[论文解读] Practical Fast Gradient Sign Attack against Mammographic Image Classifier

Ibrahim Yilmaz|arXiv (Cornell University)|Jan 27, 2020

Adversarial Robustness in Machine Learning参考文献 27被引用 8

一句话总结

本文首次在基于深度卷积神经网络（CNN）的乳腺X线影像分类器上实现了快速梯度符号法（FGSM）对抗攻击的实际应用。通过在良性乳腺X线影像上施加微小且难以察觉的扰动，该攻击成功使分类器将恶性病例误判为良性，结构相似性指数（SSIM）分析表明，即使在高扰动水平下，图像的视觉失真也极小。

ABSTRACT

Artificial intelligence (AI) has been a topic of major research for many years. Especially, with the emergence of deep neural network (DNN), these studies have been tremendously successful. Today machines are capable of making faster, more accurate decision than human. Thanks to the great development of machine learning (ML) techniques, ML have been used many different fields such as education, medicine, malware detection, autonomous car etc. In spite of having this degree of interest and much successful research, ML models are still vulnerable to adversarial attacks. Attackers can manipulate clean data in order to fool the ML classifiers to achieve their desire target. For instance; a benign sample can be modified as a malicious sample or a malicious one can be altered as benign while this modification can not be recognized by human observer. This can lead to many financial losses, or serious injuries, even deaths. The motivation behind this paper is that we emphasize this issue and want to raise awareness. Therefore, the security gap of mammographic image classifier against adversarial attack is demonstrated. We use mamographic images to train our model then evaluate our model performance in terms of accuracy. Later on, we poison original dataset and generate adversarial samples that missclassified by the model. We then using structural similarity index (SSIM) analyze similarity between clean images and adversarial images. Finally, we show how successful we are to misuse by using different poisoning factors.

研究动机与目标

• 展示基于深度学习的乳腺X线影像分类器对对抗攻击的脆弱性。
• 评估快速梯度符号法（FGSM）在真实乳腺X线影像上生成对抗样本的可行性和有效性。
• 利用结构相似性指数（SSIM）分析原始图像与对抗图像之间的感知相似性。
• 研究不同扰动系数（epsilon值）对模型鲁棒性与图像保真度的影响。
• 提高放射科医生和临床医生对在缺乏鲁棒性验证的情况下部署AI模型风险的认识。

提出的方法

• 在良性与恶性乳腺X线影像数据集上训练了一个基于CNN的乳腺X线影像分类器。
• 通过向输入图像添加微小且有针对性的扰动，应用快速梯度符号法（FGSM）生成对抗样本。
• 使用L-infinity范数约束扰动，并在高低范围调整epsilon值以评估鲁棒性。
• 采用结构相似性指数（SSIM）定量测量原始图像与对抗图像之间的感知相似性。
• 在不同epsilon值下评估模型在对抗条件下的准确率，以评估攻击成功率。
• 通过改变扰动系数进行消融研究，分析图像质量退化与模型误分类情况。

实验结果

研究问题

• RQ1 FGSM攻击能否成功生成对抗样本，使良性乳腺X线影像被误分类为恶性或反之？
• RQ2 扰动幅度（epsilon）如何影响乳腺X线影像分类器上对抗攻击的成功率？
• RQ3 对抗图像与原始图像在视觉上的相似程度如何，以SSIM衡量？
• RQ4 是否存在特定的epsilon值，使攻击在保持高感知保真度的同时实现高成功率？
• RQ5 模型性能是否在不同扰动水平下均持续下降，表明存在系统性脆弱性？

主要发现

• FGSM攻击在误分类乳腺X线影像方面取得了高成功率，即使在低epsilon值下，模型准确率也显著下降。
• 使用高epsilon值生成的对抗样本保持了较高的SSIM分数，表明尽管扰动显著，但视觉失真极小。
• 即使在小epsilon值下，攻击仍引发大量误分类，表明微小扰动足以欺骗分类器。
• SSIM分析表明，对抗图像与原始图像在视觉上几乎无法区分，尤其在低epsilon水平下。
• 该攻击在广泛的epsilon值范围内均保持有效，表明模型决策边界存在持续性脆弱性。
• 本研究表明，当前用于乳腺癌分类的深度学习模型极易受到对抗性操纵，且无明显视觉线索可察觉。