Adversarial Sample Generation and Training using Neural Network
1
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
The neural network classifier is known to be susceptible to adversarial attacks, where projected gradient descent-like noise is added to the data, causing misclassification. These attacks can be prevented by min-max training, where the neural network is trained to handle adversarial attack data. Although min-max training is very effective, it requires a large amount of training time because each adversarial attack data generation requires several iterations of gradient back-propagation to produce. In this paper, convolutional layers are used to replace the projected gradient descent-based production of adversarial attack data in an attempt to reduce the training time. By replacing the adversarial noise generation with the output of convolutional layers, the training time becomes comparable to that of a simple neural network classifier with a few additional layers. The proposed approach significantly reduced the effects of smaller-scale adversarial attacks, and under certain circumstances, was shown to be as effective as min-max training. However, for severe attacks, the proposed approach was not able to compete with modern min-max-based remedies.
Abstract
The neural network classifier is known to be susceptible to adversarial attacks, where projected gradient descent-like noise is added to the data, causing misclassification. These attacks can be prevented by min-max training, where the neural network is trained to handle adversarial attack data. Although min-max training is very effective, it requires a large amount of training time because each adversarial attack data generation requires several iterations of gradient back-propagation to produce. In this paper, convolutional layers are used to replace the projected gradient descent-based production of adversarial attack data in an attempt to reduce the training time. By replacing the adversarial noise generation with the output of convolutional layers, the training time becomes comparable to that of a simple neural network classifier with a few additional layers. The proposed approach significantly reduced the effects of smaller-scale adversarial attacks, and under certain circumstances, was shown to be as effective as min-max training. However, for severe attacks, the proposed approach was not able to compete with modern min-max-based remedies.
참고문헌 (12)
- Qian, Zhuang, "A survey of robust adversarial training in pattern recognition : Fundamental, theory, and methodologies", Pattern Recognition, 131 (2022)
- Mądry, Aleksander, "Towards deep learning models resistant to adversarial attacks", stat 1050, ~ (2017)
- Su, Jiawei, "One pixel attack for fooling deep neural networks", IEEE Transactions on Evolutionary Computation, 23(5) (2019)
- Wang, "Better diffusion models further improve adversarial training", International Conference on Machine Learning, pp.36246~36263 (2023)
- Schwinn, "Exploring misclassifications of robust neural networks to enhance adversarial attacks", Applied Intelligence, 53 (2023)
- You, Zhonghui, "Adversarial noise layer : Regularize neural network by adding noise", 2019 IEEE International Conference on Image Processing (ICIP), pp.909~913 (2019)
- Sankaranarayana, nSwami, "Regularizing deep networks using efficient layerwise adversarial training", Proceedings of the AAAI Conference on Artificial Intelligence, 32(1) (2018)