摘要：

对抗样本的研究能够促进防御方法的创新, 查漏补缺, 进而提高模型的鲁棒性。现有的目标检测对抗攻击方法的研究大多存在黑盒迁移能力不强、生成的对抗样本泛化能力不足的问题。为解决上述问题, 提出了一种提升对抗样本的迁移性和抑制目标检测器正确分类的算法GM-DEC。首先, 将GridMask数据增强方法引入基于梯度迭代的对抗样本生成过程中, 从而获得更加泛化的梯度信息, 有助于增强攻击的鲁棒性, 避免陷入局部最优和生成的对抗样本过度拟合白盒模型的情况; 其次, 为进一步增强对抗样本的迁移性, 设计一种基于注意力的关注区域抑制损失函数, 通过抑制注意力热图的大小, 使得模型关注其他非目标区域, 从而做出错误的预测; 最后, 在迭代更新的过程中引入动量迭代快速梯度符号方法(MI-FGSM)中的动量项, 累积速度矢量, 从而稳定更新方向, 实现更快收敛。在Pascal VOC2007数据集上的实验结果表明, 所提算法能够有效攻击Faster R-CNN、YOLO、SSD等目标检测器, 与目前针对目标检测的攻击算法相比黑盒攻击成功率约提升10~30百分点, 拥有较好的迁移性。

关键词: 目标检测, 对抗样本, 黑盒攻击, GridMask, 注意力抑制

Abstract:

The study of adversarial examples can promote innovation in defense methods, identify gaps, and thus improve the robustness of a model. Most of the existing studies on object detection against attack methods suffer from poor black-box migration ability and insufficient generalization ability of the generated adversarial examples. To solve these problems, a algorithm called GM-DEC is proposed to enhance the mobility of adversarial examples and inhibit the correct classification of object detectors. First, GridMask, a data augmentation method, is introduced into the gradient iteration-based adversarial example generation process to obtain more generalized gradient information, thereby helping to enhance the robustness of the attack and avoid falling into local optima and overfitting white-box models with generated adversarial examples. Second, to further enhance the transferability of the adversarial examples, an attention-based region-of-attention suppression loss function is designed, which makes the model focus on other non-targeted regions by suppressing the size of the attention heatmap, thus leading to incorrect predictions. Finally, the momentum term in Momentum Iterative-Fast Gradient Sign Method (MI-FGSM) is introduced during the iterative updating process to accumulate velocity vectors, thus stabilizing the updating direction and achieving faster convergence. Experiments are carried out on the Pascal VOC2007 dataset, and the results show that the proposed algorithm can effectively attack object detectors such as Faster R-CNN, YOLO, and SSD. The success rate of the black-box attack is improved by approximately 10-30 percentage point compared with the current attack algorithms for object detection, accompanied by better transferability.

Key words: object detection, adversarial example, black-box attack, GridMask, attention suppression