基于U-Net的对抗样本防御模型

doi:10.19678/j.issn.1000-3428.0060571

计算机工程 ›› 2021, Vol. 47 ›› Issue (12): 163-170. doi: 10.19678/j.issn.1000-3428.0060571

基于U-Net的对抗样本防御模型

赖妍菱¹, 石峻峰¹, 陈继鑫¹, 白汉利², 唐晓澜¹, 邓碧颖¹, 郑德生¹

1. 西南石油大学计算机科学学院, 成都 610500;
2. 中国空气动力研究与发展中心, 四川绵阳 621000

收稿日期:2021-01-12 修回日期:2021-04-25 发布日期:2021-05-08
作者简介:赖妍菱(1997-),女,硕士研究生,主研方向为对抗样本防御;石峻峰,学士;陈继鑫,硕士研究生;白汉利,高级工程师、硕士;唐晓澜、邓碧颖,硕士研究生;郑德生,副研究员、博士。
基金资助:
四川省重大科技专项“新时代互联网+人工智能个性定制化智能教育研发与应用”（18ZDZX）。

Adversarial Example Defense Model Based on U-Net

LAI Yanling¹, SHI Junfeng¹, CHEN Jixin¹, BAI Hanli², TANG Xiaolan¹, DENG Biying¹, ZHENG Desheng¹

1. School of Computer Science, Southwest Petroleum University, Chengdu 610500, China;
2. China Aerodynamics Research and Development Center, Mianyang, Sichuan 621000, China

Received:2021-01-12 Revised:2021-04-25 Published:2021-05-08

摘要/Abstract

摘要： 对抗攻击是指对图像添加微小的扰动使深度神经网络以高置信度输出错误分类。提出一种对抗样本防御模型SE-ResU-Net，基于图像语义分割网络U-Net架构，引入残差模块和挤压激励模块，通过压缩和重建方式进行特征提取和图像还原，破坏对抗样本中的扰动结构。实验结果表明，SE-ResU-Net模型能对MI-FGSM、PGD、DeepFool、C&W攻击的对抗样本实施有效防御，在CIFAR10和Fashion-MNIST数据集上的防御成功率最高达到87.0%和93.2%，且具有较好的泛化性能。

关键词: 深度神经网络, 图像分类, 对抗攻击, 对抗样本, 防御模型, CIFAR10数据集, Fashion-MNIST数据集

Abstract: Adversarial attack refers to adding a small disturbance to the image to make the deep neural network output the wrong classification with high confidence.An adversarial sample defense model named SE-ResU-Net is proposed, based on the image semantic segmentation network U-Net architecture, the residual module and the extrusion excitation module are introduced, and feature extraction and image restoration are performed through compression and reconstruction methods, destroying the perturbation structure in the adversarial sample.Experimental results show that SE-ResU-Net can effectively defend against MI-FGSM, PGD, DeepFool, and C&W attack adversarial samples.The defense success rate on CIFAR10 and Fashion-MNIST datasets is up to 87.0% and 93.2%, and has good generalization performance.

Key words: deep neural network, image classification, adversarial attack, adversarial example, defense model, CIFAR10 dataset, Fashion-MNIST dataset

中图分类号:

TP391.41

赖妍菱, 石峻峰, 陈继鑫, 白汉利, 唐晓澜, 邓碧颖, 郑德生. 基于U-Net的对抗样本防御模型[J]. 计算机工程, 2021, 47(12): 163-170.

LAI Yanling, SHI Junfeng, CHEN Jixin, BAI Hanli, TANG Xiaolan, DENG Biying, ZHENG Desheng. Adversarial Example Defense Model Based on U-Net[J]. Computer Engineering, 2021, 47(12): 163-170.

http://www.ecice06.com/CN/Y2021/V47/I12/163

图/表 17

20211213182555

20211213182559

20211213182602

20211213182605

20211213182609

20211213182612

20211213182615

20211213182618

20211213182621

20211213182625

20211213182628

20211213182631

20211213182634

20211213182638

20211213182642

20211213182646

20211213182650

参考文献

[1] JORDAN M I, MITCHELL T M.Machine learning:trends, perspectives, and prospects[J].Science, 2015, 349(6245):255-260.
[2] 陈晓楠, 胡建敏, 张本俊, 等.基于模型间迁移性的黑盒对抗攻击起点提升方法[J].计算机工程, 2021, 47(8):162-169. CHEN X N, HU J M, ZHANG B J, et al.Black-box adversarial attack starting point improvement method based on migration between models[J].Computer Engineering, 2021, 47(8):162-169.(in Chinese)
[3] LI X Y, ZHU Q S, ZHU M Z, et al.Machine learning study of the relationship between the geometric and entropy discord[J].Europhysics Letters, 2019, 127(2):20009.
[4] QU Z G, CHEN S Y, WANG X J.A secure controlled quantum image steganography algorithm[J].Quantum Information Processing, 2020, 19(10):1-25.
[5] AKHTAR N, MIAN A.Threat of adversarial attacks on deep learning in computer vision:a survey[J].IEEE Access, 2018, 6:14410-14430.
[6] 姜妍, 张立国.面向深度学习模型的对抗攻击与防御方法综述[J].计算机工程, 2021, 47(1):1-11. JIANG Y, ZHANG L G.Survey of adversarial attacks and defense methods for deep learning model[J].Computer Engineering, 2021, 47(1):1-11.(in Chinese).
[7] ZHENG D S, RAN Z Y, LIU Z F, et al.An efficient bar code image recognition algorithm for sorting system[J].Computers, Materials & Continua, 2020, 64(3):1885-1895.
[8] TRAMÈR F, KURAKIN A, PAPERNOT N, et al.Ensemble adversarial training:attacks and defenses[EB/OL].[2020-12-08].https://arxiv.org/abs/1705.07204.
[9] PAPERNOT N, MCDANIEL P, WU X, et al.Distillation as a defense to adversarial perturbations against deep neural networks[C]//Proceedings of 2016 IEEE Symposium on Security and Privacy.Washington D.C., USA:IEEE Press, 2016:582-597.
[10] LI X Y, ZHU Q S, HUANG Y M, et al.Research on the freezing phenomenon of quantum correlation by machine learning[J].Computers, Materials & Continua, 2020, 65(3):2143-2151.
[11] DAS N, SHANBHOGUE M, CHEN S T, et al.Keeping the bad guys out:protecting and vaccinating deep learning with JPEG compression[EB/OL].[2020-12-08].https://arxiv.org/abs/1705.02900.
[12] NICOLAE M I, SINN M, TRAN M N, et al.Adversarial robustness toolbox v0.2.2[EB/OL].[2020-12-08].https://arxiv.org/abs/1807.01069v1.
[13] SONG Y, KIM T, NOWOZIN S, et al.PixelDefend:leveraging generative models to understand and defend against adversarial examples[EB/OL].[2020-12-08].https://arxiv.org/abs/1710.10766.
[14] XIE C H, WU Y X, MAATEN L V D, et al.Feature denoising for improving adversarial robustness[C]//Proceedings of 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition.Washington D.C., USA:IEEE Press, 2019:501-509.
[15] GOODFELLOW I J, SHLENS J, SZEGEDY C.Explaining and harnessing adversarial examples[EB/OL].[2020-12-08].https://arxiv.org/abs/1412.6572.
[16] DONG Y P, LIAO F Z, PANG T, et al.Boosting adversarial attacks with momentum[C]//Proceedings of 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition.Washington D.C., USA:IEEE Press, 2018:9185-9193.
[17] TASHIRO Y, SONG Y, ERMON S.Output diversified initialization for adversarial attacks[EB/OL].[2020-12-08].https://arxiv.org/abs/2003.06878v1#.
[18] MOOSAVI-DEZFOOLI S M, FAWZI A, FROSSARD P.DeepFool:a simple and accurate method to fool deep neural networks[C]//Proceedings of 2016 IEEE Conference on Computer Vision and Pattern Recognition.Washington D.C., USA:IEEE Press, 2016:2574-2582.
[19] CARLINI N, WAGNER D.Towards evaluating the robustness of neural networks[C]//Proceedings of 2017 IEEE Symposium on Security and Privacy.Washington D.C., USA:IEEE Press, 2017:39-57.
[20] XU W L, EVANS D, QI Y J.FeatureSqueezing:detecting adversarial examples in deep neural networks[C]//Proceedings of 2018 Network and Distributed System Security Symposium.Washington D.C., USA:IEEE Press, 2018:1-10.
[21] JIA X J, WEI X X, CAO X C, et al.ComDefend:an efficient image compression model to defend adversarial examples[C]//Proceedings of 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition.Washington D.C., USA:IEEE Press, 2019:6077-6085.
[22] RONNEBERGER O, FISCHER P, BROX T.U-Net:convolutional networks for biomedical image segmentation[C]//Proceedings of 2015 International Conference on Medical Image Computing and Computer-Assisted Intervention.Berlin, Germany:Springer, 2015:234-241.
[23] WENG Y, ZHOU T B, LI Y J, et al.NAS-Unet:neural architecture search for medical image segmentation[J].IEEE Access, 2019, 7:44247-44257.
[24] ZENG Z T, XIE W H, ZHANG Y Z, et al.RIC-Unet:an improved neural network based on Unet for nuclei segmentation in histology images[J].IEEE Access, 2019, 7:21420-21428.
[25] JIN Q G, MENG Z P, SUN C M, et al.RA-UNet:a hybrid deep attention-aware network to extract liver and tumor in CT scans[J].Frontiers in Bioengineering and Biotechnology, 2020, 8:605132.
[26] HE K M, ZHANG X Y, REN S Q, et al.Deep residual learning for image recognition[C]//Proceedings of 2016 IEEE Conference on Computer Vision and Pattern Recognition.Washington D.C., USA:IEEE Press, 2016:770-778.
[27] TARG S, ALMEIDA D, LYMAN K.Resnet in Resnet:generalizing residual architectures[EB/OL].[2020-12-08].https://arxiv.org/abs/1603.08029.
[28] HU J, SHEN L, SUN G.Squeeze-and-excitation networks[C]//Proceedings of 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition.Washington D.C., USA:IEEE Press, 2018:7132-7141.
[29] YAN W S, HUA Y Q.Deep residual SENet for foliage recognition[M].Berlin, Germany:Springer, 2020.
[30] LEDIG C, THEIS L, HUSZÁR F, et al.Photo-realistic single image super-resolution using a generative adversarial network[C]//Proceedings of 2017 IEEE Conference on Computer Vision and Pattern Recognition.Washington D.C., USA:IEEE Press, 2017:105-114.

选择文件类型/文献管理软件名称

选择包含的内容

基于U-Net的对抗样本防御模型

Adversarial Example Defense Model Based on U-Net

RichHTML

PDF

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 17

参考文献

相关文章 15

编辑推荐

Metrics

本文评价

[1]	杨燕燕, 谢明轩, 曹江峡, 王学宾, 柳厅文, 杜彦辉. 基于原型网络的中文分类模型对抗样本生成[J]. 计算机工程, 2023, 49(8): 54-62.
[2]	靳雁霞, 史志儒, 杨晶, 刘亚变, 乔星宇, 张翎. 布料与精细建模物体间的碰撞检测算法研究[J]. 计算机工程, 2023, 49(7): 269-277.
[3]	曹坪, 杨怀志, 薄一军, 尤嘉, 张淳杰, 李丹勇. 面向低质量裂缝图像的多知识蒸馏分类[J]. 计算机工程, 2023, 49(7): 204-213.
[4]	石进, 徐杨, 曹斌. 基于自适应三线性池化网络的细粒度图像分类[J]. 计算机工程, 2023, 49(5): 239-246,254.
[5]	白祉旭, 王衡军. 基于改进遗传算法的对抗样本生成方法[J]. 计算机工程, 2023, 49(5): 139-149.
[6]	陈锐, 孙羽菲, 郭强, 隋轶丞, 周振辉, 石昌青, 张玉志. OclDNN:一种可应用于TensorFlow的通用DNN库[J]. 计算机工程, 2023, 49(4): 138-148.
[7]	石磊, 张吉涛, 高宇飞, 卫琳, 陶永才. 基于Transformer与BiLSTM的网络流量入侵检测[J]. 计算机工程, 2023, 49(3): 29-36,57.
[8]	王春东, 孙嘉琪, 杨文军. 基于矫正理解的中文文本对抗样本生成方法[J]. 计算机工程, 2023, 49(2): 37-45.
[9]	刘金硕, 詹岱依, 邓娟, 王丽娜. 基于深度神经网络和联邦学习的网络入侵检测[J]. 计算机工程, 2023, 49(1): 15-21,30.
[10]	郑德生, 陈继鑫, 周静, 柯武平, 陆超, 周永, 仇钎. 基于输入通道拆分的对抗攻击迁移性增强算法[J]. 计算机工程, 2023, 49(1): 130-137.
[11]	韩彦岭, 沈思扬, 徐利军, 王静, 张云, 周汝雁. 面向深度学习图像分类的GPU并行方法研究[J]. 计算机工程, 2023, 49(1): 191-200.
[12]	董卫宇, 李海涛, 王瑞敏, 任化娟, 孙雪凯. 基于堆叠卷积注意力的网络流量异常检测模型[J]. 计算机工程, 2022, 48(9): 12-19.
[13]	陈珊, 孙仁诚, 邵峰晶, 隋毅. 基于胶囊网络的动态路由研究与改进[J]. 计算机工程, 2022, 48(5): 208-214.
[14]	袁单飞, 陈慈发, 董方敏. 基于多尺度分割的图像识别残差网络研究[J]. 计算机工程, 2022, 48(5): 258-262,271.
[15]	张恒, 陈晓红, 蓝宇翔, 李舜酩. 基于深度学习的监督型典型相关分析[J]. 计算机工程, 2022, 48(5): 222-228.

模态框（Modal）标题

选择文件类型/文献管理软件名称

选择包含的内容

基于U-Net的对抗样本防御模型

Adversarial Example Defense Model Based on U-Net

RichHTML

PDF

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 17

参考文献

相关文章 15

编辑推荐

Metrics

本文评价