作者投稿和查稿 主编审稿 专家审稿 编委审稿 远程编辑

计算机工程 ›› 2021, Vol. 47 ›› Issue (11): 150-157. doi: 10.19678/j.issn.1000-3428.0059405

• 网络空间安全 • 上一篇    下一篇

基于双对抗机制的图像攻击算法

黄静琪, 贾西平, 陈道鑫, 柏柯嘉, 廖秀秀   

  1. 广东技术师范大学 计算机科学学院, 广州 510665
  • 收稿日期:2020-09-01 修回日期:2020-11-26 发布日期:2020-12-09
  • 作者简介:黄静琪(1996-),女,硕士研究生,主研方向为模式识别、智能系统;贾西平,副教授、博士;陈道鑫,学士;柏柯嘉(通信作者),副教授、博士;廖秀秀,讲师、博士。
  • 基金资助:
    国家自然科学基金(61872096);广东省普通高校重点科研项目(2019KZDXM063);广东省教育厅青年创新人才项目(2016KQNCX092)。

Image Attack Algorithm Based on Bi-Adversary Mechanism

HUANG Jingqi, JIA Xiping, CHEN Daoxin, BAI Kejia, LIAO Xiuxiu   

  1. School of Computer Science, Guangdong Polytechnic Normal University, Guangzhou 510665, China
  • Received:2020-09-01 Revised:2020-11-26 Published:2020-12-09

摘要: 图像攻击是指通过对图像添加小幅扰动使深度神经网络产生误分类。针对现有图像攻击算法在变分自编码器(VAE)防御下攻击性能不稳定的问题,在AdvGAN算法的基础上,提出基于对抗机制的AntiVAEGAN算法获取对VAE防御的稳定攻击效果。为应对AntiVAEGAN算法防御能力提升时攻击性能不稳定的问题,结合生成器与鉴别器、生成器与VAE的双对抗机制提出改进的图像攻击算法VAEAdvGAN。在MNIST和GTSRB数据集上的实验结果表明,在无防御的情况下,AntiVAEGAN和VAEAdvGAN算法几乎能达到与AdvGAN算法相同的图像分类准确率和攻击成功率,而在VAE防御的情况下,VAEAdvGAN相比AdvGAN和AntiVAEGAN算法整体攻击效果更优。

关键词: 生成对抗网络, 图像攻击, 对抗样本, 变分自编码器防御, 防御模型

Abstract: Image attack can disable a deep neural network in image classification by adding a small amount of interference to the input image.However,most of the existing image attack algorithms are relatively fragile against Variational Auto-Encoder(VAE) defense.Based on the AdvGAN algorithm,an algorithm named AntiVAEGAN is proposed,which employs the adversary mechanism to penetrate VAE defenses persistent,but AntiVAEGAN suffers from a loss of attack performance when improving the defense performance.To address the problem,this paper proposes an improved image attack algorithm,VAEAdvGAN,by combining both the generator-discriminator defense mechanism and the generator-VAE defense mechanism.Experimental results on the MNIST dataset and GTSRB dataset show that without defense,AntiVAEGAN and VAEAdvGAN can achieve almost the same classification accuracy and attack success rate as AdvGAN.In the case of VAE defense,VAEAdvGAN exhibits better overall attack effect than AdvGAN and AntiVAEGAN.

Key words: Generative Adversarial Network(GAN), image attack, adversarial sample, Variational Auto-Encoder(VAE) defense, defense model

中图分类号: