[论文解读] Transferability of Adversarial Examples to Attack Cloud-based Image Classifier Service

Dou Goodman|arXiv (Cornell University)|Jan 8, 2020

Adversarial Robustness in Machine Learning参考文献 27被引用 11

一句话总结

本文提出 FFL-PGD，一种新颖的黑盒攻击方法，通过仅使用每张图像 1–2 个查询，利用快速特征图损失优化的替代模型，生成针对云上图像分类器的对抗性样本。该方法在 Amazon、Google、Microsoft 和 Clarifai API 上均实现了超过 90% 的成功率，展示了在真实云环境中的高度可迁移性和实际可行性。

ABSTRACT

In recent years, Deep Learning(DL) techniques have been extensively deployed for computer vision tasks, particularly visual classification problems, where new algorithms reported to achieve or even surpass the human performance. While many recent works demonstrated that DL models are vulnerable to adversarial examples. Fortunately, generating adversarial examples usually requires white-box access to the victim model, and real-world cloud-based image classification services are more complex than white-box classifier,the architecture and parameters of DL models on cloud platforms cannot be obtained by the attacker. The attacker can only access the APIs opened by cloud platforms. Thus, keeping models in the cloud can usually give a (false) sense of security. In this paper, we mainly focus on studying the security of real-world cloud-based image classification services. Specifically, (1) We propose a novel attack method, Fast Featuremap Loss PGD (FFL-PGD) attack based on Substitution model, which achieves a high bypass rate with a very limited number of queries. Instead of millions of queries in previous studies, our method finds the adversarial examples using only two queries per image; and (2) we make the first attempt to conduct an extensive empirical study of black-box attacks against real-world cloud-based classification services. Through evaluations on four popular cloud platforms including Amazon, Google, Microsoft, Clarifai, we demonstrate that FFL-PGD attack has a success rate over 90\% among different classification services. (3) We discuss the possible defenses to address these security challenges in cloud-based classification services. Our defense technology is mainly divided into model training stage and image preprocessing stage.

研究动机与目标

• 研究现实世界中基于云的图像分类服务对黑盒对抗性攻击的脆弱性。
• 减少在黑盒设置下生成有效对抗性样本所需的查询次数。
• 评估对抗性样本在未知模型架构的多样化云平台之间的可迁移性。
• 提出并验证在模型训练和图像预处理阶段的实用防御策略。

提出的方法

• 提出 FFL-PGD，一种基于替代模型的查询高效黑盒攻击方法，该模型模拟目标云分类器的行为。
• 引入快速特征图损失（FFL）目标函数，通过匹配替代模型与目标模型之间的特征图来指导对抗性扰动。
• 使用带有 FFL 目标函数的投影梯度下降（PGD）优化方法，以最小化查询成本生成对抗性样本。
• 采用在公开数据集上训练的可迁移代理模型，以近似目标云模型的决策边界。
• 通过代理模型的高保真度近似，将每张图像的查询次数限制在仅 1–2 次。
• 在四大主要云平台（Amazon Rekognition、Google Cloud Vision、Microsoft Azure 和 Clarifai）上验证了该攻击。

实验结果

研究问题

• RQ1 能否在极少查询访问的前提下，有效生成针对基于云的图像分类器的对抗性样本？
• RQ2 所提出的 FFL-PGD 攻击在多样化云平台上的成功率和查询效率表现如何？
• RQ3 当目标模型的架构和参数未知时，对抗性样本在不同基于云的视觉 API 之间的可迁移性达到何种程度？
• RQ4 哪些防御机制能有效缓解基于云的人工智能服务中的黑盒对抗性攻击？

主要发现

• FFL-PGD 攻击在所有四个评估的云平台（Amazon、Google、Microsoft 和 Clarifai）上均实现了超过 90% 的成功率。
• 该方法每张图像仅需 1–2 个查询，与以往需要数万甚至数十万个查询的方法相比，实现了显著减少。
• 即使目标模型的架构和参数未知，该攻击仍表现出强大的对抗性样本可迁移性。
• 快速特征图损失（FFL）组件显著提升了代理模型的保真度，从而在极少查询下实现了高质量的对抗性样本生成。
• 实证评估证实，通过 FFL-PGD 构造的对抗性样本可成功绕过所有测试的基于云的图像分类服务的检测。
• 本研究发现，JPEG 压缩和随机化等标准防御措施对 FFL-PGD 攻击的防护效果有限。