评估空间频率域中的对抗鲁棒性
Evaluating Adversarial Robustness in the Spatial Frequency Domain
AI总结：
本文利用DCT构建SF层并改造CNN骨干网络，实证表明SF-CNNs在白盒与黑盒攻击下更鲁棒，且低频成分是其鲁棒性的主要来源。
摘要：
卷积神经网络（CNNs）已经主导了大多数计算机视觉任务。然而，CNNs对对抗攻击的脆弱性引发了人们对将这些模型部署到安全关键应用中的担忧。相比之下，人类视觉系统（HVS）利用空间频率通道处理视觉信号，对对抗攻击免疫。因此，本文提出一项实证研究，探索CNN模型在频率域中的脆弱性。具体而言，我们利用离散余弦变换（DCT）构建空间-频率（SF）层，以生成输入图像的分块频谱，并通过将广泛使用的CNN骨干网络的初始特征提取层替换为SF层，构建空间频率CNNs（SF-CNNs）。通过大量实验，我们观察到在白盒攻击和黑盒攻击下，SF-CNN模型都比对应的CNN模型更加鲁棒。为进一步解释SF-CNNs的鲁棒性，我们采用两种混合策略，将SF层与具有相同卷积核大小的可训练卷积层进行比较，结果表明较低频率成分对SF-CNNs的对抗鲁棒性贡献最大。我们相信这些观察结果能够指导未来鲁棒CNN模型的设计。
英文摘要：
Convolutional Neural Networks (CNNs) have dominated the majority of computer vision tasks. However, CNNs' vulnerability to adversarial attacks has raised concerns about deploying these models to safety-critical applications. In contrast, the Human Visual System (HVS), which utilizes spatial frequency channels to process visual signals, is immune to adversarial attacks. As such, this paper presents an empirical study exploring the vulnerability of CNN models in the frequency domain. Specifically, we utilize the discrete cosine transform (DCT) to construct the Spatial-Frequency (SF) layer to produce a block-wise frequency spectrum of an input image and formulate Spatial Frequency CNNs (SF-CNNs) by replacing the initial feature extraction layers of widely-used CNN backbones with the SF layer. Through extensive experiments, we observe that SF-CNN models are more robust than their CNN counterparts under both white-box and black-box attacks. To further explain the robustness of SF-CNNs, we compare the SF layer with a trainable convolutional layer with identical kernel sizes using two mixing strategies to show that the lower frequency components contribute the most to the adversarial robustness of SF-CNNs. We believe our observations can guide the future design of robust CNN models.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
