结合高斯滤波与MASK的G-MASK人脸对抗攻击

doi:10.19678/j.issn.1000-3428.0066455

摘要/Abstract

摘要：

深度神经网络的快速发展使其在计算机视觉和自然语言处理等领域取得较大成功，但是对抗攻击会导致神经网络的表现性能降低，对各类系统的安全保密性造成严重威胁。现有黑盒攻击方法在人脸识别中性能表现较差，攻击成功率较低且生成对抗样本迁移性不高。为此，提出一种结合高斯滤波与掩码的对抗攻击方法G-MASK。利用Grad-CAM输出的热力图确定对抗样本的掩码区域，使其只在掩码区域施加扰动，提高黑盒攻击成功率，采用扰动集成方法提高黑盒迁移能力，增强黑盒攻击鲁棒性，对生成的扰动进行高斯平滑处理，降低集成模型之间干扰噪声的差异，提高图像质量且增强扰动掩蔽性。实验结果表明，针对不同的人脸识别模型，G-MASK方法在保证白盒攻击成功率较高的条件下能够显著提升黑盒攻击效果，并具有更优的掩蔽性，经过模型扰动集成的对抗样本白盒攻击成功率均提高至98.5%以上，黑盒攻击成功率最高达到75.9%，与快速梯度符号法（FGSM）、迭代快速梯度符号法（Ⅰ-FGSM）和动量迭代梯度符号法（MI-FGSM）相比分别平均提升12.1、10.6和8.2个百分点，充分验证了该方法的有效性。

关键词: 对抗样本, 黑盒攻击, 人脸识别, 高斯滤波, 掩码

Abstract:

The rapid development of deep neural networks has led to significant success in fields such as computer vision and natural language processing. However, adversarial attacks may inhibit the performance of neural networks, posing a serious threat to the security and confidentiality of various systems. Existing black-box attack methods perform poorly in facial recognition, with a low success rate and low transferability of generated adversarial samples. To this end, a G-MASK adversarial attack method combining Gaussian filtering and mask is proposed. Using the heat map output by Grad-CAM to determine the mask area of adversarial samples, the mask area is perturbed to improve the success rate of black-box attacks. The perturbation integration method is used to improve the black-box migration ability and enhance attack robustness. Gaussian smoothing is applied to the generated perturbations to reduce the difference in interference noise between integrated models, improve image quality, and enhance disturbance masking. Experimental results show that for different facial recognition models, the G-MASK method significantly improves the effectiveness of black-box attacks while ensuring a high success rate of white-box attacks and a better masking ability. Following model perturbation integration, the success rate of white-box attacks on adversarial samples exceeds 98.5%, while the success rate of black-box attacks reaches 75.9%, which is consistent with the fast gradient sign method. Compared with Fast Gradient Symbolic Method(FGSM), Iteration-Fast Gradient Symbolic Method(Ⅰ-FGSM), Moenttum Iteration-Fast Gradient Symbolic Method(MI-FGSM) yields average improvements of 12.1, 10.6, and 8.2 percentage points.

Key words: adversarial sample, black-box attack, facial recognition, Gaussian filtering, mask

李倩, 向海昀, 张玉婷, 甘昀, 廖浩德. 结合高斯滤波与MASK的G-MASK人脸对抗攻击[J]. 计算机工程, 2024, 50(2): 308-316.

Qian LI, Haiyun XIANG, Yuting ZHANG, Yun GAN, Haode LIAO. G-MASK Facial Adversarial Attack Combining Gaussian Filtering and MASK[J]. Computer Engineering, 2024, 50(2): 308-316.

http://www.ecice06.com/CN/Y2024/V50/I2/308

图/表 8

图1 人脸关注区域热力图

Fig.1 Heatmap of facial focus area

图2 G-MASK人脸对抗攻击算法框架

Fig.2 Framework of G-MASK facial adversarial attack algorithm

图3 MASK和G-MASK的攻击成功率、余弦相似度、L2距离对比

Fig.3 Comparison of MASK and G-MASK of accuracy, cos-similarity, L2 distance

图4 不同攻击方法生成的对抗样本

Fig.4 Adversarial samples generated by different attack methods

参考文献 26

1	LI H F, HUANG H K, CHEN L, et al. Adversarial examples for CNN-based SAR image classification: an experience study. IEEE Journal of Selected Topics in Applied Earth Observations and Remote Sensing, 2021, 14, 1333- 1347. doi: 10.1109/JSTARS.2020.3038683
2	陈晓楠, 胡建敏, 张本俊, 等. 基于模型间迁移性的黑盒对抗攻击起点提升方法. 计算机工程, 2021, 47 (8): 162- 169. URL
	CHEN X N, HU J M, ZHANG B J, et al. Black box adversarial attack starting point promotion method based on mobility between models. Computer Engineering, 2021, 47 (8): 162- 169. URL
3	柴梦婷, 朱远平. 生成式对抗网络研究与应用进展. 计算机工程, 2019, 45 (9): 222- 234. URL
	CHAI M T, ZHU Y P. Research and application progress of generative adversarial networks. Computer Engineering, 2019, 45 (9): 222- 234. URL
4	SHEN M, YU H, ZHU L H, et al. Effective and robust physical-world attacks on deep learning face recognition systems. IEEE Transactions on Information Forensics and Security, 2021, 16, 4063- 4077. doi: 10.1109/TIFS.2021.3102492
5	KRIZHEVSKY A, SUTSKEVER I, HINTON G E. ImageNet classification with deep convolutional neural networks. Communications of the ACM, 2017, 60 (6): 84- 90. doi: 10.1145/3065386
6	SIMONYAN K, ZISSERMAN A, Very deep convolutional networks for large-scale image recognition[EB/OL]. [2022-11-05]. https://arxiv.org/pdf/1409.1556.pdf.
7	SZEGEDY C, VANHOUCKE V, IOFFE S, et al. Rethinking the inception architecture for computer vision[C]//Proceedings of Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2016: 1-10.
8	SZEGEDY C, IOFFE S, VANHOUCKE V, et al. Inception-v4, Inception-ResNet and the impact of residual connections on learning[C]//Proceedings of the 31st AAAI Conference on Artificial Intelligence. [S. l.]: AAAI Press, 2017: 4278-4284.
9	SHARIF M, BHAGAVATULA S, BAUER L, et al. Accessorize to a crime: real and stealthy attacks on state-of-the-art face recognition[C]//Proceedings of ACM SIGSAC Conference on Computer and Communications Security. New York, USA: ACM Press, 2016: 1528-1540.
10	姜妍, 张立国. 面向深度学习模型的对抗攻击与防御方法综述. 计算机工程, 2021, 47 (1): 1- 11. doi: 10.3969/j.issn.1007-130X.2021.01.001
	JIANG Y, ZHANG L G. Survey of adversarial attacks and defense methods for deep learning model. Computer Engineering, 2021, 47 (1): 1- 11. doi: 10.3969/j.issn.1007-130X.2021.01.001
11	GOODFELLOW I J, SHLENS J, SZEGEDY C. Explaining and harnessing adversarial examples[EB/OL]. [2022-11-05]. https://arxiv.org/pdf/1412.6572.pdf.
12	KURAKIN A, GOODFELLOW I J, BENGIO S, et al. Adversarial machine learning at scale[EB/OL]. [2022-11-05]. https://arxiv.org/pdf/1611.01236.pdf.
13	DONG Y P, LIAO F Z, PANG T Y, et al. Boosting adversarial attacks with momentum[C]//Proceedings of Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2018: 9185-9193.
14	ZHANG Y K, JIANG Z Y, VILLALBA J, et al. Black-box attacks on spoofing countermeasures using transferability of adversarial examples[C]//Proceedings of Conference on the International Speech Communication Association. Washington D. C., USA: IEEE Press, 2020: 4238-4242.
15	TAIGMAN Y, YANG M, RANZATO M, et al. DeepFace: closing the gap to human-level performance in face verification[C]//Proceedings of Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2014: 1-10.
16	SUN Y, WANG X G, TANG X O. Deep learning face representation from predicting 10, 000 classes[C]//Proceedings of Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2014: 1-10.
17	HE K M, ZHANG X Y, REN S Q, et al. Deep residual learning for image recognition[C]//Proceedings of Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2016: 770-778.
18	HU J E, SHEN L, SUN G. Squeeze-and-excitation networks[C]//Proceedings of Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2018: 7132-7141.
19	WANG F, JIANG M Q, QIAN C, et al. Residual attention network for image classification[C]//Proceedings of Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2017: 1-10.
20	WANG P S, CHENG J. Accelerating convolutional neural networks for mobile applications[C]//Proceedings of Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2017: 1-10.
21	SELVARAJU R R, COGSWELL M, DAS A, et al. Grad-CAM: why did you say that? Visual explanations from deep networks via gradient-based localization[EB/OL]. [2022-11-05]. https://arxiv.org/pdf/1610.02391.pdf.
22	MOOSAVI-DEZFOOLI S M, FAWZI A, FAWZI O, et al. Universal adversarial perturbations[C]//Proceedings of Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2017: 1765-1773.
23	HUANG G B, MATTAR M A, BERG T L, et al. Labeled faces in the wild: a database for studying face recognition in unconstrained environments[EB/OL]. [2022-11-02]. http://download.xuebalib.com/1jeugxZEdrG3.pdf.
24	KINGMA D P, BA J. Adam: a method for stochastic optimization[EB/OL]. [2022-11-05]. https://arxiv.org/abs/1412.6980.
25	WEI X X, LIANG S Y, CHEN N, et al. Transferable adversarial attacks for image and video object detection[C]//Proceedings of the 28th International Joint Conference on Artificial Intelligence. New York, USA: ACM Press, 2019: 954-960.
26	ZHANG K P, ZHANG Z P, LI Z F, et al. Joint face detection and alignment using multitask cascaded convolutional networks. IEEE Signal Processing Letters, 2016, 23 (10): 1499- 1503. doi: 10.1109/LSP.2016.2603342

[1]	刘帅威, 李智, 王国美, 张丽. 基于Transformer和GAN的对抗样本生成算法[J]. 计算机工程, 2024, 50(2): 180-187.
[2]	张玉婷, 向海昀, 李倩, 廖浩德. 基于稳定Adam和空间域变换的对抗样本生成算法[J]. 计算机工程, 2024, 50(1): 251-258.
[3]	李哲铭, 王晋东, 侯建中, 李伟, 张世华, 张恒巍. 基于显著区域优化的对抗样本攻击方法[J]. 计算机工程, 2023, 49(9): 246-255, 264.
[4]	杨燕燕, 谢明轩, 曹江峡, 王学宾, 柳厅文, 杜彦辉. 基于原型网络的中文分类模型对抗样本生成[J]. 计算机工程, 2023, 49(8): 54-62.
[5]	石进, 徐杨, 曹斌. 基于自适应三线性池化网络的细粒度图像分类[J]. 计算机工程, 2023, 49(5): 239-246,254.
[6]	白祉旭, 王衡军. 基于改进遗传算法的对抗样本生成方法[J]. 计算机工程, 2023, 49(5): 139-149.
[7]	冉瑞生, 翁稳稳, 王宁, 彭顺顺. 基于人脸关键特征提取的表情识别[J]. 计算机工程, 2023, 49(2): 254-262.
[8]	王春东, 孙嘉琪, 杨文军. 基于矫正理解的中文文本对抗样本生成方法[J]. 计算机工程, 2023, 49(2): 37-45.
[9]	张金鹏, 段湘煜. 结合向量化方法与掩码机制的术语干预翻译模型[J]. 计算机工程, 2023, 49(11): 70-76, 84.
[10]	谢云旭, 吴锡, 彭静. 无锚框模型类梯度全局对抗样本生成[J]. 计算机工程, 2023, 49(10): 186-193.
[11]	王飞宇, 张帆, 杜加玉, 类红乐, 祁晓峰. 基于图像降噪与压缩的对抗样本检测方法[J]. 计算机工程, 2023, 49(10): 230-238.
[12]	郑德生, 陈继鑫, 周静, 柯武平, 陆超, 周永, 仇钎. 基于输入通道拆分的对抗攻击迁移性增强算法[J]. 计算机工程, 2023, 49(1): 130-137.
[13]	房志远, 石守东, 郑佳罄, 胡加钿. 融合弱层惩罚的卷积神经网络模型剪枝方法[J]. 计算机工程, 2022, 48(5): 67-73.
[14]	徐润昊, 程吉祥, 李志丹, 付小龙. 基于循环生成对抗网络的含遮挡人脸识别[J]. 计算机工程, 2022, 48(5): 289-296,305.
[15]	杨文雪, 吴非, 郭桐, 肖利民. 基于噪声溶解的对抗样本防御方法[J]. 计算机工程, 2022, 48(4): 158-164.

选择文件类型/文献管理软件名称

选择包含的内容