[论文解读] Adversarial Attacks on Convolutional Neural Networks in Facial Recognition Domain

Yigit Alparslan, Alparslan, Ken+3 more|arXiv (Cornell University)|Jan 30, 2020

Adversarial Robustness in Machine Learning参考文献 14被引用 12

一句话总结

本文研究了使用卷积神经网络（CNN）对人脸识别系统实施对抗性攻击，应用快速梯度符号法（FGSM）和黑箱攻击策略生成扰动。结果表明，即使扰动水平较高，人脸仍可被人眼识别，但分类器的置信度最高下降84%，误分类率高达81.6%，凸显深度神经网络鲁棒性的关键缺陷。

ABSTRACT

Numerous recent studies have demonstrated how Deep Neural Network (DNN) classifiers can be fooled by adversarial examples, in which an attacker adds perturbations to an original sample, causing the classifier to misclassify the sample. Adversarial attacks that render DNNs vulnerable in real life represent a serious threat in autonomous vehicles, malware filters, or biometric authentication systems. In this paper, we apply Fast Gradient Sign Method to introduce perturbations to a facial image dataset and then test the output on a different classifier that we trained ourselves, to analyze transferability of this method. Next, we craft a variety of different black-box attack algorithms on a facial image dataset assuming minimal adversarial knowledge, to further assess the robustness of DNNs in facial recognition. While experimenting with different image distortion techniques, we focus on modifying single optimal pixels by a large amount, or modifying all pixels by a smaller amount, or combining these two attack approaches. While our single-pixel attacks achieved about a 15% average decrease in classifier confidence level for the actual class, the all-pixel attacks were more successful and achieved up to an 84% average decrease in confidence, along with an 81.6% misclassification rate, in the case of the attack that we tested with the highest levels of perturbation. Even with these high levels of perturbation, the face images remained identifiable to a human. Understanding how these noised and perturbed images baffle the classification algorithms can yield valuable advances in the training of DNNs against defense-aware adversarial attacks, as well as adaptive noise reduction techniques. We hope our research may help to advance the study of adversarial attacks on DNNs and defensive mechanisms to counteract them, particularly in the facial recognition domain.

研究动机与目标

• 评估通过快速梯度符号法（FGSM）生成的对抗性样本在人脸识别模型上的可迁移性。
• 评估在极少先验知识（黑箱攻击）条件下，深度神经网络在人脸识别任务中的鲁棒性。
• 研究单像素与全像素扰动策略在降低分类器性能方面的有效性。
• 分析感知上微小的扰动如何显著降低模型置信度，同时保持人脸的人类可识别性。

提出的方法

• 对人脸图像数据集应用快速梯度符号法（FGSM）生成对抗性样本。
• 训练一个独立的分类器以测试FGSM生成扰动的可迁移性。
• 设计黑箱攻击算法，假设对目标模型架构或参数知之甚少。
• 探索两种攻击策略：大幅修改单个最优像素，或以较小幅度扰动所有像素。
• 结合两种策略，评估其对分类器置信度和误分类率的综合影响。
• 通过人工评估确认，尽管模型失效，扰动后的图像仍能被人类观察者视觉识别为人脸。

实验结果

研究问题

• RQ1 FGSM生成的对抗性样本在不同人脸识别模型之间可迁移的程度如何？
• RQ2 当攻击者对目标模型知之甚少时，黑箱攻击的有效性如何？
• RQ3 单像素与全像素扰动对分类器置信度和准确率的相对影响是什么？
• RQ4 对抗性扰动能否在人类难以察觉的情况下显著降低模型性能？
• RQ5 结合单像素与全像素攻击策略如何影响人脸识别中模型的鲁棒性？

主要发现

• 单像素攻击使正确类别的分类器置信度平均降低约15%。
• 全像素攻击在高扰动水平下，使真实类别置信度平均最高下降84%。
• 最有效的全像素攻击导致81.6%的误分类率，表明攻击成功率极高。
• 尽管扰动水平较高，所有对抗性扰动的人脸仍可被人类观察者识别。
• 确认了FGSM生成的对抗性样本在相同数据集上训练的不同分类器之间具有可迁移性。
• 结合单像素与全像素策略显著提升了攻击效果，表明对模型性能造成了协同性降级。