arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2206.05751cs.LGcs.CRcs.CV
收藏

一致性攻击:针对具身视觉导航的通用对抗扰动

Consistent Attack: Universal Adversarial Perturbation on Embodied Vision Navigation

Department of Computer Science and Technology, Beijing National Research Center for Information Science and Technology, Tsinghua-Bosch Joint Center for Machine Learning, Institute for Artificial Intelligence, Tsinghua University, Beijing 100084, China(计算机科学与技术系,北京信息科学国家研究中心,清华-博世联合机器学习中心,人工智能研究院,清华大学,北京)

Chengyang Ying, You Qiaoben, Xinning Zhou, Hang Su, Wenbo Ding, Jianyong Ai

AI总结:

该研究针对具身视觉导航的通用对抗攻击问题,提出基于δ扰动MDP的Reward UAP和Trajectory UAP一致性攻击方法,实验证明其能显著降低导航性能,揭示了该技术的现实应用风险。

摘要:

结合深度神经网络的视觉导航具身智能体正受到越来越多的关注。然而研究表明,深度神经网络易受恶意对抗噪声的攻击,这类噪声可能导致具身视觉导航系统发生灾难性故障。在各类对抗噪声中,通用对抗扰动(UAP,即施加在智能体每一输入帧上的、与图像无关的恒定扰动)因攻击过程计算高效且具备实际应用可行性,在具身视觉导航领域具有重要影响。但现有UAP方法忽略了具身视觉导航的系统动态特性,可能并非最优方案。\n为将UAP拓展到序列决策场景,我们将受通用噪声δ干扰的环境建模为δ扰动马尔可夫决策过程(δ-MDP)。基于该建模,我们分析了δ-MDP的性质,并提出两种全新的一致性攻击方法,分别命名为Reward UAP和Trajectory UAP,用于攻击具身智能体。这两种方法考虑了MDP的动态特性,通过估计受扰分布和受扰Q函数来计算通用噪声。\n在Habitat平台的PointGoal任务中,针对不同数据集、不同场景下的多种受害模型,我们的一致性攻击均可导致其性能出现显著下降。大量实验结果表明,将具身视觉导航方法应用于现实世界存在严重的潜在风险。

英文摘要:

Embodied agents in vision navigation coupled with deep neural networks have attracted increasing attention. However, deep neural networks have been shown vulnerable to malicious adversarial noises, which may potentially cause catastrophic failures in Embodied Vision Navigation. Among different adversarial noises, universal adversarial perturbations (UAP), i.e., a constant image-agnostic perturbation applied on every input frame of the agent, play a critical role in Embodied Vision Navigation since they are computation-efficient and application-practical during the attack. However, existing UAP methods ignore the system dynamics of Embodied Vision Navigation and might be sub-optimal. In order to extend UAP to the sequential decision setting, we formulate the disturbed environment under the universal noise $δ$, as a $δ$-disturbed Markov Decision Process ($δ$-MDP). Based on the formulation, we analyze the properties of $δ$-MDP and propose two novel Consistent Attack methods, named Reward UAP and Trajectory UAP, for attacking Embodied agents, which consider the dynamic of the MDP and calculate universal noises by estimating the disturbed distribution and the disturbed Q function. For various victim models, our Consistent Attack can cause a significant drop in their performance in the PointGoal task in Habitat with different datasets and different scenes. Extensive experimental results indicate that there exist serious potential risks for applying Embodied Vision Navigation methods to the real world.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑