감쇠 요소가 적용된 데이터 어그멘테이션을 이용한 대체 모델 학습과 적대적 데이터 생성 방법
A Substitute Model Learning Method Using Data Augmentation with a Decay Factor and Adversarial Data Generation Using Substitute Model
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
적대적 공격은 기계학습 분류 모델의 오분류를 유도하는 적대적 데이터를 생성하는 공격으로, 실생활에 적용된 분류 모델에 혼란을 야기하여 심각한 피해를 발생시킬 수 있다. 이러한 적대적 공격 중 블랙박스 방식의 공격은, 대상모델과 유사한 대체 모델을 학습시켜 대체 모델을 이용해 적대적 데이터를 생성하는 공격 방식이다. 이 때 사용되는야코비 행렬 기반의 데이터 어그멘테이션 기법은 합성되는 데이터의 왜곡이 심해진다는 단점이 있다. 본 논문은 기존의 데이터 어그멘테이션 방식에 존재하는 단점을 보완하기 위해 감쇠 요소를 추가한 데이터 어그멘테이션을 사용하여대체 모델을 학습시키고, 이를 이용해 적대적 데이터를 생성하는 방안을 제안한다. 실험을 통해, 기존의 연구 결과보다 공격 성공률이 최대 8.5% 가량 높음을 입증하였다.
Abstract
Adversarial attack, which geneartes adversarial data to make target model misclassify the input data, is able to confusereal life applications of classification models and cause severe damage to the classification system. An Black-box adversarialattack learns a substitute model, which have similar decision boundary to the target model, and then generates adversarialdata with the substitute model. Jacobian-based data augmentation is used to synthesize the training data to learn substitutes,but has a drawback that the data synthesized by the augmentation get distorted more and more as the training loopproceeds. We suggest data augmentation with 'decay factor' to alleviate this problem. The result shows that attack successrate of our method is higher(around 8.5%) than the existing method.
참고문헌 (21)
- L. Huang, "Adversarial machine learning", Proceedings of the 4th ACM workshopon Security and artificial intelligence, pp.43~58 (2011)
- B. Biggio, "Evasion attacks against machine learning at test time", Joint European conference on machine learning and knowledge discovery in databases, pp.387~402 (2013)
- N. Papernot, "Practical black-box attacks a gainst machine learning", Proceedings of the 2017 ACM on Asia conference on computer and communications security, pp.506~519 (2017)
- S. Qiu, "Review of artificial intelligence adversarial attack and defense technologies", Applied Sciences, 9(5), pp.909~938 (2019)
- N. Papernot, "The limitations of deep learning in adversarial settings", 2016 IEEE European Symposium on Security and Privacy, pp.372~387 (2016)
- N. Carlini, "Towards evaluating the robustness of neural networks", 2017 IEEE Symposium on Security and Privacy, pp.39~57 (2017)
- I. Goodfellow, "Explaining and harnessing adversarial examples", arXiv preprint arXiv:1412.6572, ~ (2014)
- X. Yuan, "Adversarial examples : attacks and defenses for deep learning", IEEE transactions on neural networks and learning systems, 9(5), pp.2805~2824 (2019)
- D. Bertsekas, "Nonlinear programming", Journal of the Operational Research Society, 48(3), pp.334~ (1997)
- C. Szegedy, "Intriguing properites of neural networks", arXiv preprint arXiv : 1312. 6199, ~ (2013)
- Y. Lecun, "Shape, contour and grouping in computer vision", pp.319~345 (1999), Springer
- A. Krizhevsky, "Imagenet classification with deep convolutional neural networks", Advances in neural information processing systems, 1, pp.1097~1105 (2012)
- H. Sak, "Long short-term memory based recur rent neural network architectures for large vocabulary speech recognition", arXiv preprint arXiv : 1402. 1128, ~ (2014)
- H. Sak, "Long short-term memory recurrent neural network architectures for large scale acoustic modeling", Fifteenth annual conference of the international speech communication association, pp.338~342 (2014)
- N. Papernot, "Transferability in machine learning from phenomena to black-box attacks using adversarial samples", arXiv preprint arXiv:1605.07277, ~ (2016)
- M. Abadi, "Tensorlfow: A system for large-scale machine learning", 12th USENIX Symposium on Operating Systems Design and Implementation, pp.265~283 (2016)
- L. Bottou, "Large-scale machine learning with stochastic gradient descent", Proceedings of COMPSTAT'2010, pp.177~186 (2010), Physica-Verlag HD
- D. Kingma, "Adam: A method for stochastic optimization", arXiv preprint arXiv : 1412. 6980, ~ (2014)
- X. Gao, "Boosting targeted black-box attacks via ensemble substitute training and linear augmentation", Applied Sciences, 9(11), pp.2286~2300 (2019)
- R. Caruana, "Ensemble selection from libraries of models", Proceedings of the twenty-first international conference on Machine learning, pp.18~ (2004), ACM
- Y. Liu, "Delving into transferable adversarial examples and black-box attacks", arXiv preprint arXiv : 1611. 02770, ~ (2016)