论文标题
对基于深度学习的剪接本地化的对抗性攻击
Adversarial Attack on Deep Learning-Based Splice Localization
论文作者
论文摘要
关于图像取证，研究人员提出了各种检测和/或本地化操作（例如拼接）的方法。最近的最佳性能图像素化算法从深度学习的应用中受益匪浅，但是这种工具可能容易受到对抗性攻击的影响。由于大多数提出的对抗性示例生成技术只能在端到端分类器上使用，因此尚未研究仅研究深度学习来提取特征提取的图像触发方法的对抗性鲁棒性。使用一种能够直接调整贴片的基础表示的新型算法，我们在三种非端到端深度学习的剪接本地化工具上展示了隐藏图像操纵的方法是通过对抗性攻击可行的。虽然经过测试的图像触觉方法，Exif-SC，脊柱和噪声依赖于接受不同替代任务培训的特征提取器，但我们发现形成的对抗性扰动可以在其定位性能的恶化方面可以转移。
Regarding image forensics, researchers have proposed various approaches to detect and/or localize manipulations, such as splices. Recent best performing image-forensics algorithms greatly benefit from the application of deep learning, but such tools can be vulnerable to adversarial attacks. Due to the fact that most of the proposed adversarial example generation techniques can be used only on end-to-end classifiers, the adversarial robustness of image-forensics methods that utilize deep learning only for feature extraction has not been studied yet. Using a novel algorithm capable of directly adjusting the underlying representations of patches we demonstrate on three non end-to-end deep learning-based splice localization tools that hiding manipulations of images is feasible via adversarial attacks. While the tested image-forensics methods, EXIF-SC, SpliceRadar, and Noiseprint, rely on feature extractors that were trained on different surrogate tasks, we find that the formed adversarial perturbations can be transferable among them regarding the deterioration of their localization performance.
