基于小样本学习和因果干预的ResNeXt对抗攻击

doi:10.3778/j.issn.1002-8331.2102-0210

摘要/Abstract

摘要： 随着深度学习相关技术在计算机视觉、自然语言处理等领域的快速发展和广泛应用，深度学习模型逐渐成为了高价值攻击目标，其固有的易受噪声干扰的安全隐患也逐步暴露出来，如基于生成对抗网络（GAN）或机器学习的方式，通过添加少量特定的噪声来生成对抗样本，导致现有的深度学习模型失效。目前的对抗攻击技术一般针对特定深度学习模型，使用海量算力搜索特定扰动噪声，无论是GAN还是传统机器学习方式，其计算效率和对抗攻击成功率受制于数据、算力和模型网络结构。为了解决对抗攻击的计算效率和对抗攻击成功率问题，着眼于深度学习模型的结构化分析，以ResNeXt50/ResNeXt101为例，基于数据增强技术，经过调制干预，由非序列图像数据生成序列数据，进而分析ResNeXt50/ResNeXt101模型的结构弱点-时不变稳定结构，提出一种基于Wasserstein距离，仅需少量样本即可定位该结构性弱点的方法，最后基于[L]范数提出一种针对其结构性弱点的新型对抗攻击方法，对算力、数据的要求大幅下降。基于ImageNet数据集的测试表明，新方法能大幅降低对抗攻击所需的算力要求，以C&W方法为基准进行的理论分析和实验结果均表明，在同样环境下，该对抗攻击方法的成功率为0.99，相对于C&W方法提高了5.32%；平均攻击时间为6.52?s，相对于C&W算法降低了10.81%；对抗样本的失真度为0.50，相对于C&W算法降低了18.03%，各指标分析均表明本方法显著优于C&W方法。

关键词: 对抗攻击, 时不变稳定结构, Wasserstein距离, 小样本学习, ResNeXt

Abstract: With the rapid development of deep learning technologies, deep learning models have been widely applied in computer vision, natural language processing and other fields, and gradually become high-value attack targets. Various attack methods with generative adversarial network（GAN） or machine learning, by adding limited but sophisticatedly designed noise to the data, have already exposed the inherent security risks of existing deep learning models. Current attack methods usually target specific deep learning models and need massive computing power and data sets for searching the sophisticated noise. Their computing efficiency and the attack success rate are thus restricted by data scale, computing power, and model structure. To tackle this problem, the paper provides a novel structural analysis of deep learning models. Taking ResNeXt50/ResNeXt101 as an example, based on data enhancement technology, it launchs causal intervention to generate sequence data from non-sequential image data, and analyzes the structural weakness based on the extracted time-invariant stable substructure, and then proposes a method to locate the structural weakness, then provides a general method to attack deep learning models with the L norm. The experimental results on ImageNet dataset show that the proposed method can dramatically reduce the requirements on computing power and data size. The theoretical analysis and experimental results based on the C&W method show that the attack success rate of the attack method under the same environment is 0.99, which is 5.32% higher than the C&W method; the average attack launch time is 6.52?s, which is 10.81% lower than the C&W algorithm; the distortion of the adversarial sample is 0.50, which is 18.03% lower than the C&W algorithm. These indicators show that this method generally outperforms the typical method, C&W method.

Key words: adversarial attack, time-invariant stable structure, Wasserstein distance, few-shot learning, ResNeXt

王志勇, 邢凯, 邓洪武, 李亚鸣, 胡璇. 基于小样本学习和因果干预的ResNeXt对抗攻击[J]. 计算机工程与应用, 2022, 58(7): 68-76.

WANG Zhiyong, XING Kai, DENG Hongwu, LI Yaming, HU Xuan. Adversarial Attack Against ResNeXt Based on Few-Shot Learning and Causal Intervention[J]. Computer Engineering and Applications, 2022, 58(7): 68-76.

参考文献

[1] MAO J，XIAO T，CAO Z.What can help pedestrian detection[C]//Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition，2017：3127-3136.
[2] REDMON J，DIVVALA S，GIRSHICK R，et al.You only look once：Unified，real-time object detection[C]//Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition，2016：779-788.
[3] REN S，HE K，GIRSHICK R，et al.Faster R-CNN：Towards real-time object detection with region proposal networks[J].IEEE Transactions on Pattern Analysis and Machine Intelligence，2016，39：1137-1149.
[4] AKHTAR N，MIAN A.Threat of adversarial attacks on deep learning in computer vision：A survey[J].IEEE Access，2016，6：14410-14430.
[5] EYKHOLT K，EVTIMOV I，FERNANDES E，et al.Robust physical-world attacks on deep learning visual classification[C]//Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition，2018：1625-1634.
[6] WORZYK N，KAHLEN H，KRAMER O.Physical adversarial attacks by projecting perturbations[C]//International Conference on Artificial Neural Networks，2019：649-659.
[7] HE K，ZHANG X，REN S，et al.Deep residual learning for image recognition[C]//Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition，2016：770-778.
[8] GOODFELLOW I J，SHLENS J，SZEGEDY C.Explaining and harnessing adversarial examples[C]//Proceedings of International Conference on Learning Representations，2015.
[9] KURAKIN A，GOODFELLOW I，BENGIO S.Adversarial machine learning at scale[C]//Proceedings of International Conference on Learning Representations，2017.
[10] XIAO C，LI B，ZHU J，et al.Generating adversarial examples with adversarial networks[C]//Proceedings of the International Joint Conference on Artificial Intelligence，2018：3905-3911.
[11] JANDIAL S，MANGLA P，VARSHNEY S，et al.AdvGAN++：Harnessing latent layers for adversary generation[C]//Proceedings of the IEEE International Conference on Computer Vision Workshops，2019.
[12] SZEGEDY C，ZAREMBA W，SUTSKEVER I，et al.Intriguing properties of neural networks[C]//Proceedings of International Conference on Learning Representations，2014.
[13] CARLINI N，WAGNER D.Towards evaluating the robustness of neural networks[C]//Proceedings of IEEE Symposium on Security and Privacy（S&P），2017：39-57.
[14] DONG Y，LIAO F，PANG T，et al.Boosting adversarial attacks with momentum[C]//Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition，2018：9185-9193.
[15] ARJOVSKY M，CHINTALA S，BOTTOU L.Wasserstein GAN[C]//Proceedings of the 34th International Conference on Machine Learning，2017：214-223.
[16] GULRAJANI I，AHMED F，ARJOVSKY M，et al.Improved training of Wasserstein GANs[C]//Advances in Neural Information Processing Systems，2017：5767-5777.
[17] FROGNER C，ZHANG C，MOBAHI H，et al.Learning with a Wasserstein loss[C]//Advances in Neural Information Processing Systems，2015.
[18] PAPERNOT N，MCDANIEL P，JHA S，et al.The limitations of deep learning in adversarial settings[C]//Proceedings of 2016 IEEE European Symposium on Security and Privacy（EuroS&P），2016：372-387.
[19] CROCE F，HEIN M.Sparse and imperceivable adversarial attacks[C]//Proceedings of the IEEE International Conference on Computer Vision，2019：4724-4732.
[20] MOOSAVI-DEZFOOLI S M，FAWZI A，FROSSARD P.Deepfool：A simple and accurate method to fool deep neural networks[C]//Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition，2016：2574-2582.
[21] LAIDLAW C，FEIZI S.Functional adversarial attacks[C]//Advances in Neural Information Processing Systems，2019：10408-10418.
[22] SHARIF M，BHAGAVATULA S，BAUER L，et al.A general framework for adversarial examples with objectives[J].ACM Transactions on Privacy and Security（TOPS），2019，22：1-30.
[23] KOMKOV S，PETIUSHKO A.Advhat：Real-world adversarial attack on arcface face id system[J].arXiv：1908. 08705，2019.
[24] SABOUR S，CAO Y，FAGHRI F，et al.Adversarial manipulation of deep representations[C]//Proceedings of International Conference on Learning Representations，2016.
[25] ZHAO Z，DUA D，SINGH S.Generating natural adversarial examples[C]//Proceedings of International Conference on Learning Representations，2018.
[26] LI Z，YANG W，PENG S，et al.A survey of convolutional neural networks：Analysis，applications，and prospects[J].arXiv：2004.02806，2020.
[27] PETERS J，JANZING D，SCH?LKOPF B.Elements of causal inference[M].[S.l.]：The MIT Press，2017.
[28] GRANGER，C W J.Investigating causal relations by econometric models and cross-spectral methods[J].Econometrica，1969，37（3）：424-438.
[29] GRANGER C W J，NEWBOLD P.Forecasting economic time series[M].New York：Academic Press，1977：225.
[30] CUBUK E D，ZOPH B，MANE D，et al.Autoaugment：Learning augmentation policies from data[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition（CVPR），2019：113-123.
[31] SHORTEN C，KHOSHGOFTAAR T M.A survey on image data augmentation for deep learning[J].Journal of Big Data，2019，6：60.
[32] PEARL J，MACKENZIE D.The book of why：the new science of cause and effect[M].[S.l.]：Basic Books，2018.
[33] WOODWARD J.Making things happen：A theory of causal explanation[M].[S.l.]：Oxford University Press，2005.
[34] KOLESNIKOV A，ZHAI X，BEYER L.Revisiting self-supervised visual representation learning[C]//Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition，2019：1920-1929.
[35] SEHWAG V，BHAGOJI A N，SONG L，et al.Better the devil you know：An analysis of evasion attacks using out-of-distribution adversarial examples[J].arXiv：1905. 01726，2019.
[36] MADRY A，MAKELOV A，SCHMIDT L，et al.Towards deep learning models resistant to adversarial attacks[C]//Proceedings of International Conference on Learning Representations，2018.
[37] LIU W，WANG X，OWENS J D，et al.Energy-based out-of-distribution detection[C]//Advances in Neural Information Processing Systems，2020.
[38] LECUN Y，CHOPRA S，HADSELL R，et al.A tutorialon energy-based learning[M].[S.l.]：Predicting Structured Data MIT Press，2006.
[39] MOHSENI S，PITALE M，YADAWA J B S，et al.Self-supervised learning for generalizable out-of-distribution detection[C]//Proceedings of the AAAI Conference on Artificial Intelligence，2020：5216-5223.