이미지 분류를 위한 오토인코더 기반 One-Pixel 적대적 공격 방어 기법
Autoencoder-Based Defense Technique against One-Pixel Adversarial Attacks in Image Classification
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
인공지능 기술의 급격한 발전으로 다양한 분야에서 적극적으로 활용되고 있으나, 이와 함께 인공지능 기반 시스템에 대한 공격 위협이 증가하고 있다. 특히, 딥러닝에서 사용되는 인공신경망은 입력 데이터를 고의로 변형시켜 모델의 오류를 유발하는 적대적 공격에 취약하다. 본 연구에서는 이미지에서 단 하나의 픽셀 정보만을 변형시킴으로써 시각적으로 인지하기 어려운 One-Pixel 공격으로부터 이미지 분류 모델을 보호하기 위한 방법을 제안한다. 제안된 방어 기법은 오토인코더 모델을 이용하여 분류 모델에 입력 이미지가 전달되기 전에 잠재적 공격 이미지에서 위협 요소를 제거한다. CIFAR-10 데이터셋을 이용한 실험에서 본 논문에서 제안하는 오토인코더 기반의 One-Pixel 공격 방어 기법을 적용한 사전 학습 이미지 분류 모델들은 기존 모델의 수정 없이도 One-Pixel 공격에 대한 강건성이 평균적으로 81.2% 향상되는 결과를 보였다.
Abstract
The rapid advancement of artificial intelligence (AI) technology has led to its proactive utilization across various fields. However, this widespread adoption of AI-based systems has raised concerns about the increasing threat of attacks on these systems. In particular, deep neural networks, commonly used in deep learning, have been found vulnerable to adversarial attacks that intentionally manipulate input data to induce model errors. In this study, we propose a method to protect image classification models from visually imperceptible One-Pixel attacks, where only a single pixel is altered in an image. The proposed defense technique utilizes an autoencoder model to remove potential threat elements from input images before forwarding them to the classification model. Experimental results, using the CIFAR-10 dataset, demonstrate that the autoencoder-based defense approach significantly improves the robustness of pretrained image classification models against One-Pixel attacks, with an average defense rate enhancement of 81.2%, all without the need for modifications to the existing models.
참고문헌 (30)
- A. Krizhevsky, "Imagenet classification with deep convolutional neural networks", Communications of the ACM, 25, pp.1097~1105 (2012)
- K. He, "Delving deep into rectifiers : surpassing human-level performance on imagenet classification", Proceedings of the IEEE international conference on computer vision 2015, pp, 1026(1034), pp.2015~
- Huang, "Adversarial attacks on neural network polices", arXiv preprint arXiv:1702.02284, Feb. 2017, ~ (2017)
- K. Ren, "Adversarial attacks and defenses in deep learning", Engineering, 6(3), pp.346~360 (2020)
- Madry, "Towards deep learning models resistant to adversarial attacks", arXiv preprint arXiv:1706.06083, Sep. 2019, ~ (2019)
- Qiu, "Review of artificial intelligence adversarial attack and defense technologies", Applied Sciences, 9(5) (2017)
- Akhtar, "Threat of adversarial attacks on deep learning in computer vision : a survey", IEEE Access, 6, pp.14410~14430 (2018)
- J. Ito, "Adversarial attacks on medical machine learning", Science, 363(6433), pp.1287~1289 (2019)
- H. Liang, "Adversarial attacks and defense : a survey", Electronics, 11(8) (2022)
- J. Su, "One pixel attack for fooling deep neural networks", IEEE Transactions on Evolutionary Computation, 23(5), pp.828~841 (2019)
- Shah, Syed Afaq Ali, "Efficient detection of pixel-level adversarial attacks", 2020 IEEE International Conference on Image Processing, pp.718~722 (2020)
- Goodfellow, Ian J., "Explaining and harnessing adversarial examples" (2014)
- Y. Dong, "Boosting adversarial attacks with momentum", Proceedings of the IEEE conference on computer vision and pattern recognition, pp.9185~9193 (2018)
- C. Szegedy, "Intriguing properties of neural networks" (2013)
- Alexey Kurakin, "Adversarial examples in the physical world", Artificial intelligence safety and security, pp.99~112 (2018)
- N. Papernot, "The limitations of deep learning in adversarial settings", 2016 IEEE European symposium on security and privacy, pp.372~387 (2016)
- N. Carlini, "Towards evaluating the robustness of neural networks", 2017 IEEE symposium on security and privacy, pp.39~57 (2017)
- S. Moosavi-Dezfooli, "DeepFool : a simple and accurate method to fool deep neural networks", Proceedings of the IEEE conference on computer vision and pattern recognition, pp.2574~2582 (2016)
- S. M. Moosavi-Dezfooli, "Universal adversarial perturbations", Proceedings of the IEEE conference on computer vision and pattern recognition, pp.1765~1773 (2017)
- S. Das, "Differential evolution : A survey of the state-of-the-art", IEEE transactions on evolutionary computation, 15(1), pp.4~31 (2011)
- F. Tramer, "The space of transferable adversarial examples" (2017)
- S. Baluja, "Adversarial transformation networks : learning to generate adversarial examples" (2017)
- MA. Husnoo, "Do not get fooled: defense against the one-pixel attack to protect IoT-enabled deep learning systems", Ad Hoc Networks, 122 (2021)
- Nguyen-Son, "OPA2D : One-pixel attack, detection, and defense in deep nueral networks", 2021 International Joint Conference on Neural Networks(IJCNN), pp.1~10 (2021)
- Chen, D., "Patch selection denoiser : an effective approach defending against one-pixel attacks", 26th International Conference on Neural Information Processing(ICONIP 2019), pp.286~296 (2019)
- Y. Lecun, "Gradient-based learning applied to document recognition", Proceedings of the IEEE, 89(11), pp.2278~2324 (1998)
- Lin, Min, "Network in network" (2013)
- K. He, "Deep residual learning for image recognition", Proceedings of the IEEE conference on computer vision and pattern recognition, pp.770~778 (2016)
- Gao Huang, "Densely connected convolutional networks", Proceedings of the IEEE conference on computer vision and pattern recognition, pp.4700~4708 (2017)
- Zagoruyko, Sergey, "Wide residual networks" (2016)