摘要：

对抗样本是评估深度神经网络(DNN)鲁棒性和揭示其潜在安全隐患的重要手段。基于生成对抗网络(GAN)的对抗样本生成方法(AdvGAN)在生成图像对抗样本方面取得显著进展, 但该方法生成的扰动稀疏性不足且幅度较大, 导致对抗样本的真实性较低。为解决这一问题, 基于AdvGAN提出一种改进的图像对抗样本生成方法(SE-AdvGAN)。SE-AdvGAN通过构造SE注意力生成器和SE残差判别器来提高扰动的稀疏性。SE注意力生成器用于提取图像关键特征, 限制扰动生成位置, SE残差判别器指导生成器避免生成无关扰动。同时, 在SE注意力生成器的损失函数中加入以l₂范数为基准的边界损失以限制扰动的幅度, 从而提高对抗样本的真实性。实验结果表明, 在白盒攻击场景下, SE-AdvGAN相较于现有方法生成的对抗样本扰动稀疏性更高、幅度更小, 并且在不同目标模型上均取得了更好的攻击效果, 说明SE-AdvGAN生成的高质量对抗样本可以更有效地评估DNN模型的鲁棒性。

关键词: 对抗样本, 生成对抗网络, 稀疏扰动, 深度神经网络, 鲁棒性

Abstract:

Adversarial examples are crucial for evaluating the robustness of Deep Neural Network (DNN) and revealing their potential security risks. The adversarial example generation method based on a Generative Adversarial Network (GAN), AdvGAN, has made significant progress in generating image adversarial examples; however, the sparsity and amplitude of the perturbation generated by this method are insufficient, resulting in lower authenticity of adversarial examples. To address this issue, this study proposes an improved image adversarial example generation method based on AdvGAN, Squeeze-and-Excitation (SE)-AdvGAN. SE-AdvGAN improves the sparsity of perturbation by constructing an SE attention generator and an SE residual discriminator. The SE attention generator is used to extract the key features of an image and limit the position of perturbation generation. The SE residual discriminator guides the generator to avoid generating irrelevant perturbation. Moreover, a boundary loss based on l₂ norm is added to the loss function of the SE attention generator to limit the amplitude of perturbation, thereby improving the authenticity of adversarial examples. The experimental results indicate that in the white box attack scenario, the SE-AdvGAN method has higher sparsity and smaller amplitude of adversarial example perturbation compared to existing methods and achieves better attack performance on different target models. This indicates that the high-quality adversarial examples generated by SE-AdvGAN can more effectively evaluate the robustness of DNN.

Key words: adversarial example, Generative Adversarial Network (GAN), sparse perturbation, Deep Neural Network (DNN), robustness