[论文解读] Deep Learning Defenses Against Adversarial Examples for Dynamic Risk Assessment

Xabier Echeberria-Barrio, Amaia Gil-Lerchundi+2 more|arXiv (Cornell University)|Jul 2, 2020

Adversarial Robustness in Machine Learning参考文献 13被引用 6

一句话总结

本文提出两种新型防御方法——基于自编码器的降维与基于图像历史的预测相似性——以应对深度学习模型在动态风险评估中面临的对抗性攻击。实验表明，这些防御方法在保持准确率的同时增强了模型的鲁棒性，其中预测相似性方法对新型对抗性样本的检测率达到99.5%。

ABSTRACT

Deep Neural Networks were first developed decades ago, but it was not until recently that they started being extensively used, due to their computing power requirements. Since then, they are increasingly being applied to many fields and have undergone far-reaching advancements. More importantly, they have been utilized for critical matters, such as making decisions in healthcare procedures or autonomous driving, where risk management is crucial. Any mistakes in the diagnostics or decision-making in these fields could entail grave accidents, and even death. This is preoccupying, because it has been repeatedly reported that it is straightforward to attack this type of models. Thus, these attacks must be studied to be able to assess their risk, and defenses need to be developed to make models more robust. For this work, the most widely known attack was selected (adversarial attack) and several defenses were implemented against it (i.e. adversarial training, dimensionality reduc tion and prediction similarity). The obtained outcomes make the model more robust while keeping a similar accuracy. The idea was developed using a breast cancer dataset and a VGG16 and dense neural network model, but the solutions could be applied to datasets from other areas and different convolutional and dense deep neural network models.

研究动机与目标

• 解决深度学习模型在医疗、自动驾驶等高风险应用中面临对抗性攻击带来的关键风险。
• 评估并比较现有防御方法（特别是对抗性训练）对新型对抗性样本的防御效果。
• 提出并验证两种新型主动防御机制——降维与预测相似性——以提升鲁棒性与风险检测能力。
• 将这些防御机制集成至动态风险评估框架中，实现在安全关键系统中的实时决策支持。

提出的方法

• 在乳腺癌数据集上训练的VGG16与全连接神经网络模型上应用对抗性攻击（FGSM、PGD）。
• 通过使用生成的对抗性样本重新训练模型，实现对抗性训练，以提升分类鲁棒性。
• 通过插入编码器-解码器层实现基于自编码器的降维，以过滤噪声并减少输入扰动。
• 基于历史图像嵌入与相似性度量（SSIM）开发预测相似性防御机制，用于检测对抗性输入。
• 以均方误差（MSE）与信噪比（PSNR）作为基线相似性度量，SSIM作为主要检测指标。
• 在已知（初始）与新生成的对抗性样本上评估防御机制，以检验其鲁棒性与检测能力。

实验结果

研究问题

• RQ1 对抗性训练、降维与预测相似性在防御已知对抗性样本方面的有效性如何？
• RQ2 使用自编码器进行降维是否能使对抗性噪声变得可见，从而降低模型的脆弱性？
• RQ3 预测相似性在不修改基础模型架构的前提下，能在多大程度上检测新型对抗性样本？
• RQ4 这些防御机制在准确率保持与对新型对抗性攻击的鲁棒性方面表现如何？
• RQ5 预测相似性能否作为安全关键AI系统中动态风险评估的可行输入？

主要发现

• 对抗性训练在防御已知对抗性样本方面达到92.0%的成功率，但无法泛化至新型对抗性样本。
• 使用中间自编码器层进行降维将对抗性攻击成功率降低至39.6%（防御率为60.4%），且生成的对抗性样本中噪声变得肉眼可见。
• 预测相似性防御通过SSIM度量图像相似性，成功检测出99.5%的新对抗性样本。
• 基于编码器的防御机制在初始对抗样本上实现64.3%的防御率，优于初始自编码器（70.5%）与对抗性训练（92.0%）在新型攻击检测中的表现。
• 预测相似性提供了一种非侵入性、外部化的攻击检测层，可无缝集成至风险评估工作流中。
• 所提出的防御机制在保持模型准确率的同时显著提升了鲁棒性，其中预测相似性在新型攻击检测中表现最佳。