电子学报 ›› 2022, Vol. 50 ›› Issue (1): 207-216.DOI: 10.12263/DZXB.20200839

• 学术论文 • 上一篇    下一篇

基于噪声初始化、Adam-Nesterov方法和准双曲动量方法的对抗样本生成方法

邹军华1, 段晔鑫1,2, 任传伦3, 邱俊洋4, 周星宇1, 潘志松1   

  1. 1.陆军工程大学指挥控制工程学院,江苏 南京 210007
    2.陆军军事交通学院镇江校区,江苏 镇江 212003
    3.华北计算技术研究所,北京 100083
    4.江南计算所数字工程与先进计算国家重点实验室,江苏 无锡 214083
  • 收稿日期:2020-08-04 修回日期:2021-01-22 出版日期:2022-01-25
    • 作者简介:
    • 邹军华 男,1991年12月出生,广东河源人.2017年获解放军理工大学硕士学位.现为陆军工程大学在读博士.研究方向为对抗学习.E-mail:278287847@qq.com
      潘志松(通信作者) 男,1973年3月出生,江苏南京人.2003年获南京航空航天大学博士学位.现为陆军工程大学教授,博士生导师.研究方向为人工智能、模式识别.E-mail:panzs@nuaa.edu.cn
    • 基金资助:
    • 国家自然科学基金 (62076251)

Perturbation Initialization, Adam-Nesterov and Quasi-Hyperbolic Momentum for Adversarial Examples

ZOU Jun-hua1, DUAN Ye-xin1,2, REN Chuan-lun3, QIU Jun-yang4, ZHOU Xing-yu1, PAN Zhi-song1   

  1. 1.Command and Control Engineering College, Army Engineering University of PLA, Nanjing, Jiangsu 210007, China
    2.Zhenjiang Campus, Army Military Transportation University of PLA, Zhenjiang, Jiangsu 212003, China
    3.North China Institute of Computer Technology, Beijing 100083, China
    4.Mathematical Engineering and Advanced Computing, Jiangnan Institute of Computing Technology, Wuxi, Jiangsu 214083, China
  • Received:2020-08-04 Revised:2021-01-22 Online:2022-01-25 Published:2022-01-25
    • Supported by:
    • National Natural Science Foundation of China (62076251)

摘要:

深度神经网络在多种模式识别任务上都取得了巨大突破,但相关研究表明深度神经网络存在脆弱性,容易被精心设计的对抗样本攻击.本文以分类任务为着手点,研究对抗样本的迁移性,提出基于噪声初始化、Adam-Nesterov方法和准双曲动量方法的对抗样本生成方法.本文提出一种对抗噪声的初始化方法,通过像素偏移方法来预先增强干净样本的攻击性能.同时,本文使用Adam-Nesterov方法和准双曲动量方法来改进现有方法中的Nesterov方法和动量方法,实现更高的黑盒攻击成功率.在不需要额外运行时间和运算资源的情况下,本文方法可以和其他的攻击方法组合,并显著提高了对抗样本的黑盒攻击成功率.实验表明,本文的最强攻击组合为ANI-TI-DIQHM*(其中*代表噪声初始化),其对经典防御方法的平均黑盒攻击成功率达到88.68%,对较为先进的防御方法的平均黑盒攻击成功率达到82.77%,均超过现有最高水平.

关键词: 对抗样本, Adam-Nesterov方法, 准双曲动量方法, 噪声初始化, 迁移性能

Abstract:

Deep neural networks(DNNs) have made great breakthrough in many pattern recognition tasks. However, relevant research shows that the DNNs are vulnerable to adversarial examples. In this paper, we study the transferability of adversarial examples in the classification task, and propose perturbation initialization, the quasi-hyperbolic momentum iterative fast gradient sign method(QHMI-FGSM) and the adam-nesterov iterative fast gradient sign method(ANI-FGSM). We propose perturbation initialization method called pixel shift in adversarial attack. Furthermore, QHMI-FGSM and ANI-FGSM proposed in this paper are the improvements on the existing momentum iterative fast gradient sign method(MI-FGSM) and nesterov iterative fast gradient sign method(NI-FGSM). Additionally, perturbation initialization, QHMI-FGSM and ANI-FGSM are easily integrated into other existing methods, which can significantly improve the success rates of black-box attacks without additional running time and computing resources. Experimental results show that our best attack ANI-TI-DIQHM* can fool six classic black-box defense models with an average success rate of 88.68%, and fool four advance black-box defense models with an average success rate of 82.77%, which are higher than the state-of-the-art results.

Key words: adversarial examples, Adam-Nesterov method, quasi-hyperbolic momentum method, perturbation initialization, transferability

中图分类号: