[论文解读] Adversarial Perturbations Prevail in the Y-Channel of the YCbCr Color Space

Camilo Pestana, Naveed Akhtar+3 more|arXiv (Cornell University)|Feb 25, 2020

Adversarial Robustness in Machine Learning参考文献 53被引用 9

一句话总结

本文提出ResUpNet，一种模型无关的防御方法，通过在上采样框架中利用ResNet特征，仅从YCbCr色彩空间的Y通道中去除对抗性扰动。该方法通过聚焦于扰动最集中的Y通道，在输入变换防御中实现了最先进性能，同时保持了对干净图像的高准确率，并在PGD、FGSM和DDN攻击下优于现有方法。

ABSTRACT

Deep learning offers state of the art solutions for image recognition. However, deep models are vulnerable to adversarial perturbations in images that are subtle but significantly change the model's prediction. In a white-box attack, these perturbations are generally learned for deep models that operate on RGB images and, hence, the perturbations are equally distributed in the RGB color space. In this paper, we show that the adversarial perturbations prevail in the Y-channel of the YCbCr space. Our finding is motivated from the fact that the human vision and deep models are more responsive to shape and texture rather than color. Based on our finding, we propose a defense against adversarial images. Our defence, coined ResUpNet, removes perturbations only from the Y-channel by exploiting ResNet features in an upsampling framework without the need for a bottleneck. At the final stage, the untouched CbCr-channels are combined with the refined Y-channel to restore the clean image. Note that ResUpNet is model agnostic as it does not modify the DNN structure. ResUpNet is trained end-to-end in Pytorch and the results are compared to existing defence techniques in the input transformation category. Our results show that our approach achieves the best balance between defence against adversarial attacks such as FGSM, PGD and DDN and maintaining the original accuracies of VGG-16, ResNet50 and DenseNet121 on clean images. We perform another experiment to show that learning adversarial perturbations only for the Y-channel results in higher fooling rates for the same perturbation magnitude.

研究动机与目标

• 研究对抗性扰动在RGB和YCbCr空间中各色彩通道的分布情况。
• 鉴于Y通道在对抗性扰动中占主导地位，开发一种专门针对Y通道的防御方法。
• 构建一种模型无关的输入变换防御方法，在保持干净图像准确率的同时提升鲁棒性。
• 通过仅在Y通道上优化对抗性攻击，以减少所需扰动幅度。

提出的方法

• 将输入图像从RGB空间转换为YCbCr色彩空间，分离出Y通道进行处理。
• 对扰动后的Y通道应用卷积层，随后通过使用残差块和来自预训练ResNet的跳跃连接的上采样网络进行处理。
• 利用ResNet的特征图作为上采样过程中的引导，以无瓶颈方式重建干净的Y通道。
• 将优化后的Y通道与原始未修改的Cb和Cr通道重新组合，以在RGB空间中重建最终图像。
• 使用对抗性样本在PyTorch中端到端训练整个ResUpNet模型以实现防御。
• 通过仅将扰动限制在Y通道上，使用小步长α和最大ε边界进行迭代更新，优化攻击过程。

实验结果

研究问题

• RQ1 对抗性扰动在YCbCr色彩空间中主要集中在哪个通道？
• RQ2 仅针对Y通道的防御方法是否能优于修改所有RGB通道的防御方法？
• RQ3 将对抗性扰动优化聚焦于Y通道是否能减少成功攻击所需的扰动幅度？
• RQ4 使用ResNet特征的上采样架构实现的模型无关防御，是否能在保持极低干净图像准确率损失的前提下实现最先进鲁棒性？

主要发现

• 与RGB空间中各通道分布均衡不同，对抗性扰动在YCbCr空间的Y通道中显著更集中。
• 在VGG-16、ResNet50和DenseNet121上，ResUpNet在PGD、FGSM和DDN攻击下均实现了干净图像准确率与鲁棒性之间的最佳平衡。
• 在相同扰动幅度下，仅在Y通道上优化的攻击（FGSM-Y和PGD-Y）的欺骗率高于标准FGSM和PGD攻击。
• 当ε = 0.005时，FGSM-Y和PGD-Y在VGG-16上的成功率分别达到98.7%和98.5%，而标准攻击分别为93.7%和89.0%。
• ResUpNet在所有模型和数据集上均保持了高干净图像准确率（Top-1和Top-5），在多数设置下优于BaRT和Pixel Deflection防御方法。
• 该防御方法为模型无关，无需对目标分类器进行架构修改，具有广泛的适用性。