.
[3]	JIA Xiaojun, WEI Xingxing, CAO Xiaochun, et al. ComDefend: An Efficient Image Compression Model to Defend Adversarial Examples[C]//IEEE. IEEE Conference on Computer Vision and Pattern Recognition, June 16-20, 2019, Long Beach, CA, USA. New York: IEEE, 2019: 6084-6092.
[4]	SONG Yang, KIM T, NOWOZIN S, et al. PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples[EB/OL]. https://arxiv.org/abs/1710.10766, 2017-10-30.
[5]	ZOPH B, LE Q V. Neural Architecture Search with Reinforcement Learning[EB/OL]. https://arxiv.org/abs/1611.01578, 2016-11-05.
[6]	ZOPH B, VASUDEVAN V, SHLENS J, et al. Learning Transferable Architectures for Scalable Image Recognition [C]//IEEE. IEEE Conference on Computer Vision and Pattern Recognition, June 18-22, 2018, Salt Lake City, UT, USA. New York: IEEE, 2018: 8697-8710.
[7]	GOODFELLOW I J, SHLENS J, SZEGEDY C. Explaining and Harnessing Adversarial Examples[EB/OL].https://arxiv.org/abs/1412.6572, 2014-12-20.
[8]	KURAKIN A, GOODFELLOW I J, BENGIO S. Adversarial Machine Learning at Scale[EB/OL]. , 2016-11-04.
[9]	DONG Yinpeng, LIAO Fangzhou, PANG Tianyu, et al. Boosting Adversarial Attacks with Momentum [C]//IEEE. 2018 IEEE Conference on Computer Vision and Pattern Recognition, June 18-22, 2018, Salt Lake City, UT, USA. New York: IEEE, 2018: 9185-9193.
[10]	PAPERNOT N, MCDANIEL P D, JHA S, et al. The Limitations of Deep Learning in Adversarial Settings [C]//IEEE. IEEE European Symposium on Security and Privacy, March 21-24, 2016, Saarbrücken, Germany. New York: IEEE, 2016: 372-387.
[11]	XU Weilin, EVANS D, QI Yanjun. Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks[EB/OL]. https://arxiv.org/abs/1704.01155, 2017-04-04.
[12]	WILLIAMS R J. Simple Statistical Gradient-following Algorithms for Connectionist Reinforcement Learning[J]. Mach Learn, 1992(8):229-256.
[13]	HE Kaiming, KRIZHEVSKY A N V, HINTON G. Cifar-10[EB/OL]. http://www.cs.toronto.edu/kriz/cifar.html, 2021-08-09.
[14]	HE Kaiming, ZHANG Xiangyu, REN Shaoqing, et al. Deep Residual Learning for Image Recognition [C]//IEEE. 2016 IEEE Conference on Computer Vision and Pattern Recognition, June 27-30, 2016, Las Vegas, NV, USA. New York: IEEE, 2016: 770-778.
[15]	DENG Jia, DONG Wei, SOCHER R, et al. ImageNet: A Large-scale Hierarchical Image Database [C]//IEEE. 2009 IEEE Computer Society Conference on Computer Vision and Pattern Recognition, June 20-25, 2009, Miami, Florida, USA. New York: IEEE, 2009: 248-255.
[16]	SZEGEDY C, VANHOUCKE V, IOFFE S, et al. Rethinking the Inception Architecture for Computer Vision [C]//IEEE. 2016 IEEE Conference on Computer Vision and Pattern Recognition, June 27-30, 2016, Las Vegas, NV, USA. New York: IEEE, 2016: 2818-2826.

参数	值域
卷积通道	16,32,64,128,256
卷积核大小	1,2,3
卷积步长	1,2
激活函数	0(ReLU),1(sigmod),2(PReLU)
是否跳跃连接	0(无),1（有）

防御方法	强度为1	强度为3	强度为5
没有防御	27.1%	15.8%	3.7%
FS	65.3%	43.9%	39.4%
Comdefend	55.9%	53.2%	51.9%
本文方法	75.2%	74.9%	74.8%

基于网络结构自动搜索的对抗样本防御方法研究

A Defense Method against Adversarial Attacks Based on Neural Architecture Search

RichHTML

PDF (PC)

可视化

摘要/Abstract

引用本文

使用本文

图/表 8

参考文献 16

相关文章 15

编辑推荐

Metrics

本文评价

[1]	徐占洋, 程洛飞, 程建春, 许小龙. 一种使用Bi-ADMM优化深度学习模型的方案[J]. 信息网络安全, 2023, 23(2): 54-63.
[2]	陈得鹏, 刘肖, 崔杰, 仲红. 一种基于双阈值函数的成员推理攻击方法[J]. 信息网络安全, 2023, 23(2): 64-75.
[3]	贾凡, 康舒雅, 江为强, 王光涛. 基于NLP及特征融合的漏洞相似性算法评估[J]. 信息网络安全, 2023, 23(1): 18-27.
[4]	高博, 陈琳, 严迎建. 基于CNN-MGU的侧信道攻击研究[J]. 信息网络安全, 2022, 22(8): 55-63.
[5]	胡卫, 赵文龙, 陈璐, 付伟. 基于Logits向量的JSMA对抗样本攻击改进算法[J]. 信息网络安全, 2022, 22(3): 62-69.
[6]	夏强, 何沛松, 罗杰, 刘嘉勇. 基于普遍对抗噪声的高效载体图像增强算法[J]. 信息网络安全, 2022, 22(2): 64-75.
[7]	郭森森, 王同力, 慕德俊. 基于生成对抗网络与自编码器的网络流量异常检测模型[J]. 信息网络安全, 2022, 22(12): 7-15.
[8]	张郅, 李欣, 叶乃夫, 胡凯茜. 融合多重风格迁移和对抗样本技术的验证码安全性增强方法[J]. 信息网络安全, 2022, 22(10): 129-135.
[9]	刘烁, 张兴兰. 基于双重注意力的入侵检测系统[J]. 信息网络安全, 2022, 22(1): 80-86.
[10]	朱新同, 唐云祁, 耿鹏志. 基于特征融合的篡改与深度伪造图像检测算法[J]. 信息网络安全, 2021, 21(8): 70-81.
[11]	路宏琳, 王利明. 面向用户的支持用户掉线的联邦学习数据隐私保护方法[J]. 信息网络安全, 2021, 21(3): 64-71.
[12]	于克辰, 郭莉, 姚萌萌. 基于空间及能量维度的黑盒对抗样本生成方法[J]. 信息网络安全, 2021, 21(3): 72-78.
[13]	马瑞, 蔡满春, 彭舒凡. 一种基于改进的Xception网络的深度伪造视频检测模型[J]. 信息网络安全, 2021, 21(12): 109-117.
[14]	潘孝勤, 杜彦辉. 基于混合特征和多通道GRU的伪造语音鉴别方法[J]. 信息网络安全, 2021, 21(10): 1-7.
[15]	徐国天, 盛振威. 基于融合CNN与LSTM的DGA恶意域名检测方法[J]. 信息网络安全, 2021, 21(10): 41-47.