[论文解读] Detecting Adversarial Examples in Convolutional Neural Networks

Stefanos Pertigkiozoglou, Petros Maragos|arXiv (Cornell University)|Dec 8, 2018

Adversarial Robustness in Machine Learning参考文献 16被引用 11

一句话总结

该论文提出了三种用于检测卷积神经网络中对抗样本的新方法：(1) 基于正则化的最终层对抗性微调，(2) 使用隐藏层激活值的直方图特征进行SVM分类，以及(3) 通过残差图像分析检测被分类器忽略的输入特征。这些方法的组合在MNIST数据集上实现了最先进性能，使用BIM攻击时达到98.9%的精确率和92.7%的召回率，DeepFool攻击下的AUC为99.3%。

ABSTRACT

The great success of convolutional neural networks has caused a massive spread of the use of such models in a large variety of Computer Vision applications. However, these models are vulnerable to certain inputs, the adversarial examples, which although are not easily perceived by humans, they can lead a neural network to produce faulty results. This paper focuses on the detection of adversarial examples, which are created for convolutional neural networks that perform image classification. We propose three methods for detecting possible adversarial examples and after we analyze and compare their performance, we combine their best aspects to develop an even more robust approach. The first proposed method is based on the regularization of the feature vector that the neural network produces as output. The second method detects adversarial examples by using histograms, which are created from the outputs of the hidden layers of the neural network. These histograms create a feature vector which is used as the input of an SVM classifier, which classifies the original input either as an adversarial or as a real input. Finally, for the third method we introduce the concept of the residual image, which contains information about the parts of the input pattern that are ignored by the neural network. This method aims at the detection of possible adversarial examples, by using the residual image and reinforcing the parts of the input pattern that are ignored by the neural network. Each one of these methods has some novelties and by combining them we can further improve the detection results. For the proposed methods and their combination, we present the results of detecting adversarial examples on the MNIST dataset. The combination of the proposed methods offers some improvements over similar state of the art approaches.

研究动机与目标

• 解决训练好的CNN对人类难以察觉但导致误分类的对抗样本的脆弱性。
• 开发无需重新训练整个网络的检测方法，专注于事后检测。
• 通过结合多种互补的检测机制，提高检测的鲁棒性。
• 在MNIST数据集上使用BIM和DeepFool等标准对抗攻击评估所提出的方法。
• 证明结合多种检测方法可使精确率和召回率均优于单一方法。

提出的方法

• 第一种方法在不重新训练整个网络的前提下，对网络输出的特征向量进行正则化，实现最终层的对抗性微调，从而提升对对抗扰动的鲁棒性。
• 第二种方法从隐藏层输出绝对值的直方图构建特征向量，并使用SVM对真实输入与对抗输入进行分类。
• 第三种方法提出残差图像，即输入与经网络处理后输出之间的差值，以识别被分类器忽略的特征。
• 通过以增强正确分类的方式扰动输入，利用残差图像检测那些导致误分类的对抗样本。
• 三种方法通过逻辑运算（与、或、多数投票）组合，以平衡精确率与召回率，其中混合策略采用直方图检测结合至少一种其他方法。
• 对残差图像方法应用基于阈值的决策规则，并通过在不同攻击类型下调整该阈值，生成ROC曲线和精确率-召回率曲线。

实验结果

研究问题

• RQ1 对最终层特征向量进行正则化是否能在不重新训练整个网络的情况下提升对抗样本检测性能？
• RQ2 基于隐藏层激活值的直方图表示是否能通过SVM分类器有效区分对抗样本与真实输入？
• RQ3 捕捉网络忽略特征的残差图像是否可作为检测对抗样本的可靠信号？
• RQ4 结合多种检测方法如何在精确率与召回率方面提升整体检测性能？
• RQ5 混合检测策略——将直方图检测与至少一种其他方法结合——是否能在不牺牲召回率的前提下实现高精确率？

主要发现

• 使用逻辑与（T₁）组合全部三种方法在BIM攻击下实现99.5%的精确率和60.1%的召回率，表明检测具有高置信度但覆盖范围有限。
• 使用逻辑或（T₂）组合在BIM攻击下实现83.6%的精确率和99.4%的召回率，显示高灵敏度但存在大量误报。
• 多数投票组合（T₃）在BIM攻击下实现95.5%的精确率和91.8%的召回率，在DeepFool攻击下实现96.2%的精确率和96.25%的召回率，有效平衡了两项指标。
• 混合策略 T₄ = H ∧ (R ∨ I) 在BIM攻击下实现98.8%的精确率和89.6%的召回率，在DeepFool攻击下实现98.9%的精确率和92.7%的召回率，优于单一方法及多数最先进方法。
• ROC AUC在BIM攻击下达到98.7%，在DeepFool攻击下达到99.3%，表明在不同阈值下整体检测性能强劲。
• 精确率-召回率曲线与ROC曲线表明，通过调整残差图像方法的阈值，检测性能具有鲁棒性且可调谐。