无锚框模型类梯度全局对抗样本生成

doi:10.19678/j.issn.1000-3428.0065438

摘要/Abstract

摘要：

在计算机视觉任务中深度神经网络模型易受对抗样本的干扰，泛化性能高的对抗样本会影响更多的模型。为了研究深度神经网络模型的脆弱性进而改善该现状，提出一种基于类梯度的全局对抗样本生成方法。以图像中的目标类为单位快速进行类梯度收集，通过一次性融合同一类别内所有目标的梯度来体现类内相似性与类间差异性。在此基础上，结合数据集中一定比例的图像及对应的图片尺度扰动生成全局扰动。通过上述过程突破模型候选框及图片数量的制约，生成的全局扰动可以对大量数据形成有效的影响。实验结果表明，该方法在Pascal VOC和MS-COCO-keypoints数据集的2种计算机视觉任务中性能均优于PGD、FPE等算法，其攻击成功率比DAG算法高1个百分点，比FPE算法高34个百分点，同时推断扰动速度较快。全局扰动的存在揭示了深度神经网络模型在高维决策边界之间存在一定的几何相关性，利用所提方法有助于深度神经网络抵抗泛化性能更高的全局对抗样本。

关键词: 对抗样本, 全局扰动, 目标检测, 人体姿态估计, 无锚框模型

Abstract:

In computer vision tasks, deep neural network models are susceptible to interference from adversarial samples, and adversarial samples with high generalization performance will more greatly affect models. To investigate the fragility of deep neural network models and improve the current situation, a global adversarial sample generation method based on class gradient is proposed. It quickly collects class gradients based on the target class in the image, reflecting intra-class similarity and inter-class differences by fusing the gradients of all targets within the same class at once. On this basis, global perturbations are generated by combining a certain proportion of images in the dataset with corresponding image scale perturbations. By eliminating the constraints of model candidate boxes and the number of images through the above process, the generated global disturbance can effectively affect a large amount of data. Experimental results show that this method outperforms algorithms such as PGD and FPE in two computer vision tasks on the Pascal VOC and MS-COCO-keypoints datasets. Its attack success rate is 1 percentage point higher than that of the DAG algorithm and 34 percentage points higher than that of the FPE algorithm, and the inference disturbance speed is faster. The existence of global disturbance reveals that the deep neural network model has certain geometric correlation with the high-dimensional decision boundary, and the proposed method can help the deep neural network to resist the global confrontation samples with higher generalization performance.

Key words: adversarial example, global perturbation, object detection, human pose estimation, anchor-free model

谢云旭, 吴锡, 彭静. 无锚框模型类梯度全局对抗样本生成[J]. 计算机工程, 2023, 49(10): 186-193.

Yunxu XIE, Xi WU, Jing PENG. Generation of Gradient Global Adversarial Samples with Anchor-Free Model[J]. Computer Engineering, 2023, 49(10): 186-193.

http://www.ecice06.com/CN/Y2023/V49/I10/186

图/表 10

图1 GCP算法总体流程

Fig.1 Overall procedure of GCP algorithm

图2 单张图像扰动与全局扰动示意图

Fig.2 Schematic diagram of single image perturbation and global perturbation

图3 Pascal VOC数据集上干净样本和对抗样本的可视化结果

Fig.3 Visualization results of clean and adversarial samples on Pascal VOC dataset

图4 参与生成全局扰动的图像数与

$ {{m}}_{{m}{A}{P}, {a}{t}{t}{a}{c}{k}} $

的关系

Fig.4 The relationship between the number of images involved in generating global perturbations and

$ {{m}}_{{m}{A}{P}, {a}{t}{t}{a}{c}{k}} $

图5 全局扰动循环数对ASR的影响

Fig.5 Influence of global disturbance cyclic number on ASR

图6 全局扰动可视化结果

Fig.6 Global disturbance visualization results

参考文献 31

1	GOODFELLOW I J, SHLENS J, SZEGEDY C. Explaining and harnessing adversarial examples[EB/OL]. [2022-07-05]. https://arxiv.org/abs/1412.6572.
2	KURAKIN A, GOODFELLOW I, BENGIO S. Adversarial examples in the physical world[EB/OL]. [2022-07-05]. https://arxiv.org/abs/1607.02533.
3	SZEGEDY C, ZAREMBA W, SUTSKEVER I, et al. Intriguing properties of neural networks[EB/OL]. [2022-07-05]. https://arxiv.org/abs/1312.6199.
4	MOOSAVI-DEZFOOLI S M, FAWZI A, FROSSARD P. DeepFool: a simple and accurate method to fool deep neural networks[C]//Proceedings of IEEE Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2016: 2574-2582.
5	MODAS A, MOOSAVI-DEZFOOLI S M, FROSSARD P. SparseFool: a few pixels make a big difference[C]//Proceedings of IEEE/CVF Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2020: 9079-9088.
6	PAPERNOT N, MCDANIEL P, JHA S, et al. The limitations of deep learning in adversarial settings[C]//Proceedings of IEEE European Symposium on Security and Privacy. Washington D. C., USA: IEEE Press, 2016: 372-387.
7	CARLINI N, WAGNER D. Towards evaluating the robustness of neural networks[C]//Proceedings of IEEE Symposium on Security and Privacy. Washington D. C., USA: IEEE Press, 2017: 39-57.
8	LIU W, ANGUELOV D, ERHAN D, et al. SSD: single shot MultiBox detector[EB/OL]. [2022-07-05]. https://arxiv.org/pdf/1512.02325.pdf.
9	REDMON J, FARHADI A. YOLO9000: better, faster, stronger[C]//Proceedings of IEEE Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2017: 6517-6525.
10	REDMON J, FARHADI A. YOLOv3: an incremental improvement[EB/OL]. [2022-07-05]. https://arxiv.org/abs/1804.02767.
11	REN S Q, HE K M, GIRSHICK R, et al. Faster R-CNN: towards real-time object detection with region proposal networks. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2017, 39(6): 1137- 1149. doi: 10.1109/TPAMI.2016.2577031
12	LIU Z Y, TAN Y C, HE Q, et al. SwinNet: swin transformer drives edge-aware RGB-D and RGB-T salient object detection. IEEE Transactions on Circuits and Systems for Video Technology, 2022, 32(7): 4486- 4497. doi: 10.1109/TCSVT.2021.3127149
13	XIE C H, WANG J Y, ZHANG Z S, et al. Adversarial examples for semantic segmentation and object detection[C]//Proceedings of IEEE International Conference on Computer Vision. Washington D. C., USA: IEEE Press, 2017: 1378-1387.
14	WEI X, LIANG S, CHEN N, et al. Transferable adversarial attacks for image and video object detection[EB/OL]. [2022-07-05]. https://arxiv.org/abs/1811.12641.
15	JIAO Y F, YAO H T, XU C S. PEN: pose-embedding network for pedestrian detection. IEEE Transactions on Circuits and Systems for Video Technology, 2021, 31(3): 1150- 1162. doi: 10.1109/TCSVT.2020.3000223
16	LIU S G, LI Y, HUA G G. Human pose estimation in video via structured space learning and halfway temporal evaluation. IEEE Transactions on Circuits and Systems for Video Technology, 2019, 29(7): 2029- 2038. doi: 10.1109/TCSVT.2018.2858828
17	WEI S H, RAMAKRISHNA V, KANADE T, et al. Convolutional pose machines[C]//Proceedings of IEEE Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2016: 4724-4732.
18	NEWELL A, YANG K Y, DENG J. Stacked Hourglass networks for human pose estimation[EB/OL]. [2022-07-05]. https://arxiv.org/pdf/1603.06937.pdf.
19	NEWELL A, HUANG Z A, DENG J. Associative embedding: end-to-end learning for joint detection and grouping[C]//Proceedings of the 31st International Conference on Neural Information Processing Systems. New York, USA: ACM Press, 2017: 2274-2284.
20	CHENG B, XIAO B, WANG J, et al. Bottom-up higher-resolution networks for multi-person pose estimation[EB/OL]. [2022-07-05]. https://arxiv.org/pdf/1908.10357v2.pdf.
21	SHAH S, JAIN N, SHARMA A, et al. On the robustness of human pose estimation[EB/OL]. [2022-07-05]. https://arxiv.org/abs/1908.06401.
22	MOOSAVI-DEZFOOLI S M, FAWZI A, FAWZI O, et al. Universal adversarial perturbations[C]//Proceedings of IEEE Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2017: 86-94.
23	METZEN J H, KUMAR M C, BROX T, et al. Universal adversarial perturbations against semantic image segmentation[C]//Proceedings of IEEE International Conference on Computer Vision. Washington D. C., USA: IEEE Press, 2017: 2774-2783.
24	EVERINGHAM M, GOOL L, WILLIAMS C K, et al. The Pascal Visual Object Classes(VOC) challenge. International Journal of Computer Vision, 2010, 88(2): 303- 338. doi: 10.1007/s11263-009-0275-4
25	LIN T Y, MAIRE M, BELONGIE S, et al. Microsoft COCO: common objects in context[EB/OL]. [2022-07-05]. https://arxiv.org/abs/1405.0312.
26	ZHOU X, WANG D, KRÄHENBÜHL P. Objects as points[EB/OL]. [2022-07-05]. https://arxiv.org/abs/1904.07850.
27	ZHOU X Y, ZHUO J C, KRÄHENBÜHL P. Bottom-up object detection by grouping extreme and center points[C]//Proceedings of IEEE/CVF Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2020: 850-859.
28	LAW H, DENG J. CornerNet: detecting objects as paired keypoints[EB/OL]. [2022-07-05]. https://arxiv.org/abs/1808.01244.
29	SHELHAMER E, LONG J, DARRELL T. Fully convolutional networks for semantic segmentation[C]//Proceedings of IEEE Conference on Pattern Analysis and Machine Intelligence. Washington D. C., USA: IEEE Press, 2016: 640-651.
30	ZHU X Z, HU H, LIN S, et al. Deformable ConvNets V2: more deformable, better results[C]//Proceedings of IEEE/CVF Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2020: 9300-9308.
31	YU F, WANG D Q, SHELHAMER E, et al. Deep layer aggregation[C]//Proceedings of IEEE/CVF Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2018: 2403-2412.

[1]	李嘉新, 侯进, 盛博莹, 周宇航. 基于改进YOLOv5的遥感小目标检测网络[J]. 计算机工程, 2023, 49(9): 256-264.
[2]	李哲铭, 王晋东, 侯建中, 李伟, 张世华, 张恒巍. 基于显著区域优化的对抗样本攻击方法[J]. 计算机工程, 2023, 49(9): 246-255, 264.
[3]	龙玉江, 卫薇, 舒彧, 张正刚, 王道累, 李峰. 基于自适应关键点的破损旋转绝缘子检测方法[J]. 计算机工程, 2023, 49(9): 272-278.
[4]	徐春波, 闫娟, 杨慧斌, 王博, 吴晗. 基于目标检测和语义分割的视觉SLAM算法[J]. 计算机工程, 2023, 49(8): 199-206, 214.
[5]	宋志娜, 李莎, 杨建明, 徐川. 基于特征与区域定位增强的遥感舰船目标检测[J]. 计算机工程, 2023, 49(8): 257-264.
[6]	杨燕燕, 谢明轩, 曹江峡, 王学宾, 柳厅文, 杜彦辉. 基于原型网络的中文分类模型对抗样本生成[J]. 计算机工程, 2023, 49(8): 54-62.
[7]	刘俊豪, 王美林, 谢兴, 宋烨兴, 许莉花. 基于改进YOLOv5的皮革瑕疵检测算法[J]. 计算机工程, 2023, 49(8): 240-249.
[8]	李强龙, 周新文, 位梦恩, 甘阳洲. 基于条形池化和注意力机制的街道场景红外目标检测算法[J]. 计算机工程, 2023, 49(8): 310-320.
[9]	闫兴亚, 匡娅茜, 白光睿, 李月. 基于深度学习的学生课堂行为识别方法[J]. 计算机工程, 2023, 49(7): 251-258.
[10]	聂志勇, 阴宇薇, 汤佳欣, 涂志刚. 一种基于边界框关键点距离的框回归算法[J]. 计算机工程, 2023, 49(7): 65-75.
[11]	刘豪, 吴红兰, 房宇轩. 结合全局上下文信息的高效人体姿态估计[J]. 计算机工程, 2023, 49(7): 102-109.
[12]	李军侠, 王星驰, 殷梓, 石德硕. 边缘深度挖掘的弱监督显著性目标检测[J]. 计算机工程, 2023, 49(7): 169-178.
[13]	吴珊, 周凤. 基于改进SSD算法的小目标检测[J]. 计算机工程, 2023, 49(7): 179-188.
[14]	王款, 宣士斌, 何雪东, 李紫薇, 李嘉祥. 基于交叉注意力Transformer的人体姿态估计方法[J]. 计算机工程, 2023, 49(7): 223-231.
[15]	齐咏生, 杜晓旭, 朱俊峰, 高胜利, 刘利强. 基于增强型轻量深度网络的牧区牲畜高效检测[J]. 计算机工程, 2023, 49(7): 278-287.

选择文件类型/文献管理软件名称

选择包含的内容