摘要： 图像攻击是指通过对图像添加小幅扰动使深度神经网络产生误分类。针对现有图像攻击算法在变分自编码器（VAE）防御下攻击性能不稳定的问题，在AdvGAN算法的基础上，提出基于对抗机制的AntiVAEGAN算法获取对VAE防御的稳定攻击效果。为应对AntiVAEGAN算法防御能力提升时攻击性能不稳定的问题，结合生成器与鉴别器、生成器与VAE的双对抗机制提出改进的图像攻击算法VAEAdvGAN。在MNIST和GTSRB数据集上的实验结果表明，在无防御的情况下，AntiVAEGAN和VAEAdvGAN算法几乎能达到与AdvGAN算法相同的图像分类准确率和攻击成功率，而在VAE防御的情况下，VAEAdvGAN相比AdvGAN和AntiVAEGAN算法整体攻击效果更优。

关键词: 生成对抗网络, 图像攻击, 对抗样本, 变分自编码器防御, 防御模型

Abstract: Image attack can disable a deep neural network in image classification by adding a small amount of interference to the input image.However,most of the existing image attack algorithms are relatively fragile against Variational Auto-Encoder(VAE) defense.Based on the AdvGAN algorithm,an algorithm named AntiVAEGAN is proposed,which employs the adversary mechanism to penetrate VAE defenses persistent,but AntiVAEGAN suffers from a loss of attack performance when improving the defense performance.To address the problem,this paper proposes an improved image attack algorithm,VAEAdvGAN,by combining both the generator-discriminator defense mechanism and the generator-VAE defense mechanism.Experimental results on the MNIST dataset and GTSRB dataset show that without defense,AntiVAEGAN and VAEAdvGAN can achieve almost the same classification accuracy and attack success rate as AdvGAN.In the case of VAE defense,VAEAdvGAN exhibits better overall attack effect than AdvGAN and AntiVAEGAN.

Key words: Generative Adversarial Network(GAN), image attack, adversarial sample, Variational Auto-Encoder(VAE) defense, defense model

中图分类号: 

• TP391