이미지의 Symbolic Representation 기반 적대적 예제 탐지 방법
Adversarial Example Detection Based on Symbolic Representation of Image
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
딥러닝은 이미지 처리에 있어 우수한 성능을 보여주며 큰 주목을 받고 있지만, 입력 데이터에 대한 변조를 통해 모델이 오분류하게 만드는 적대적 공격에 매우 취약하다. 적대적 공격을 통해 생성된 적대적 예제는 사람이 식별하기 어려울 정도로 최소한으로 변조가 되며 이미지의 전체적인 시각적 특징은 변하지 않는다. 딥러닝 모델과 달리 사람은 이미지의 여러 특징을 기반으로 판단하기 때문에 적대적 예제에 속지 않는다. 본 논문은 이러한 점에 착안하여 이미지의 색상, 모양과 같은 시각적이고 상징적인 특징인 Symbolic Representation을 활용한 적대적 예제 탐지 방법을 제안한다. 입력 이미지에 대한 분류결과에 대응하는 Symbolic Representation과 입력 이미지로부터 추출한 Symbolic Representation을 비교하여 적대적 예제를 탐지한다. 다양한 방법으로 생성한 적대적 예제를 대상으로 탐지성능을 측정한 결과, 공격 목표 및 방법에 따라 상이하지만 specific target attack에 대하여 최대 99.02%의 탐지율을 보였다.
Abstract
Deep learning is attracting great attention, showing excellent performance in image processing, but is vulnerable to adversarial attacks that cause the model to misclassify through perturbation on input data. Adversarial examples generated by adversarial attacks are minimally perturbated where it is difficult to identify, so visual features of the images are not generally changed. Unlikely deep learning models, people are not fooled by adversarial examples, because they classify the images based on such visual features of images. This paper proposes adversarial attack detection method using Symbolic Representation, which is a visual and symbolic features such as color, shape of the image. We detect a adversarial examples by comparing the converted Symbolic Representation from the classification results for the input image and Symbolic Representation extracted from the input images. As a result of measuring performance on adversarial examples by various attack method, detection rates differed depending on attack targets and methods, but was up to 99.02% for specific target attack.
참고문헌 (24)
- G. Ryu, "A Research Tre nds in Artificial Intelligence Security Attacks and Countermeasures", Review of KIISC, 30(5), pp.93~99 (2020)
- M. Xue, "Machine learning securit y : Threats, countermeasures, and eva luations", IEEE Access, 8, pp.74720~74742 (2020)
- C. Yang, "Generative poisoning attack methoda gainst neural networks", arXiv prepri nt arXiv:1703.01340, ~ (2017)
- L. Munoz-Gonzalez, "Towards poi soning of deep learning algorithms wi th back-gradient optimization", Pro c. 10thACM Workshop Artif. Intell. Se cur. AISec, pp.27~38 (2017)
- X. Chen, "Targeted backdoor attacks on deep learning systems using data pois oning", arXiv preprint arXiv:1712.05526, ~ (2017)
- T. Gu, "Badnets: Identifying vulnerabilities i n the machine learning model supply chain", arXiv preprint arXiv:1708.06733, ~ (2017)
- C. Szegedy, "Intriguing properties of neural netsworks", arXiv preprint a rXiv:1312.6199, ~ (2014)
- I. Goodfellow, "Explaining and Harnessing Adver sarial Examples", Proc. Internation al Conference on Learning Representa tions (2015)
- A. Kurakin, "Artificial intelligence s afety and security", pp.2018, Chapman and Hall
- A. Madry, "Towards deep learning models resistant to adversari al attacks", arXiv preprint arXiv:1706. 06083, ~ (2017)
- N. Carlini, "Towards Evaluating the Robustness of Neural Networks", Proc. IEEE Symposium Security and Privacy, pp.39~57 (2017)
- S. Moosavi-Dezfooli, "Deepfool: a simple and accu rate method to fool deep neural netwo rks", Proceedings of the IEEE confe rence on computer vision and pattern recognition, pp.2574~2582 (2016)
- Y. . Dong, "Boosting adve rsarial attacks with momentum", P roceedings of the IEEE conference on computer vision and pattern recogniti on, pp.9185~9193 (2018)
- M. Fredrikson, "Model inversion attacks that ex ploit confidence information and basic countermeasures", Proceedings of t he 22nd ACM SIGSAC conference on c omputer and communications security, pp.1322~1333 (2015)
- F. Tramèr, "Stealingm achine learning models via prediction APIs", 25th USENIX security symp osium (USENIX Security 16), pp.601~618 (2016)
- B. Biggio, "Wild patterns : Ten years after the rise of adversarial machine learning", Pattern Recognitio n, 84, pp.317~331 (2018)
- G. Ryu, "Advers arial attacks by attaching noise mark ers on the face against deep face reco gnition", Journal of Information Securi ty and Applications, 60, pp.1~11 (2021)
- H. Hirano, "Universal adversarial attacks on d eep neural networks for medical imag e classification", BMC medical imagin g, 21(1), pp.1~13 (2021)
- K. Eykholt, "Robust Physical-World Attacks o n Deep Learning Visual Classificatio n", Proceedings of the IEEE confere nce on computer vision and pattern r ecognition, pp.1625~1634 (2018)
- N. Akhtar, "Threat of ad versarial attacks on deep learning in computer vision : A survey", IEEE Access, 6, pp.14410~14430 (2018)
- D. Meng, "Magnet: a t wo-pronged defense against adversari al examples", Proceedings of the 2017 ACM SIGSAC conference on comp uter and communications security, pp.135~147 (2017)
- W. Xu, "Feature squeezing : Detecting adversarial exa mples in deep neural networks", arXiv preprint arXiv:1704.01155, ~ (2017)
- S. Freitas, "Unmask: Adversarial detection and defense through robust feature al ignment", 2020 IEEE International Conference on Big Data, pp.1081~1088 (2020)
- R. Timofte, "Sparse r epresentation based projections", P roceedings of the 22nd British machin e vision conference-BMVC, pp.61~61 (2011)