Attention 기법에 기반한 적대적 공격의 강건성 향상 연구
Improving Adversarial Robustness via Attention
1
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
적대적 학습은 적대적 샘플에 대한 딥러닝 모델의 강건성을 향상시킨다. 하지만 기존의 적대적 학습 기법은 입력 단계의 작은 섭동마저도 은닉층의 특징에 큰 변화를 일으킨다는 점을 간과하여 adversarial loss function에만 집중한다. 그 결과로 일반 샘플 또는 다른 공격 기법과 같이 학습되지 않은 다양한 상황에 대한 정확도가 감소한다. 이 문제를 해결하기 위해서는 특징 표현 능력을 향상시키는 모델 아키텍처에 대한 분석이 필요하다. 본 논문에서는 입력 이미지의 attention map을 생성하는 attention module을 일반 모델에 적용하고 PGD 적대적 학습을 수행한다. CIFAR-10 dataset에서의 제안된 기법은 네트워크 구조에 상관없이 적대적 학습을 수행한 일반 모델보다 적대적 샘플에 대해 더 높은 정확도를 보였다. 특히 우리의 접근법은 PGD, FGSM, BIM과 같은 다양한 공격과 더 강력한 adversary에 대해서도 더 강건했다. 나아가 우리는 attention map을 시각화함으로써 attention module이 적대적 샘플에 대해서도 정확한 클래스의 특징을 추출한다는 것을 확인했다.
Abstract
Adversarial training improves the robustness of deep neural networks for adversarial examples. However, the previous adversarial training method focuses only on the adversarial loss function, ignoring that even a small perturbation of the input layer causes a significant change in the hidden layer features. Consequently, the accuracy of a defended model is reduced for various untrained situations such as clean samples or other attack techniques. Therefore, an architectural perspective is necessary to improve feature representation power to solve this problem. In this paper, we apply an attention module that generates an attention map of an input image to a general model and performs PGD adversarial training upon the augmented model. In our experiments on the CIFAR-10 dataset, the attention augmented model showed higher accuracy than the general model regardless of the network structure. In particular, the robust accuracy of our approach was consistently higher for various attacks such as PGD, FGSM, and BIM and more powerful adversaries. By visualizing the attention map, we further confirmed that the attention module extracts features of the correct class even for adversarial examples.
참고문헌 (16)
- Goodfellow, Ian, "Explaining and harnessing adversarial examples", Proceedings of the International Conference on Learning Representations (2015)
- Madry, Aleksander, "Towards deep learning models resistant to adversarial attacks", Proceedings of the International Conference on Learning Representations (2018)
- Kurakin, Alexey, "Adversarial machine learning at scale", Proceedings of the International Conference on Learning Representations (2017)
- Parikh, Ankur P., "A decomposable attention model for natural language inference", Proceedings of the Empirical Methods in Natural Language Processing (2016)
- Vaswani, Ashish, "Attention is all you need", Proceedings of the Neural Information Processing System (2017)
- Ramachandran, Prajit, "Stand-alone self-attention in vision models", Proceedings of the Neural Information Processing System (2019)
- Woo, Sanghyun, "Cbam : Convolutional block attention module", Proceedings of the European conference on computer vision (2018)
- Selvaraju, Ramprasaath R., "Grad-cam : Visual explanations from deep networks via gradient-based localization", Proceedings of the IEEE international conference on computer vision (2017)
- Liao, Fangzhou, "Defense against adversarial attacks using high-level representation guided denoiser", Proceedings of the IEEE, 2018, ~
- Cho, Seungju, "Dapas : Denoising autoencoder to prevent adversarial attack in semantic segmentation", Proceedings of the International Joint Conference on Neural Networks (2020)
- Li, Xin, "Adversarial examples detection in deep networks with convolutional filter statistics", Proceedings of the IEEE international conference on computer vision (2017)
- Ma, Xingjun, "Characterizing adversarial subspaces using local intrinsic dimensionality" (2018)
- Samangouei, Pouya, "Defense-gan : Protecting classifiers against adversarial attacks using generative models", Proceedings of the International Conference on Learning Representations (2018)
- Xie, Cihang, "Feature denoising for improving adversarial robustness", Proceedings of the IEEE, 2019, ~
- Meng, Dongyu, "MagNet : a two-pronged defense against adversarial examples", Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (2017)
- Carlini, Nicholas, "Magnet and ‘efficient defensesagainst adversarial attacks’ are not robust to adversarial examples" (2017)