엣지 기반 적대적 예제 탐지 모델의 효과에 대한 연구: 다양한 적대적 알고리즘을 대상으로
A Study on the Efficacy of Edge-Based Adversarial Example Detection Model: Across Various Adversarial Algorithms
1
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
딥러닝 모델(Deep Learning Model)은 컴퓨터 비전(Computer Vision) 분야의 이미지(Image) 분류및 객체 탐지와 같은 작업에서 뛰어난 성과를 보이며, 실제 산업 현장에서 다양하게 활용되고 있다. 최근 다양한 알고리즘(Algorithm)의 적대적 예제를 이용하여 딥러닝 모델의 취약성을 지적하며, 강건성 향상 방안을 제시하는 연구들이 활발하게 진행되고 있다. 적대적 예제는 오분류를 유도하기 위해 작은 노이즈(Noise)가 추가된 이미지로서, 딥러닝 모델을 실제 환경에 적용 시 중대한 위협이 될 수 있다. 본 논문에서는 다양한 알고리즘의 적대적 예제를 대상으로 에지 학습 분류 모델의 강건성 및 이를 이용한 적대적 예제 탐지 모델의 성능을 확인하고자 하였다. 강건성실험 결과, FGSM(Fast Gradient Sign Method) 알고리즘에 대하여 기본 분류 모델이 약 17%의 정확도를 보였으나, 에지(Edge) 학습 모델들은 60~70%대의 정확도를 유지하였고, PGD(projected gradient descent)/DeepFool/CW(Carlini-Wagner) 알고리즘에 대해서는 기본 분류 모델이 0~1%의 정확도를 보였으나, 에지 학습 모델들은 80~90%의 정확도를 유지하였다. 적대적 예제 탐지 실험 결과, FGSM/PGD/DeepFool/CW의 모든 알고리즘에 대해서 91~95%의 높은 탐지율을 확인할 수 있었다. 본 연구를 통하여 다양한 적대적 알고리즘에 대한 방어 가능성을 제시함으로써, 컴퓨터 비전을활용하는 여러 산업 분야에서 딥러닝 모델의 안전성 및 신뢰성 제고를 기대한다.
Abstract
Deep learning models show excellent performance in tasks such as image classification and object detection in the field of computer vision, and are used in various ways in actual industrial sites. Recently, research on improving robustness has been actively conducted, along with pointing out that this deep learning model is vulnerable to hostile examples. A hostile example is an image in which small noise is added to induce misclassification, and can pose a significant threat when applying a deep learning model to a real environment. In this paper, we tried to confirm the robustness of the edge-learning classification model and the performance of the adversarial example detection model using it for adversarial examples of various algorithms. As a result of robustness experiments, the basic classification model showed about 17% accuracy for the FGSM algorithm, while the edge-learning models maintained accuracy in the 60-70% range, and the basic classification model showed accuracy in the 0-1% range for the PGD/DeepFool/CW algorithm, while the edge-learning models maintained accuracy in 80-90%. As a result of the adversarial example detection experiment, a high detection rate of 91-95% was confirmed for all algorithms of FGSM/PGD/DeepFool/CW. By presenting the possibility of defending against various hostile algorithms through this study, it is expected to improve the safety and reliability of deep learning models in various industries using computer vision.
참고문헌 (28)
- A. Madry, "Towards deep learning models resistant to adversarial attacks", International Conference on Learning Representations (2018)
- S. Moosavi-Dezfooli, "Deepfool: A simple and accurate method to fool deep neural networks", Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp.2574~2582 (2016)
- N. Carlini, "Towards evaluating the robustness of neural networks", 2017 IEEE Symposium on Security and Privacy (Sp), pp.39~57 (2017)
- P. Chen, "Zoo : Zeroth order optimization based black-box attacks to deep neural networks without training substitute models", Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, pp.15~26 (2017)
- A. Athalye, "Obfuscated gradients give a false sense of security : Circumventing defenses to adversarial examples", International Conference on Machine Learning, pp.274~283 (2018)
- K. Eykholt, "Robust physical-world attacks on deep learning visual classification", Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp.1625~1634 (2018)
- A. Liu, "X-adv : Physical adversarial object attacks against x-ray prohibited item detection", 32nd USENIX Security Symposium (USENIX Security 23), pp.3781~3798 (2023)
- X. Ma, "Understanding adversarial attacks on deep learning based medical image analysis systems", Pattern Recognition, 110, pp.107332~ (2021)[DOI]
- N. Akhtar, "Threat of adversarial attacks on deep learning in computer vision : A survey", IEEE Access, 6, pp.14410~14430 (2018)[DOI]
- D. Tsipras, "Robustness may be at odds with accuracy", International Conference on Learning Representations (2019)
- A. Borji, "Shape defense", I (Still) can'T Believe it's Not Better! Workshop at NeurIPS 2021, pp.15~20 (2022)
- W. Xu, "Feature squeezing : Detecting adversarial examples in deep neural networks", NDSS Symposium (2018)
- J. Shim, "Detecting Adversarial Examples Using Edge-based Classification", Journal of The Korea Society of Computer and Information, 28(10), pp.67~76 (2023)[DOI]
- A. N. Bhagoji, "Enhancing robustness of machine learning systems via data transformations", 2018 52nd Annual Conference on Information Sciences and Systems (CISS), pp.1~5 (2018)
- N. Chattopadhyay, "Robustness against adversarial attacks using dimensionality", International Conference on Security, Privacy, and Applied Cryptography Engineering, pp.226~241 (2021)
- C. Xie, "Feature denoising for improving adversarial robustness", Proceedings of the IEEE, 2019, 501~509
- C. Ferrari, "(Compress and Restore)N : A Robust Defense Against Adversarial Attacks on Image Classification", ACM Transactions on Multimedia Computing, Communications and Applications, 19(1s), pp.1~16 (2023)[DOI]
- D. Meng, "Magnet : A two-pronged defense against adversarial examples", Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp.135~147 (2017)
- J. H. Metzen, "On detecting adversarial perturbations", International Conference on Learning Representations (2017)
- L. G. Roberts, "Machine Perception of Three-Dimensional Solids", PhD, pp.1963
- I. Sobel, "Pattern Classification and Scene Analysis", pp.271~272 (1973)
- J. Canny, "Readings in Computer Vision", pp.184~203 (1987)
- "Optimal operators in digital image processing" (2000)[URL]
- "ANIMALS(30 Animal Species for Easy train)"[URL]