[论文解读] Evaluation of Momentum Diverse Input Iterative Fast Gradient Sign Method (M-DI2-FGSM) Based Attack Method on MCS 2018 Adversarial Attacks on Black Box Face Recognition System

Md Ashraful Alam Milton|arXiv (Cornell University)|Jun 23, 2018

Adversarial Robustness in Machine Learning被引用 14

一句话总结

本文评估了动量多样化输入迭代快速梯度符号法（M-DI2-FGSM）在面向人脸识别系统的定向黑盒对抗攻击中的应用，该方法参与了MCS 2018挑战赛。该方法在验证集上取得了1.404的得分，优于基线的1.407分，在132支队伍中位列第14名，证明了其在有限模型访问条件下生成可迁移对抗样本的有效性。

ABSTRACT

The convolutional neural network is the crucial tool for the recent success of deep learning based methods on various computer vision tasks like classification, segmentation, and detection. Convolutional neural networks achieved state-of-the-art performance in these tasks and every day pushing the limit of computer vision and AI. However, adversarial attack on computer vision systems is threatening their application in the real life and in safety-critical applications. Necessarily, Finding adversarial examples are important to detect susceptible models to attack and take safeguard measures to overcome the adversarial attacks. In this regard, MCS 2018 Adversarial Attacks on Black Box Face Recognition challenge aims to facilitate the research of finding new adversarial attack techniques and their effectiveness in generating adversarial examples. In this challenge, the attack"s nature is targeted-attack on the black-box neural network where we have no knowledge about black-block"s inner structure. The attacker must modify a set of five images of a single person so that the neural network miss-classify them as target image which is a set of five images of another person. In this competition, we applied Momentum Diverse Input Iterative Fast Gradient Sign Method (M-DI2-FGSM) to make an adversarial attack on black-box face recognition system. We tested our method on MCS 2018 Adversarial Attacks on Black Box Face Recognition challenge and found competitive result. Our solution got validation score 1.404 which better than baseline score 1.407 and stood 14 place among 132 teams in the leader-board. Further improvement can be achieved by finding improved feature extraction from source image, carefully chosen hyper-parameters, finding improved substitute model of the black-box and better optimization method.

研究动机与目标

• 开发一种无需访问内部模型结构的、针对黑盒人脸识别系统的有效定向对抗攻击方法。
• 评估M-DI2-FGSM方法在生成人脸识别可迁移对抗样本方面的性能。
• 在MCS 2018黑盒人脸识别对抗攻击挑战赛中，超越基线攻击性能。
• 识别出影响攻击成功率的关键因素，如特征提取、超参数设置、替代模型选择以及优化策略，以进一步提升攻击效果。

提出的方法

• M-DI2-FGSM方法结合了基于动量的梯度更新与多样化输入扰动，以提升攻击的可迁移性。
• 通过使用动量的迭代FGSM更新，稳定并加速优化过程。
• 在每次梯度计算前，通过对输入图像应用随机变换（如缩放、裁剪）生成多样化输入扰动。
• 该攻击为定向攻击，将五张目标人物的图像修改为使黑盒人脸识别系统将其误分类为目标人物的图像。
• 该方法在黑盒约束下运行，仅依赖模型预测结果，不访问梯度或模型架构信息。
• 对步长、迭代次数和动量系数等超参数进行了调优，以最大化攻击成功率。

实验结果

研究问题

• RQ1 M-DI2-FGSM在生成黑盒人脸识别系统可迁移对抗样本方面效果如何？
• RQ2 动量策略与多样化输入方法是否能提升定向对抗攻击的可迁移性与成功率？
• RQ3 在严格的黑盒约束下，M-DI2-FGSM与基线方法在MCS 2018挑战赛中的表现如何比较？
• RQ4 特征提取质量与替代模型选择在提升攻击性能方面起到何种作用？
• RQ5 在真实黑盒环境中，哪些超参数配置能实现最优攻击成功率？

主要发现

• M-DI2-FGSM方法在MCS 2018挑战赛中取得了1.404的验证得分，优于基线得分1.407。
• 该方法在排行榜中位列132支队伍中的第14名，表明其在竞争激烈的现实黑盒攻击环境中表现优异。
• 该攻击成功生成了定向对抗样本，导致黑盒人脸识别系统将源图像误分类为目标图像。
• 改进特征提取、超参数调优、替代模型设计以及优化方法被识别为实现进一步性能提升的关键因素。
• 动量与多样化输入的结合显著增强了对抗样本在不同模型架构间的可迁移性与鲁棒性。
• 尽管对目标模型内部结构访问有限，该方法仍表现出强大的泛化能力。