얼굴 인식 모델에 대한 질의 효율적인 블랙박스 적대적 공격 방법
Query-Efficient Black-Box Adversarial Attack Methods on Face Recognition Model
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
얼굴 인식 모델은 스마트폰의 신원 인식에 활용되는 등 많은 사용자에게 편의를 제공하고 있다. 이에 따라 DNN 모델의 보안성 검토가 중요해지고 있는데 DNN 모델의 잘 알려진 취약점으로 적대적 공격이 존재한다. 적대적 공격은 현재 DNN 모델의 인식 결과만을 이용하여 공격을 수행하는 의사결정 공격기법까지 발전하였다. 그러나 기존 의사결정 기반 공격기법[14]은 적대적 예제 생성 시 많은 질의 수가 필요한 문제점이 있다. 특히, 기울기를 근사하는데 많은 질의 수가 소모되는데 정확한 기울기를 구할 수 없는 문제가 존재한다. 따라서 본 논문에서는 기존 의사결정 공격기법의 기울기를 근사할 때 소모되는 질의 수 낭비를 막기 위해서 직교 공간 샘플링과 차원 축소 샘플링 방법을 제안한다. 실험 결과 섭동의 크기가 L2 distance 기준 약 2.4 적은 적대적 예제를 생성할 수 있었고 공격 성공률의 경우 약 14% 향상할 수 있었다. 실험 결과를 통해 본 논문에서 제안한 적대적 예제 생성방법의 같은 질의 수 대비 공격 성능이 우수함을 입증한다.
Abstract
The face recognition model is used for identity recognition of smartphones, providing convenience to many users. As a result, the security review of the DNN model is becoming important, with adversarial attacks present as a well-known vulnerability of the DNN model. Adversarial attacks have evolved to decision-based attack techniques that use only the recognition results of deep learning models to perform attacks. However, existing decision-based attack technique[14] have a problem that requires a large number of queries when generating adversarial examples. In particular, it takes a large number of queries to approximate the gradient. Therefore, in this paper, we propose a method of generating adversarial examples using orthogonal space sampling and dimensionality reduction sampling to avoid wasting queries that are consumed to approximate the gradient of existing decision-based attack technique[14]. Experiments show that our method can reduce the perturbation size of adversarial examples by about 2.4 compared to existing attack technique[14] and increase the attack success rate by 14% compared to existing attack technique[14]. Experimental results demonstrate that the adversarial example generation method proposed in this paper has superior attack performance.
참고문헌 (18)
- C. Szegedy, "Intriguing properites of neural networks", arXiv preprint arXiv : 1312. 6199, ~ (2013)
- I. Goodfellow, "Explaining and harnessing adversarial examples", arXiv preprint arXiv : 1412. 6572, ~ (2014)
- N. Papernot, "The limitations of deep learning in adversarial settings", 2016IEEE European symposium on security and privacy (EuroS&P), pp.372~387 (2016)
- S. Moosavi-Dezfooli, "DeepFool : a simple and accurate method to fool deep neural networks", 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp.2574~2582 (2016)
- N. Carlini, "Towards evaluating the robustness of neural networks", 2017 IEEE Symposium on Security and Privacy(SP), pp.39~57 (2017)
- A. Madry, "Towards deep learning models resistant to adversarial attacks", arXiv preprint arXiv : 1706. 06083, ~ (2017)
- A. Athalye, "Synthesizing Robust Adversarial Examples", International Conference on Machine Learning(ICML), pp.284~293 (2018)
- A. Athalye, "Synthesizing Robust Adversarial Examples", International Conference on Machine Learning(ICML), pp.274~283 (2018)
- J. Su, "One pixel attack for fooling deep neural networks", 23(5), pp.828~841 (2019)
- P. Chen, "ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models", 2017ACM SIGSAC Conference on Computer and Communications Security, pp.15~26 (2017)
- N. Papernot, "Practical Black-Box Attacks against Machine Learning", 2017 ACM on Asia Conference on Computer and Communications Security, ASIA CCS’17, pp.506~519 (2017)
- W. Brendel, "Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models", International Conference on Learning Representations (2018)
- Labeled faces in the wild: A database for studying face recognition in unconstrained environments, "G. B. Huang", University of Massachusetts, 1~, pp.Technical Report 07-49 (2007)
- J. Chen, "HopSkipJumpAttack : A Query-Efficient Decision-Based Attack", 2020 IEEE Symposium on Security and Privacy(SP), pp.1277~1294 (2020)
- W. Liu, "SphereFace : Deep hypersphere embedding for face recognition", Proc. IEEE Conf. Comput. Vis. Pattern Recognit, pp.6738~6746 (2017)
- K. Simonyan, "Very deep convolutional networks for large-scale image recognition", arXiv:1409.1556, ~ (2014)
- K. He, "Deep residual learning for image recognition", arXiv : 1512. 03385, ~ (2015)
- J. Deng, "ArcFace : Additive angular margin loss for deep face recognition", arXiv : 1801. 07698, ~ (2018)