论文标题
强大的通用对抗性扰动
Robust Universal Adversarial Perturbations
论文作者
论文摘要
通用的对抗扰动（UAP）是不可察觉的图像敏捷矢量，引起深度神经网络（DNNS）以很高的概率分类输入。在实际攻击方案中，对抗性扰动可能会经历转换，例如像素强度，缩放等的变化。在添加到DNN输入中之前。现有方法不会为这些现实世界转换创造强大的UAP，从而限制了它们在实际攻击方案中的适用性。在这项工作中，我们介绍并制定了对现实世界转换的强大UAP。我们使用概率的鲁棒性界限构建了一种迭代算法，并构建了通过组成任意亚差异转换功能而产生的转换的这种UAPS稳健性。我们对流行的CIFAR-10和ILSVRC 2012数据集进行了广泛的评估，该数据集测量了我们在广泛的范围常见的，诸如旋转，旋转，对比变化等广泛范围的稳健性等。我们进一步表明，通过使用一组原始变换，我们的方法可以很好地提高我们的方法，例如，我们的方法可以在诸如fog，jpeg compression等方面概述。基线。
Universal Adversarial Perturbations (UAPs) are imperceptible, image-agnostic vectors that cause deep neural networks (DNNs) to misclassify inputs with high probability. In practical attack scenarios, adversarial perturbations may undergo transformations such as changes in pixel intensity, scaling, etc. before being added to DNN inputs. Existing methods do not create UAPs robust to these real-world transformations, thereby limiting their applicability in practical attack scenarios. In this work, we introduce and formulate UAPs robust against real-world transformations. We build an iterative algorithm using probabilistic robustness bounds and construct such UAPs robust to transformations generated by composing arbitrary sub-differentiable transformation functions. We perform an extensive evaluation on the popular CIFAR-10 and ILSVRC 2012 datasets measuring our UAPs' robustness under a wide range common, real-world transformations such as rotation, contrast changes, etc. We further show that by using a set of primitive transformations our method can generalize well to unseen transformations such as fog, JPEG compression, etc. Our results show that our method can generate UAPs up to 23% more robust than state-of-the-art baselines.
