arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2305.04436cs.CV
收藏

基于局部直方图均衡化的增强图像差异特征对抗样本检测

Adversarial Examples Detection with Enhanced Image Difference Features based on Local Histogram Equalization

East China Normal University(华东师范大学);Tsinghua University(清华大学);OPPO;Anhui University(安徽大学)

Zhaoxia Yin, Shaowei Zhu, Hang Su, Jianteng Peng, Wanli Lyu, Bin Luo

AI总结:

提出基于局部直方图均衡化的高频信息增强框架,提取并放大对抗样本与正常样本的特征差异,模块化提升现有检测器性能并降低部署成本。

摘要:

深度神经网络(DNNs)近年来在许多领域取得了显著进展。然而,研究表明,DNNs容易受到对抗样本的攻击,即使无法访问完整的底层模型参数,不可感知的扰动也能极大地误导DNNs。已有多种防御方法被提出,例如特征压缩和梯度掩蔽。然而,大量研究证明,先前的方法只能针对特定攻击进行检测或防御,这使得这些方法在面对最新的未知攻击方法时失效。对抗扰动的不可见性是对抗样本攻击的评估指标之一,这也意味着对抗样本与正常样本在高频信息的局部相关性上的差异可以作为区分两者的有效特征。因此,我们提出了一种基于高频信息增强策略的对抗样本检测框架,该框架能够有效提取并放大对抗样本与正常样本之间的特征差异。实验结果表明,在该框架下,特征增强模块可以以模块化的方式与现有检测模型结合。在不修改现有检测模型的情况下,提高检测器的性能并降低部署成本。

英文摘要:

Deep Neural Networks (DNNs) have recently made significant progress in many fields. However, studies have shown that DNNs are vulnerable to adversarial examples, where imperceptible perturbations can greatly mislead DNNs even if the full underlying model parameters are not accessible. Various defense methods have been proposed, such as feature compression and gradient masking. However, numerous studies have proven that previous methods create detection or defense against certain attacks, which renders the method ineffective in the face of the latest unknown attack methods. The invisibility of adversarial perturbations is one of the evaluation indicators for adversarial example attacks, which also means that the difference in the local correlation of high-frequency information in adversarial examples and normal examples can be used as an effective feature to distinguish the two. Therefore, we propose an adversarial example detection framework based on a high-frequency information enhancement strategy, which can effectively extract and amplify the feature differences between adversarial examples and normal examples. Experimental results show that the feature augmentation module can be combined with existing detection models in a modular way under this framework. Improve the detector's performance and reduce the deployment cost without modifying the existing detection model.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑