《计算机应用》唯一官方网站 ›› 2022, Vol. 42 ›› Issue (2): 510-518.DOI: 10.11772/j.issn.1001-9081.2021020360
• 网络空间安全 • 上一篇
收稿日期:
2021-03-10
修回日期:
2021-04-28
接受日期:
2021-04-29
发布日期:
2021-05-10
出版日期:
2022-02-10
通讯作者:
陈永乐
作者简介:
陈权(1996—),男,山西太原人,硕士研究生,主要研究方向:深度学习、对抗攻击;基金资助:
Quan CHEN, Li LI, Yongle CHEN(), Yuexing DUAN
Received:
2021-03-10
Revised:
2021-04-28
Accepted:
2021-04-29
Online:
2021-05-10
Published:
2022-02-10
Contact:
Yongle CHEN
About author:
CHEN Quan, born in 1996, M. S. candidate. His research interests include deep learning, adversarial attack.Supported by:
摘要:
针对深度神经网络(DNN)中的可解释性导致模型信息泄露的问题,证明了在白盒环境下利用Grad-CAM解释方法产生对抗样本的可行性,并提出一种无目标的黑盒攻击算法——动态遗传算法。该算法首先根据解释区域与扰动像素位置的变化关系改进适应度函数,然后通过多轮的遗传算法在不断减少扰动值的同时递增扰动像素的数量,而且每一轮的结果坐标集会在下一轮的迭代中保留使用,直到在未超过扰动边界的情况下扰动像素集合使预测标签发生翻转。在实验部分,所提算法在AlexNet、VGG-19、ResNet-50和SqueezeNet模型下的攻击成功率平均为92.88%,与One pixel算法相比,虽然增加了8%的运行时间,但成功率提高了16.53个百分点。此外,该算法能够在更短的运行时间内,使成功率高于Ada-FGSM算法3.18个百分点,高于PPBA算法8.63个百分点,并且与Boundary-attack算法的成功率相差不大。结果表明基于解释方法的动态遗传算法能有效进行对抗攻击。
中图分类号:
陈权, 李莉, 陈永乐, 段跃兴. 面向深度学习可解释性的对抗攻击算法[J]. 计算机应用, 2022, 42(2): 510-518.
Quan CHEN, Li LI, Yongle CHEN, Yuexing DUAN. Adversarial attack algorithm for deep learning interpretability[J]. Journal of Computer Applications, 2022, 42(2): 510-518.
算法 | 运行时间/s |
---|---|
动态遗传算法 | 13.0 |
灰狼算法 | 14.6 |
布谷鸟算法 | 20.1 |
樽海鞘群算法 | 11.2 |
表1 不同优化算法的运行时间
Tab. 1 Running times of different optimization algorithms
算法 | 运行时间/s |
---|---|
动态遗传算法 | 13.0 |
灰狼算法 | 14.6 |
布谷鸟算法 | 20.1 |
樽海鞘群算法 | 11.2 |
算法 | AlexNet | VGG-19 | ResNet-50 | SqueezeNet |
---|---|---|---|---|
BIM | 99.50 | 99.60 | 100.00 | 99.60 |
DeepFool | 99.40 | 99.80 | 99.90 | 99.80 |
Grad-CAM Attack(S=1) | 72.50 | 72.30 | 91.10 | 86.50 |
Grad-CAM Attack (S=-1) | 48.50 | 16.50 | 9.90 | 39.00 |
表2 不同模型下的无目标攻击成功率 (%)
Tab. 2 Untargeted attack successrate under different models
算法 | AlexNet | VGG-19 | ResNet-50 | SqueezeNet |
---|---|---|---|---|
BIM | 99.50 | 99.60 | 100.00 | 99.60 |
DeepFool | 99.40 | 99.80 | 99.90 | 99.80 |
Grad-CAM Attack(S=1) | 72.50 | 72.30 | 91.10 | 86.50 |
Grad-CAM Attack (S=-1) | 48.50 | 16.50 | 9.90 | 39.00 |
算法 | AlexNet | VGG-19 | ResNet-50 | SqueezeNet |
---|---|---|---|---|
BIM | 99.50 | 99.60 | 100.00 | 99.60 |
DeepFool | 99.40 | 99.80 | 99.90 | 99.80 |
Grad-CAM Attack(S=1) | 92.30 | 93.30 | 95.90 | 94.70 |
表3 改进后不同模型下的无目标攻击成功率 (%)
Tab. 3 Untargeted attack success rate under different models after improvement
算法 | AlexNet | VGG-19 | ResNet-50 | SqueezeNet |
---|---|---|---|---|
BIM | 99.50 | 99.60 | 100.00 | 99.60 |
DeepFool | 99.40 | 99.80 | 99.90 | 99.80 |
Grad-CAM Attack(S=1) | 92.30 | 93.30 | 95.90 | 94.70 |
参数 | 值 | 参数 | 值 |
---|---|---|---|
最大失真 | 0.09 | 扰动像素递增值 | 18 |
初始扰动系数 | 0.21 | 变异率 | 0.05 |
扰动递减值 | 0.02 | 交叉率 | 0.96 |
迭代次数 | 150 |
表4 参数设置
Tab. 4 Parameter settings
参数 | 值 | 参数 | 值 |
---|---|---|---|
最大失真 | 0.09 | 扰动像素递增值 | 18 |
初始扰动系数 | 0.21 | 变异率 | 0.05 |
扰动递减值 | 0.02 | 交叉率 | 0.96 |
迭代次数 | 150 |
算法 | AlexNet | VGG-19 | ResNet-50 | SqueezeNet | 平均成功率 |
---|---|---|---|---|---|
One pixel | 83.00 | 73.80 | 79.00 | 69.60 | 76.35 |
Boundary-attack | 97.40 | 98.80 | 97.90 | 96.80 | 97.73 |
Ada-FGSM | 90.61 | 91.74 | 89.57 | 86.88 | 89.70 |
TREMBA | 93.90 | 95.80 | 92.20 | 93.72 | 93.91 |
PPBA | 89.60 | 90.30 | 84.80 | 72.30 | 84.25 |
动态遗传算法(Grad-CAM) | 93.10 | 94.30 | 91.40 | 92.70 | 92.88 |
表5 不同模型下的黑盒攻击成功率 ( %)
Tab. 5 Black-box attack success rate under different models
算法 | AlexNet | VGG-19 | ResNet-50 | SqueezeNet | 平均成功率 |
---|---|---|---|---|---|
One pixel | 83.00 | 73.80 | 79.00 | 69.60 | 76.35 |
Boundary-attack | 97.40 | 98.80 | 97.90 | 96.80 | 97.73 |
Ada-FGSM | 90.61 | 91.74 | 89.57 | 86.88 | 89.70 |
TREMBA | 93.90 | 95.80 | 92.20 | 93.72 | 93.91 |
PPBA | 89.60 | 90.30 | 84.80 | 72.30 | 84.25 |
动态遗传算法(Grad-CAM) | 93.10 | 94.30 | 91.40 | 92.70 | 92.88 |
算法 | AlexNet | VGG-19 | ResNet-50 | SqueezeNet |
---|---|---|---|---|
One pixel | 16.2 | 18.6 | 18.7 | 17.4 |
Boundary-attack | 18.3 | 19.2 | 19.4 | 19.9 |
Ada-FGSM | 19.2 | 19.9 | 20.5 | 19.8 |
TREMBA | 29.6 | 31.3 | 32.2 | 30.4 |
PPBA | 19.7 | 21.4 | 22.6 | 22.1 |
动态遗传算法(Grad-CAM) | 18.9 | 19.2 | 19.3 | 19.0 |
表6 平均50张图片的处理时间 ( s)
Tab. 6 Average processing time of 50 images
算法 | AlexNet | VGG-19 | ResNet-50 | SqueezeNet |
---|---|---|---|---|
One pixel | 16.2 | 18.6 | 18.7 | 17.4 |
Boundary-attack | 18.3 | 19.2 | 19.4 | 19.9 |
Ada-FGSM | 19.2 | 19.9 | 20.5 | 19.8 |
TREMBA | 29.6 | 31.3 | 32.2 | 30.4 |
PPBA | 19.7 | 21.4 | 22.6 | 22.1 |
动态遗传算法(Grad-CAM) | 18.9 | 19.2 | 19.3 | 19.0 |
组号 | 扰动递减值 | 扰动像素递增值 | 运行时间/s | 成功率/% |
---|---|---|---|---|
1* | 0.02 | 18 | 19.0 | 92.88 |
2 | 0.02 | 15 | 55.2 | 94.20 |
3 | 0.04 | 18 | 16.8 | 89.30 |
4 | 0.03 | 17 | 29.8 | 91.60 |
5 | 0.01 | 19 | 24.4 | 90.80 |
表7 参数性能对比(SqueezeNet)
Tab. 7 Performance comparison of different parameters (SqueezeNet)
组号 | 扰动递减值 | 扰动像素递增值 | 运行时间/s | 成功率/% |
---|---|---|---|---|
1* | 0.02 | 18 | 19.0 | 92.88 |
2 | 0.02 | 15 | 55.2 | 94.20 |
3 | 0.04 | 18 | 16.8 | 89.30 |
4 | 0.03 | 17 | 29.8 | 91.60 |
5 | 0.01 | 19 | 24.4 | 90.80 |
1 | 吴飞,廖彬兵,韩亚洪.深度学习的可解释性[J].航空兵器, 2019, 26(1): 39-46. 10.12132/ISSN.1673-5048.2018.0065 |
WU F, LIAO B B, HAN Y H. Interpretability for deep learning[J]. Aero Weapon, 2019, 26(1): 39-46. 10.12132/ISSN.1673-5048.2018.0065 | |
2 | GOODFELLOW I J, SHLENS J, SZEGEDY C. Explaining and harnessing adversarial examples[EB/OL]. (2015-03-20) [2020-10-29]. . |
3 | KURAKIN A, GOODFELLOW I, BENGIO S. Adversarial examples in the physical world[EB/OL]. (2017-02-11) [2020-10-29]. . 10.1201/9781351251389-8 |
4 | CARLINI N, WAGNER D. Towards evaluating the robustness of neural networks [C]// Proceedings of the 2017 IEEE Symposium on Security and Privacy. Piscataway: IEEE, 2017: 39-57. 10.1109/sp.2017.49 |
5 | PAPERNOT N, McDANIEL P, JHA S, et al. The limitations of deep learning in adversarial settings [C]// Proceedings of the 2016 IEEE European Symposium on Security and Privacy. Piscataway: IEEE, 2016: 372-387. 10.1109/eurosp.2016.36 |
6 | SHI Y C, HAN Y H, ZHANG Q X, et al. Adaptive iterative attack towards explainable adversarial robustness[J]. Pattern Recognition, 2020, 105: No.107309. 10.1016/j.patcog.2020.107309 |
7 | DONG X Y, HAN J F, CHEN D D, et al. Robust superpixel-guided attentional adversarial attack [C]// Proceedings of the 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2020: 12892-12901. 10.1109/cvpr42600.2020.01291 |
8 | LI J, JI R R, LIU H, et al. Projection & probability-driven black-box attack [C]// Proceedings of the 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2020: 359-368. 10.1109/cvpr42600.2020.00044 |
9 | HUANG Z C, ZHANG T. Black-box adversarial attack with transferable model-based embedding[EB/OL]. (2020-01-05) [2020-10-29]. . |
10 | SIMONYAN K, VEDALDI A, ZISSERMAN A. Deep inside convolutional networks: visualising image classification models and saliency maps[EB/OL]. (2014-04-19) [2020-10-29]. . 10.5244/c.28.6 |
11 | SELVARAJU R R, COGSWELL M, DAS A, et al. Grad-CAM: visual explanations from deep networks via gradient-based localization [C]// Proceedings of the 2017 IEEE International Conference on Computer Vision. Piscataway: IEEE, 2017: 618-626. 10.1109/iccv.2017.74 |
12 | SZEGEDY C, ZAREMBA W, SUTSKEVER I, et al. Intriguing properties of neural networks[EB/OL]. (2014-02-19) [2020-10-29]. . |
13 | MOOSAVI-DEZFOOLI S M, FAWZI A, FROSSARD P. DeepFool: a simple and accurate method to fool deep neural networks [C]// Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2016: 2574-2582. 10.1109/cvpr.2016.282 |
14 | SU J W, VARGAS D V, SAKURAI K. One pixel attack for fooling deep neural networks[J]. IEEE Transactions on Evolutionary Computation, 2019, 23(5): 828-841. 10.1109/tevc.2019.2890858 |
15 | BRENDEL W, RAUBER J, BETHGE M. Decision-based adversarial attacks: reliable attacks against black-box machine learning models[EB/OL]. (2018-02-16) [2020-10-29]. . 10.21105/joss.02607 |
16 | GHORBANI A, ABID A, ZOU J. Interpretation of neural networks is fragile [C]// Proceedings of the 33rd AAAI Conference on Artificial Intelligence. Palo Alto, CA: AAAI Press, 2019: 3681-3688. 10.1609/aaai.v33i01.33013681 |
17 | ZHANG X Y, WANG N F, SHEN H, et al. Interpretable deep learning under fire [C]// Proceedings of the 29th USENIX Security Symposium. Berkeley: USENIX Association, 2020: 1659-1676. |
18 | YE D P, CHEN C X, LIU C R, et al. Detection defense against adversarial attacks with saliency map[EB/OL]. (2020-09-06) [2020-10-29]. . 10.1002/int.22458 |
19 | DABKOWSKI P, GAL Y. Real time image saliency for black box classifiers[EB/OL]. (2017-05-22) [2020-10-29]. . |
20 | FONG R C, VEDALDI A. Interpretable explanations of black boxes by meaningful perturbation [C]// Proceedings of the 2017 IEEE International Conference on Computer Vision. Piscataway: IEEE, 2017: 3449-3457. 10.1109/iccv.2017.371 |
21 | SPRINGENBERG J T, DOSOVITSKIY A, BROX T, et al. Striving for simplicity: the all convolutional net[EB/OL]. (2015-04-13) [2020-10-29]. . 10.1109/cvpr.2015.7298761 |
22 | KINDERMANS P J, SCHÜTT K T, ALBER M, et al. Learning how to explain neural networks: patternNet and patternAttribution[EB/OL]. (2017-10-24) [2020-10-29]. . |
23 | RUDOLPH G. Convergence analysis of canonical genetic algorithms[J]. IEEE Transactions on Neural Networks, 1994, 5(1): 96-101. 10.1109/72.265964 |
24 | KRIZHEVSKY A, HINTON G. Learning multiple layers of features from tiny images[EB/OL]. (2009-04-08). [2020-10-29]. . |
25 | DENG J, DONG W, SOCHER R, et al. ImageNet: a large-scale hierarchical image database [C]// Proceedings of the 2009 IEEE Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2009: 248-255. 10.1109/cvpr.2009.5206848 |
26 | SIMONYAN K, ZISSERMAN A. Very deep convolutional networks for large-scale image recognition[EB/OL]. (2015-04-10) [2020-10-29]. . 10.5244/c.28.6 |
27 | HE K M, ZHANG X Y, REN S Q, et al. Deep residual learning for image recognition [C]// Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2016: 770-778. 10.1109/cvpr.2016.90 |
28 | IANDOLA F N, HAN S, MOSKEWICZ M W, et al. SqueezeNet: AlexNet-level accuracy with 50x fewer parameters and< 0.5 MB model size[EB/OL]. (2016-11-04) [2020-10-29]. . |
29 | KRIZHEVSKY A, SUTSKEVER I, HINTON G E. ImageNet classification with deep convolutional neural networks [C]// Proceedings of the 25th International Conference on Neural Information Processing Systems. Red Hook, NY: Curran Associates Inc., 2012: 1097-1105. |
[1] | 刘忠慧, 王梓宥, 闵帆. 近似概念的遗传生成算法及其推荐应用[J]. 《计算机应用》唯一官方网站, 2022, 42(2): 412-418. |
[2] | 张闻强, 邢征, 杨卫东. 基于多区域采样策略的混合粒子群优化求解多目标柔性作业车间调度问题[J]. 计算机应用, 2021, 41(8): 2249-2257. |
[3] | 张盟, 郭健全. 需求和回收不确定的闭环供应链渠道结构选择[J]. 计算机应用, 2021, 41(7): 2100-2107. |
[4] | 杨震, 马健霄, 王宝杰. 设置待行区条件下双环相位信号配时优化模型[J]. 计算机应用, 2021, 41(7): 2108-2112. |
[5] | 王曙燕, 侯则昱, 孙家泽. 面向深度学习的对抗样本差异性检测方法[J]. 计算机应用, 2021, 41(7): 1849-1856. |
[6] | 李进, 王凤, 杨沈宇. 换电模式下电动车货运路径优化模型与算法[J]. 计算机应用, 2021, 41(6): 1792-1798. |
[7] | 张明明, 卢庆宁, 李文中, 宋浒. 基于联合动态剪枝的深度神经网络压缩算法[J]. 计算机应用, 2021, 41(6): 1589-1596. |
[8] | 张文烨, 尚方信, 郭浩. 基于Octave卷积的混合精度神经网络量化方法[J]. 计算机应用, 2021, 41(5): 1299-1304. |
[9] | 李舒仪, 韩晓龙. 海铁联运港口混合作业模式下轨道吊与集卡协同调度[J]. 计算机应用, 2021, 41(5): 1506-1513. |
[10] | 周美玲, 陈淮莉. 基于负荷平衡的电动汽车模糊多目标充电调度算法[J]. 计算机应用, 2021, 41(4): 1192-1198. |
[11] | 王彬溶, 谭代伦, 郑伯川. 基于旅行商问题转化和遗传算法求解汽配件喷涂顺序[J]. 计算机应用, 2021, 41(3): 881-886. |
[12] | 马晓梅, 何非. 基于改进遗传算法的标签印刷生产调度技术[J]. 计算机应用, 2021, 41(3): 860-866. |
[13] | 黄书召, 田军委, 乔路, 王沁, 苏宇. 基于改进遗传算法的无人机路径规划[J]. 计算机应用, 2021, 41(2): 390-397. |
[14] | 杨丽, 王时绘, 朱博. 基于动态和静态偏好的兴趣点推荐算法[J]. 计算机应用, 2021, 41(2): 398-406. |
[15] | 李慧博, 赵云霄, 白亮. 基于深度神经网络和门控循环单元的动态图表示学习方法[J]. 《计算机应用》唯一官方网站, 2021, 41(12): 3432-3437. |
阅读次数 | ||||||
全文 |
|
|||||
摘要 |
|
|||||