[论文解读] Defending against Adversarial Attack towards Deep Neural Networks via Collaborative Multi-task Training

Derek Wang, Chaoran Li+3 more|arXiv (Cornell University)|Mar 14, 2018

Adversarial Robustness in Machine Learning参考文献 45被引用 6

一句话总结

本文提出了一种用于深度神经网络的协作式多任务训练防御方法，通过结合对抗训练与标签对编码技术，以抵御黑盒和灰盒对抗攻击。在CIFAR-10数据集上，该方法在黑盒对抗样本上实现了96.3%的准确率，并检测到98.7%的高置信度对抗输入，同时仅导致良性样本准确率下降2.1%。

ABSTRACT

Deep neural networks (DNNs) are known to be vulnerable to adversarial examples which contain human-imperceptible perturbations. A series of defending methods, either proactive defence or reactive defence, have been proposed in the recent years. However, most of the methods can only handle specific attacks. For example, proactive defending methods are invalid against grey-box or white-box attacks, while reactive defending methods are challenged by low-distortion adversarial examples or transferring adversarial examples. This becomes a critical problem since a defender usually does not have the type of the attack as a priori knowledge. Moreover, existing two-pronged defences (e.g., MagNet), which take advantages of both proactive and reactive methods, have been reported as broken under transferring attacks. To address this problem, this paper proposed a novel defensive framework based on collaborative multi-task training, aiming at providing defence for different types of attacks. The proposed defence first encodes training labels into label pairs and counters black-box attacks leveraging adversarial training supervised by the encoded label pairs. The defence further constructs a detector to identify and reject high-confidence adversarial examples that bypass the black-box defence. In addition, the proposed collaborative architecture can prevent adversaries from finding valid adversarial examples when the defence strategy is exposed. In the experiments, we evaluated our defence against four state-of-the-art attacks on $MNIST$ and $CIFAR10$ datasets. The results showed that our defending method achieved up to $96.3\%$ classification accuracy on black-box adversarial examples, and detected up to $98.7\%$ of the high confidence adversarial examples. It only decreased the model accuracy on benign example classification by $2.1\%$ for the $CIFAR10$ dataset.

研究动机与目标

• 解决现有防御方法在多种攻击类型下缺乏泛化能力的问题，特别是在攻击类型事先未知的情况下。
• 克服现有主动与被动防御方法在迁移攻击或高置信度对抗样本下失效的局限性。
• 开发一种即使攻击者部分了解模型或防御策略（灰盒环境）时仍保持有效性的防御机制。
• 在显著提升对对抗扰动的鲁棒性的同时，维持对干净（良性）样本的高准确率。
• 构建一种即使防御机制暴露给攻击者，也能抵御模型反演与对抗样本生成的防御方法。

提出的方法

• 将类别标签编码为标签对，以在对抗训练过程中增强鲁棒性，提升对黑盒攻击的抵抗能力。
• 采用协作式多任务训练，联合优化主分类头与对抗样本检测器。
• 训练检测器以识别并拒绝绕过主防御的高置信度对抗样本。
• 利用标签对编码对模型决策边界进行正则化，降低对微小输入扰动的敏感性。
• 结合基于梯度的对抗训练与标签对编码，提升在可迁移攻击下的泛化能力。
• 通过架构设计隐藏梯度信息，使防御在灰盒环境下仍能抵御基于梯度的攻击。

实验结果

研究问题

• RQ1 能否设计一种防御机制，在事先未知攻击类型的情况下，有效抵御黑盒与灰盒对抗攻击？
• RQ2 标签对编码在提升模型对黑盒环境下低置信度对抗样本鲁棒性方面效果如何？
• RQ3 多任务检测器在识别绕过主分类器的高置信度对抗样本方面，其检测能力能达到何种程度？
• RQ4 若将防御策略暴露给攻击者，是否会影响其有效性？该防御在该条件下是否仍保持鲁棒性？
• RQ5 在MNIST与CIFAR-10等标准基准数据集上，该防御在良性准确率与可扩展性方面表现如何？

主要发现

• 所提出的防御在黑盒对抗样本上实现了96.3%的分类准确率，显著优于许多现有防御方法。
• 对抗样本检测器成功识别出98.7%的高置信度对抗样本，展现出强大的检测能力。
• 模型在CIFAR-10数据集上对良性样本的准确率仅下降2.1%，表明其具有极强的实际可行性。
• 该防御对迁移攻击保持有效，且由于梯度遮蔽与标签对正则化，对灰盒攻击也具有鲁棒性。
• 与此前已被替代攻击攻破的双轨防御方法（如MagNet）相比，本方法表现更优。
• 该防御的性能对Classmap的质量敏感，而Classmap的质量取决于训练中使用的非目标对抗样本的鲁棒性与多样性。