The Generation of Black Box Adversarial Sample Based on Spatial and Energy Dimension

doi:10.3969/j.issn.1671-1122.2021.03.009

Abstract

Abstract:

As a significant role in image recognition, neural network can be disturbed by adversarial samples, resulting in recognition errors. Considering that classical adversarial sample generation methods are limited in terms of constraint variables and measurement metrics, this paper puts forward an adversarial sample generation method based on spatial and energy dimensions constrained by cosine similarity, which generates an adversarial sample by spatially translating and rotating the original sample and superimposing a certain strength of Gaussian noise on the energy dimension. Compared with the classic artificial perturbations, rotational shift of spatial dimension and noise of energy dimension exist in large probability in picture generation, transmission, and processing, therefore, the generation of adversarial samples is more natural. The experimental results demonstrate that adversarial sample with both energy and spatial dimensions acting simultaneously is more effective than adversarial sample with only spatial dimensions.

Key words: artificial intelligence, adversarial sample generation, spatial dimension, perturbation

CLC Number:

TP309

YU Kechen, GUO Li, YAO Mengmeng. The Generation of Black Box Adversarial Sample Based on Spatial and Energy Dimension[J]. Netinfo Security, 2021, 21(3): 72-78.

Figures/Tables 7

References 13

[1]	HINTON G, DENG L, YU D, et al. Deep Neural Networks for Acoustic Modeling in Speech Recognition: The Shared Views of Four Research Groups[J]. IEEE Signal Processing Magazine, 2012,29(6):82-97. doi: 10.1109/MSP.2012.2205597 URL
[2]	SUTSKEVER I, VINYALS O, LE Q V. Sequence to Sequence Learning with Neural Networks[EB/OL]. http://de.arxiv.org/pdf/1409.3215, 2020-05-11.
[3]	ACKERMAN E. How Drive.ai is Mastering Autonomous Driving With Deep Learning[EB/OL] https://spectrum.ieee.org/cars-that-think/transportation/self-driving/+how-driveai-is-mastering-autonomous-driving-with-deep-learning, 2020-08-10.
[4]	SZEGEDY C, ZAREMBA W, SUTSKEVER I, et al. Intriguing Properties of Neural Networks[EB/OL]. http://arxiv.org/abs/1312.6199, 2020-08-03.
[5]	GOODFELLOW I J, SHLENS J, SZEGEDY C. Explaining and Harnessing Adversarial Examples[EB/OL]. http://arxiv.org/abs/1412.6572, 2020-08-03.
[6]	PAPERNOT N, MCDANIEL P, GOODFELLOW I, et al. Practical Black-box Attacks against Machine Learning[EB/OL]. http://arxiv.org/abs/1602.02697, 2020-08-05.
[7]	KURAKIN A, GOODFELLOW I, BENGIO S. Adversarial Examples in the Physical World[EB/OL]. http://arxiv.org/abs/1607.02533, 2020-08-03.
[8]	SHARIF M, BHAGAVATULA S, BAUER L, et al. Accessorize to a Crime: Real and Stealthy Attacks on State-of-the-art Face Recognition [C]//ACM. 2016 ACM SIGSAC Conference on Computer and Communications Security, October 24-28, 2016, Vienna, Austria. New York: ACM, 2016: 1528-1540.
[9]	MOOSAVI-DEZFOOLI S M, FAWZI A, FROSSARD P. DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks [C]//IEEE. 2016 IEEE Conference on Computer Vision and Pattern Recognition, June 27-30, 2016, Las Vegas, NV, USA. New Jersey: IEEE, 2016: 2574-2582.
[10]	CARLINI N, WAGNER D. Towards Evaluating the Robustness of Neural Networks [C]//IEEE. 2017 IEEE Symposium on Security and Privacy, May 22-26, 2017, San Jose, CA, USA. New Jersey: IEEE, 2017: 39-57.
[11]	CHEN Pinyu, SHARMA Y, ZHANG Huan, et al. EAD: Elastic-net Attacks to Deep Neural Networks via Adversarial Examples[EB/OL]. http://arxiv.org/abs/1709.04114, 2020-08-03.
[12]	ROZSA A, RUDD E M, BOULT T E. Adversarial Diversity and Hard Positive Generation [C]//IEEE. 2016 IEEE Conference on Computer Vision and Pattern Recognition Workshops, June 26-July 1, 2016, Las Vegas, NV, USA. New Jersey: IEEE, 2016: 410-417.
[13]	ENGSTROM L, TRAN B, TSIPRAS D, et al. Exploring the Landscape of Spatial Robustness[EB/OL]. http://arxiv.org/abs/1712.02779, 2020-08-03.

名称	型号
处理器	英特尔Core i7-10875H @2.30 GHz 8核
主板	华硕 G512LV（LPC Controller-068D）
内存	16 GB（海力士 DDR4 3200 MHz）
硬盘	英特尔SSDPEKNW512 GB（512 GB/固态硬盘）
显卡	NVIDIA GeForce RTX 2060（6 GB）

变量	回归系数	标准误差	T值	P值
MAX_ROTATION__FLOAT__	1.563	0.084	18.672	0.000
MAX_TRANSLATION__FLOAT__	0.806	0.089	9.076	0.000
C（常数）	28.313	1.996	14.188	0.000
统计量	估计值	—	—	—
调整后R²	0.828	—	—	—
F检验P值	0.000	—	—	—