无锚框模型类梯度全局对抗样本生成

doi:10.19678/j.issn.1000-3428.0065438

摘要/Abstract

摘要：

在计算机视觉任务中深度神经网络模型易受对抗样本的干扰，泛化性能高的对抗样本会影响更多的模型。为了研究深度神经网络模型的脆弱性进而改善该现状，提出一种基于类梯度的全局对抗样本生成方法。以图像中的目标类为单位快速进行类梯度收集，通过一次性融合同一类别内所有目标的梯度来体现类内相似性与类间差异性。在此基础上，结合数据集中一定比例的图像及对应的图片尺度扰动生成全局扰动。通过上述过程突破模型候选框及图片数量的制约，生成的全局扰动可以对大量数据形成有效的影响。实验结果表明，该方法在Pascal VOC和MS-COCO-keypoints数据集的2种计算机视觉任务中性能均优于PGD、FPE等算法，其攻击成功率比DAG算法高1个百分点，比FPE算法高34个百分点，同时推断扰动速度较快。全局扰动的存在揭示了深度神经网络模型在高维决策边界之间存在一定的几何相关性，利用所提方法有助于深度神经网络抵抗泛化性能更高的全局对抗样本。

关键词: 对抗样本, 全局扰动, 目标检测, 人体姿态估计, 无锚框模型

Abstract:

In computer vision tasks, deep neural network models are susceptible to interference from adversarial samples, and adversarial samples with high generalization performance will more greatly affect models. To investigate the fragility of deep neural network models and improve the current situation, a global adversarial sample generation method based on class gradient is proposed. It quickly collects class gradients based on the target class in the image, reflecting intra-class similarity and inter-class differences by fusing the gradients of all targets within the same class at once. On this basis, global perturbations are generated by combining a certain proportion of images in the dataset with corresponding image scale perturbations. By eliminating the constraints of model candidate boxes and the number of images through the above process, the generated global disturbance can effectively affect a large amount of data. Experimental results show that this method outperforms algorithms such as PGD and FPE in two computer vision tasks on the Pascal VOC and MS-COCO-keypoints datasets. Its attack success rate is 1 percentage point higher than that of the DAG algorithm and 34 percentage points higher than that of the FPE algorithm, and the inference disturbance speed is faster. The existence of global disturbance reveals that the deep neural network model has certain geometric correlation with the high-dimensional decision boundary, and the proposed method can help the deep neural network to resist the global confrontation samples with higher generalization performance.

Key words: adversarial example, global perturbation, object detection, human pose estimation, anchor-free model

谢云旭, 吴锡, 彭静. 无锚框模型类梯度全局对抗样本生成[J]. 计算机工程, 2023, 49(10): 186-193.

Yunxu XIE, Xi WU, Jing PENG. Generation of Gradient Global Adversarial Samples with Anchor-Free Model[J]. Computer Engineering, 2023, 49(10): 186-193.

https://www.ecice06.com/CN/Y2023/V49/I10/186

图/表 10

图1 GCP算法总体流程

Fig.1 Overall procedure of GCP algorithm

图2 单张图像扰动与全局扰动示意图

Fig.2 Schematic diagram of single image perturbation and global perturbation

图3 Pascal VOC数据集上干净样本和对抗样本的可视化结果

Fig.3 Visualization results of clean and adversarial samples on Pascal VOC dataset

图4 参与生成全局扰动的图像数与

$ {{m}}_{{m}{A}{P}, {a}{t}{t}{a}{c}{k}} $

的关系

Fig.4 The relationship between the number of images involved in generating global perturbations and

$ {{m}}_{{m}{A}{P}, {a}{t}{t}{a}{c}{k}} $

图5 全局扰动循环数对ASR的影响

Fig.5 Influence of global disturbance cyclic number on ASR

图6 全局扰动可视化结果

Fig.6 Global disturbance visualization results

参考文献 31

1	GOODFELLOW I J, SHLENS J, SZEGEDY C. Explaining and harnessing adversarial examples[EB/OL]. [2022-07-05]. https://arxiv.org/abs/1412.6572.
2	KURAKIN A, GOODFELLOW I, BENGIO S. Adversarial examples in the physical world[EB/OL]. [2022-07-05]. https://arxiv.org/abs/1607.02533.
3	SZEGEDY C, ZAREMBA W, SUTSKEVER I, et al. Intriguing properties of neural networks[EB/OL]. [2022-07-05]. https://arxiv.org/abs/1312.6199.
4	MOOSAVI-DEZFOOLI S M, FAWZI A, FROSSARD P. DeepFool: a simple and accurate method to fool deep neural networks[C]//Proceedings of IEEE Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2016: 2574-2582.
5	MODAS A, MOOSAVI-DEZFOOLI S M, FROSSARD P. SparseFool: a few pixels make a big difference[C]//Proceedings of IEEE/CVF Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2020: 9079-9088.
6	PAPERNOT N, MCDANIEL P, JHA S, et al. The limitations of deep learning in adversarial settings[C]//Proceedings of IEEE European Symposium on Security and Privacy. Washington D. C., USA: IEEE Press, 2016: 372-387.
7	CARLINI N, WAGNER D. Towards evaluating the robustness of neural networks[C]//Proceedings of IEEE Symposium on Security and Privacy. Washington D. C., USA: IEEE Press, 2017: 39-57.
8	LIU W, ANGUELOV D, ERHAN D, et al. SSD: single shot MultiBox detector[EB/OL]. [2022-07-05]. https://arxiv.org/pdf/1512.02325.pdf.
9	REDMON J, FARHADI A. YOLO9000: better, faster, stronger[C]//Proceedings of IEEE Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2017: 6517-6525.
10	REDMON J, FARHADI A. YOLOv3: an incremental improvement[EB/OL]. [2022-07-05]. https://arxiv.org/abs/1804.02767.
11	REN S Q, HE K M, GIRSHICK R, et al. Faster R-CNN: towards real-time object detection with region proposal networks. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2017, 39(6): 1137- 1149. doi: 10.1109/TPAMI.2016.2577031
12	LIU Z Y, TAN Y C, HE Q, et al. SwinNet: swin transformer drives edge-aware RGB-D and RGB-T salient object detection. IEEE Transactions on Circuits and Systems for Video Technology, 2022, 32(7): 4486- 4497. doi: 10.1109/TCSVT.2021.3127149
13	XIE C H, WANG J Y, ZHANG Z S, et al. Adversarial examples for semantic segmentation and object detection[C]//Proceedings of IEEE International Conference on Computer Vision. Washington D. C., USA: IEEE Press, 2017: 1378-1387.
14	WEI X, LIANG S, CHEN N, et al. Transferable adversarial attacks for image and video object detection[EB/OL]. [2022-07-05]. https://arxiv.org/abs/1811.12641.
15	JIAO Y F, YAO H T, XU C S. PEN: pose-embedding network for pedestrian detection. IEEE Transactions on Circuits and Systems for Video Technology, 2021, 31(3): 1150- 1162. doi: 10.1109/TCSVT.2020.3000223
16	LIU S G, LI Y, HUA G G. Human pose estimation in video via structured space learning and halfway temporal evaluation. IEEE Transactions on Circuits and Systems for Video Technology, 2019, 29(7): 2029- 2038. doi: 10.1109/TCSVT.2018.2858828
17	WEI S H, RAMAKRISHNA V, KANADE T, et al. Convolutional pose machines[C]//Proceedings of IEEE Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2016: 4724-4732.
18	NEWELL A, YANG K Y, DENG J. Stacked Hourglass networks for human pose estimation[EB/OL]. [2022-07-05]. https://arxiv.org/pdf/1603.06937.pdf.
19	NEWELL A, HUANG Z A, DENG J. Associative embedding: end-to-end learning for joint detection and grouping[C]//Proceedings of the 31st International Conference on Neural Information Processing Systems. New York, USA: ACM Press, 2017: 2274-2284.
20	CHENG B, XIAO B, WANG J, et al. Bottom-up higher-resolution networks for multi-person pose estimation[EB/OL]. [2022-07-05]. https://arxiv.org/pdf/1908.10357v2.pdf.
21	SHAH S, JAIN N, SHARMA A, et al. On the robustness of human pose estimation[EB/OL]. [2022-07-05]. https://arxiv.org/abs/1908.06401.
22	MOOSAVI-DEZFOOLI S M, FAWZI A, FAWZI O, et al. Universal adversarial perturbations[C]//Proceedings of IEEE Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2017: 86-94.
23	METZEN J H, KUMAR M C, BROX T, et al. Universal adversarial perturbations against semantic image segmentation[C]//Proceedings of IEEE International Conference on Computer Vision. Washington D. C., USA: IEEE Press, 2017: 2774-2783.
24	EVERINGHAM M, GOOL L, WILLIAMS C K, et al. The Pascal Visual Object Classes(VOC) challenge. International Journal of Computer Vision, 2010, 88(2): 303- 338. doi: 10.1007/s11263-009-0275-4
25	LIN T Y, MAIRE M, BELONGIE S, et al. Microsoft COCO: common objects in context[EB/OL]. [2022-07-05]. https://arxiv.org/abs/1405.0312.
26	ZHOU X, WANG D, KRÄHENBÜHL P. Objects as points[EB/OL]. [2022-07-05]. https://arxiv.org/abs/1904.07850.
27	ZHOU X Y, ZHUO J C, KRÄHENBÜHL P. Bottom-up object detection by grouping extreme and center points[C]//Proceedings of IEEE/CVF Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2020: 850-859.
28	LAW H, DENG J. CornerNet: detecting objects as paired keypoints[EB/OL]. [2022-07-05]. https://arxiv.org/abs/1808.01244.
29	SHELHAMER E, LONG J, DARRELL T. Fully convolutional networks for semantic segmentation[C]//Proceedings of IEEE Conference on Pattern Analysis and Machine Intelligence. Washington D. C., USA: IEEE Press, 2016: 640-651.
30	ZHU X Z, HU H, LIN S, et al. Deformable ConvNets V2: more deformable, better results[C]//Proceedings of IEEE/CVF Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2020: 9300-9308.
31	YU F, WANG D Q, SHELHAMER E, et al. Deep layer aggregation[C]//Proceedings of IEEE/CVF Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2018: 2403-2412.

[1]	张天鹏, 韩晶, 吕学强. 基于多任务学习的超分辨率辅助小目标检测[J]. 计算机工程, 2024, 50(9): 304-312.
[2]	曾钰琦, 刘博, 钟柏昌, 钟瑾. 智慧教育下基于改进YOLOv8的学生课堂行为检测算法[J]. 计算机工程, 2024, 50(9): 344-355.
[3]	王昱婷, 刘志明, 万亚平, 朱涛. 基于可见光与红外图像的弱光条件下目标检测[J]. 计算机工程, 2024, 50(8): 270-281.
[4]	贵向泉, 刘世清, 李立, 秦庆松, 李唐艳. 基于改进YOLOv8的景区行人检测算法[J]. 计算机工程, 2024, 50(7): 342-351.
[5]	刘仕兵, 周诗涵. 高铁接触网绝缘子检测算法研究[J]. 计算机工程, 2024, 50(5): 200-208.
[6]	孙帮勇, 马铭, 于涛. 基于区域特征强化的多尺度伪装目标检测方法[J]. 计算机工程, 2024, 50(5): 209-219.
[7]	赵继达, 甄国涌, 储成群. 基于YOLOv8的无人机图像目标检测算法[J]. 计算机工程, 2024, 50(4): 113-120.
[8]	崔丽群, 曹华维. 基于改进YOLOv5的遥感图像目标检测[J]. 计算机工程, 2024, 50(4): 228-236.
[9]	赵佳圆, 张玉茹, 苏晓东, 徐红岩, 李世洲, 张玉荣. 基于注意力机制的人体关键点隐式建模网络[J]. 计算机工程, 2024, 50(3): 317-325.
[10]	周金涛, 高迪驹, 刘志全. 基于全景视觉的无人船水面障碍物检测方法[J]. 计算机工程, 2024, 50(2): 113-121.
[11]	刘帅威, 李智, 王国美, 张丽. 基于Transformer和GAN的对抗样本生成算法[J]. 计算机工程, 2024, 50(2): 180-187.
[12]	李倩, 向海昀, 张玉婷, 甘昀, 廖浩德. 结合高斯滤波与MASK的G-MASK人脸对抗攻击[J]. 计算机工程, 2024, 50(2): 308-316.
[13]	王子豪, 方成, 李丽萍, 鹿存跃. 基于热力图预测的免“锚框”人物目标检测算法[J]. 计算机工程, 2024, 50(10): 51-60.
[14]	袁昊, 葛海波, 辛世澳, 胥冬梅, 杨雨迪. 基于深度纹理特征的伪装目标边缘细化检测[J]. 计算机工程, 2024, 50(10): 89-99.
[15]	戴磊, 曹林, 郭亚男, 张帆, 杜康宁. 基于生成对抗网络的深度伪造跨模型防御方法[J]. 计算机工程, 2024, 50(10): 100-109.

选择文件类型/文献管理软件名称

选择包含的内容