摘要： 深度神经网络(DNN)容易受到对抗样本的攻击,在干净图像中添加微小扰动就使分类器产生错误分类。基于决策的攻击是一类只依赖目标模型预测硬标签输出的黑盒攻击,将目标模型视为黑匣子,攻击时只需对目标模型结果进行查询,而无需了解模型内部结构和参数信息,这种特性对现实世界的应用程序构成了严重的威胁。目前,基于决策的攻击方法通常利用梯度估计在目标模型决策边界附近发动攻击,但需要高昂的查询代价且生成的对抗样本质量效果不佳,失真较为严重。由于图像在频率空间中的低频信息能够有效表征其重要特征,在低频空间执行决策攻击,不仅有助于降低查询次数,还能生成高质量的对抗样本,因此提出一种基于圆几何性质的黑盒攻击方法CBA。该方法利用离散余弦变换(DCT),选择在频率空间中进行攻击,低频信息在其决策边界附近根据圆的几何性质不断迭代得到低频空间中的对抗样本。最后,逆离散余弦变换将其变换回输入空间,可以避免梯度估计,在保证攻击成功率的同时显著减少查询次数。在ImageNet数据集上的实验结果表明,CBA在查询量分别为500、1 000、2 000次的情况下,生成对抗样本的攻击成功率均比最新利用决策边界的几何性质的黑盒攻击方法高。同时,CBA在相同查询量不同约束条件下,也具有更高的攻击成功率。因此,CBA减少了生成对抗样本所需的查询量,生成的对抗样本失真更小,图像质量更佳,除此之外,还在现实世界模型中测试了CBA的有效性。

关键词: 深度神经网络, 对抗样本, 决策攻击, 低频空间, 图像处理

Abstract: Deep Neural Networks (DNNs) are vulnerable to adversarial examples and adding even a small perturbation to a clean image can cause a misclassification. Decision-based attacks are a class of black-box attacks that rely only on a target model to predict hard-label outputs. They consider the target model as a black box, and the attack queries the results of the target model without requiring access to its internal structure or parameter information. This poses a significant threat in real-world applications. Current decision-based attacks typically utilize gradient estimation to launch attacks near the decision boundary of the target model; however, they require high query costs and generate poor-quality adversarial examples with more severe distortion. The results of this study show that low-frequency information in the frequency space of an image can effectively capture important features of an image. A decision-based attack in a low-frequency space not only helps reduce the number of queries but also generates high-quality adversarial samples. To this end, this study proposes a black-box attack method based on the geometric properties of circles, called CBA. This method utilizes a Discrete Cosine Transform (DCT) to obtain adversarial examples in the frequency space using the geometric properties of circles near the decision boundary in a continuous iteration. Finally, the Inverse Discrete Cosine Transform (IDCT) changes them back into input space. This avoids gradient estimation and significantly reduces the number of queries while guaranteeing the success rate of the attack. Experimental results on the ImageNet dataset show that the attack success rate of CBA for generating adversarial examples is higher than that of the latest black-box attack methods, which utilize the geometric nature of the decision boundaries for query volumes of 500, 1 000, 2 000, respectively. Additionally, CBA has a higher attack success rate under different constraints for the same query volume. These results show that CBA reduces the number of queries required to generate adversarial examples and generates adversarial examples with less distortion and better image quality. Additionally, the effectiveness of CBA is tested using a real-world model.

Key words: Deep Neural Network(DNN), adversarial examples, decision-based attack, low-frequency space, image processing

中图分类号: 

• TP391