大脑编程对对抗攻击免疫：使用符号学习实现精确和鲁棒的图像分类
Brain Programming is Immune to Adversarial Attacks: Towards Accurate and Robust Image Classification using Symbolic Learning
摘要：
近年来，对深度卷积神经网络（DCNN）的安全性担忧，以人类视觉几乎不可见的输入图像的小修改的形式对对抗攻击（AA）的脆弱性使其预测不可信。因此，在开发新的分类器时，除了准确的分数之外，还需要提供对抗性示例的鲁棒性。在这项工作中，我们进行了比较研究的影响AA的艺术媒体分类，这涉及到一个复杂的功能分析，分类一个很好的艺术品收藏的复杂问题。我们测试了来自计算机视觉的流行视觉词方法，四种最先进的DCNN模型（AlexNet，VGG，ResNet，ResNet101）和大脑编程（BP）算法。在这项研究中，我们分析了算法的性能使用准确性。此外，我们使用对抗样本和干净图像之间的准确率来衡量鲁棒性。此外，我们提出了一个统计分析每个分类器的预测的信心，以证实的结果。我们确认，BP预测的变化低于2%，使用对抗的例子计算的快速梯度符号方法。此外，考虑到多像素攻击，BP得到了七个类中的四个没有变化，其余的预测误差最大为4%。最后，BP还得到了四个类别，使用对抗补丁没有变化，其余三个类的变化为1%。此外，统计分析表明，BP的预测的置信度没有显着差异，为每对清洁和扰动的图像在每个实验。与DCNN和手工特征方法相比，这些结果证明了BP对对抗性示例的鲁棒性，DCNN和手工特征方法在艺术媒体分类上的性能受到了所提出的扰动的影响。
英文摘要：
In recent years, the security concerns about the vulnerability of Deep Convolutional Neural Networks (DCNN) to Adversarial Attacks (AA) in the form of small modifications to the input image almost invisible to human vision make their predictions untrustworthy. Therefore, it is necessary to provide robustness to adversarial examples in addition to an accurate score when developing a new classifier. In this work, we perform a comparative study of the effects of AA on the complex problem of art media categorization, which involves a sophisticated analysis of features to classify a fine collection of artworks. We tested a prevailing bag of visual words approach from computer vision, four state-of-the-art DCNN models (AlexNet, VGG, ResNet, ResNet101), and the Brain Programming (BP) algorithm. In this study, we analyze the algorithms' performance using accuracy. Besides, we use the accuracy ratio between adversarial examples and clean images to measure robustness. Moreover, we propose a statistical analysis of each classifier's predictions' confidence to corroborate the results. We confirm that BP predictions' change was below 2\% using adversarial examples computed with the fast gradient sign method. Also, considering the multiple pixel attack, BP obtained four out of seven classes without changes and the rest with a maximum error of 4\% in the predictions. Finally, BP also gets four categories using adversarial patches without changes and for the remaining three classes with a variation of 1\%. Additionally, the statistical analysis showed that the predictions' confidence of BP were not significantly different for each pair of clean and perturbed images in every experiment. These results prove BP's robustness against adversarial examples compared to DCNN and handcrafted features methods, whose performance on the art media classification was compromised with the proposed perturbations.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
