[论文解读] Adversarial Examples for Semantic Segmentation and Object Detection

Cihang Xie, Jianyu Wang+4 more|arXiv (Cornell University)|Mar 24, 2017

Adversarial Robustness in Machine Learning参考文献 33被引用 93

一句话总结

本文提出 Dense Adversary Generation (DAG)，用于生成难以察觉的扰动以欺骗语义分割和目标检测，并展示了跨架构与跨任务的强传输性。

ABSTRACT

It has been well demonstrated that adversarial examples, i.e., natural images with visually imperceptible perturbations added, generally exist for deep networks to fail on image classification. In this paper, we extend adversarial examples to semantic segmentation and object detection which are much more difficult. Our observation is that both segmentation and detection are based on classifying multiple targets on an image (e.g., the basic target is a pixel or a receptive field in segmentation, and an object proposal in detection), which inspires us to optimize a loss function over a set of pixels/proposals for generating adversarial perturbations. Based on this idea, we propose a novel algorithm named Dense Adversary Generation (DAG), which generates a large family of adversarial examples, and applies to a wide range of state-of-the-art deep networks for segmentation and detection. We also find that the adversarial perturbations can be transferred across networks with different training data, based on different architectures, and even for different recognition tasks. In particular, the transferability across networks with the same architecture is more significant than in other cases. Besides, summing up heterogeneous perturbations often leads to better transfer performance, which provides an effective method of black-box adversarial attack.

研究动机与目标

• 将对抗样本从图像分类扩展到语义分割和目标检测。
• 提出 Dense Adversary Generation (DAG)，对多目标同时优化扰动。
• 展示扰动能够在具有不同架构、训练数据和任务的网络之间传递。
• 研究影响攻击鲁棒性的因素，如 proposals（候选框/提案）密度和扰动融合。

提出的方法

• 将目标 T 定义为像素/感受野或对象提案。
• 通过对错误类别进行随机置换来分配对抗标签 L'。
• 最小化多目标损失 L = sum_n (f_l_n(X,t_n) - f_l'_n(X,t_n)).
• 通过对错误分类目标的梯度迭代计算扰动 r_m，并通过无穷范数归一化。
• 更新图像 X_m+1 = X_m + r'_m；当所有目标被错误分类或者达到固定迭代次数时停止（分割为 200 次，检测为 150 次）。
• 提高提案密度（NMS 的 IOU 阈值）以使 DAG 对扰动后产生的新提案具有鲁棒性。

实验结果

研究问题

• RQ1 在分割和大规模检测管线中，是否可以为密集目标集合生成对抗扰动？
• RQ2 扰动是否能在具有相同/不同架构、训练数据，甚至不同任务的网络之间传递？
• RQ3 输入提案密度如何影响攻击效果和收敛？
• RQ4 将来自多个模型的扰动结合在一起对传递性和攻击强度有何影响？

主要发现

• 扰动显著降低分割的 mIOU 和检测的 mAP。
• 更密集的提案集合（NMS 中更高的 IOU）会产生更强的对抗效果并使收敛变慢。
• 扰动的可感知度在各任务中都非常低，确保不可察觉。
• 扰动在同一架构、不同数据训练的模型之间传递良好，在一定程度上也能在不同架构之间传递。
• 将来自多个模型的异质扰动结合起来能显著增强传递性，形成强健的黑盒攻击。