질의 효율적인 의사 결정 공격을 통한 오디오 적대적 예제 생성 연구
Generating Audio Adversarial Examples Using a Query-Efficient Decision-Based Attack
1
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
딥러닝 기술이 여러 분야에 적용되면서 딥러닝 모델의 보안 문제인 적대적 공격기법 연구가 활발히 진행되었다. 적대적 공격은 이미지 분야에서 주로 연구가 되었는데 최근에는 모델의 분류 결과만 있으면 공격이 가능한 의사 결정 공격기법까지 발전했다. 그러나 오디오 분야의 경우 적대적 공격을 적용하는 연구가 비교적 더디게 이루어지고 있는데 본 논문에서는 오디오 분야에 최신 의사 결정 공격기법을 적용하고 개선한다. 최신 의사 결정 공격기법은 기울기 근사를 위해 많은 질의 수가 필요로 하는 단점이 있는데 본 논문에서는 기울기 근사에 필요한 벡터 탐색 공간을 축소하여 질의 효율성을 높인다. 실험 결과 최신 의사 결정 공격기법보다 공격 성공률을 50% 높였고, 원본 오디오와 적대적 예제의 차이를 75% 줄여 같은 질의 수 대비 더욱 작은 노이즈로 적대적 예제가 생성 가능함을 입증하였다.
Abstract
As deep learning technology was applied to various fields, research on adversarial attack techniques, a security problem of deep learning models, was actively studied. adversarial attacks have been mainly studied in the field of images. Recently, they have even developed a complete decision-based attack technique that can attack with just the classification results of the model. However, in the case of the audio field, research is relatively slow. In this paper, we applied several decision-based attack techniques to the audio field and improved state-of-the-art attack techniques. State-of-the-art decision-attack techniques have the disadvantage of requiring many queries for gradient approximation. In this paper, we improve query efficiency by proposing a method of reducing the vector search space required for gradient approximation. Experimental results showed that the attack success rate was increased by 50%, and the difference between original audio and adversarial examples was reduced by 75%, proving that our method could generate adversarial examples with smaller noise.
참고문헌 (23)
- C. Szegedy, "Intriguing properties of neural networks", International Conference o n Learning Representations(ICLR) (2014)
- I. Goodfellow, "Explaining and harnessing advers arial examples", International Confere nce on Learning Representations(ICL R) (2015)
- N. Papernot, "The limitations of deep learnin g in adversarial settings", 2016 IEEE European symposium on security and privacy (EuroS&P), pp.372~387 (2016)
- S. Moosavi-Dezfooli, "DeepFool: a simple and acc urate method to fool deep neural net works", 2016 IEEE Conference on Com puter Vision and Pattern Recognition (CVPR), pp.2574~2582 (2016)
- N. Carlini, "Towards evaluating the robustness of neural n etworks", 2017 IEEE Symposium on S ecurity and Privacy (SP), pp.39~57 (2017)
- A. Athalye, "Synthes izing Robust Adversarial Examples", I nternational Conference on Machine L earning(ICML), pp.284~293 (2018)
- A. Athalye, "Synthesizing Robust Adversarial E xamples", International Conference on Machine Learning(ICML), pp.274~283 (2018)
- J. Su, "On e pixel attack for fooling deep neural networks", 23(5), pp.828~841 (2019)
- P. Chen, "ZOO : Zeroth Order Optimizati on based Black-box Attacks to Deep Neural Networks without Training Su bstitute Models", 2017 ACM SIGSAC C onference on Computer and Communic ations Security, pp.15~26 (2017)
- N. Papernot, "Practical Black-Box Attacks against Machine Learning", 2017 ACM on Asia Conference on Computer and Communications Security, ASIA CCS’17, pp.506~519 (2017)
- W. Brendel, "Decision-Based Adversarial Attack s: Reliable Attacks Against Black-Box Machine Learning Models", Internation al Conference on Learning Representa tions (2018)
- J. Chen, "HopSkipJumpAttack: A Query-Efficient Decision-Based Attack", 2020 IE EE Symposium on Security and Priva cy (SP), pp.1277~1294 (2020)
- N. Carlini, "Audio Adv ersarial Examples: Targeted Attacks on Speech-to-Text", 2018 IEEE Securit y and Privacy Workshops (SPW), pp.1~7 (2018)
- M. Alzantot, "Did you hear that? Adversarial Examples Against Automatic Speech Recognition", Machine Deception Work shop, Neural Information Processing Systems (NIPS) (2017)
- R. Taori, "Targeted Adversarial Examples for Black Box Audio Systems", 2019 IEEE Security, and Privacy Workshops (SP W), pp.15~20 (2019)
- X. Yuan, "Commandersong: A systematic appro ach for practical adversarial voice rec ognition", 27th USENIX Security Symp osium, pp.49~64 (2018)
- C. Kereliuk, "Deep Learning and Music Advers aries", IEEE Transactions on Multime dia, 17(11), pp.2059~2071 (2015)
- H. Abdullah, "Practical hidden voice attac ks against speech and speaker recogni tion systems", NDSS 2019, pp.1369~1378 (2019)
- L. Schonherr, "Adversarial Attacks Against A utomatic Speech Recognition Systems via Psychoacoustic Hiding", NDSS 2019 (2019)
- H. Yakura, "Robust A udio Adversarial Example for a Physic al Attack", 28th International Joint Co nference on Artificial Intelligencepp, pp.5334~5341 (2019)
- S. Hu, "Adversarial Examples for Automatic Speech Recognition : Attacks and Cou ntermeasures", IEEE Communications Magazine, pp.120~126 (2019)
- "Simple audio recognition: Recognizing keywords"[URL]
- P. Warden, "Speech Commands: A Dat aset for Limited-Vocabulary Speech R ecognition", arXiv preprint arXiv:1804, ~