엣지 기반 분류를 이용한 적대적 예제 탐지
Detecting Adversarial Examples Using Edge-based Classification
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
딥러닝 모델이 컴퓨터 비전 분야에서 혁신적인 성과를 이루어내고 있으나, 적대적 예제에 취약하다는 문제가 지속적으로 제기되고 있다. 적대적 예제는 이미지에 미세한 노이즈를 주입하여 오분류를 유도하는 공격 방법으로서, 현실 세계에서의 딥러닝 모델 적용에 심각한 위협이 될 수 있다. 본 논문에서는 객체의 엣지를 강조하여 학습된 분류 모델과 기본 분류 모델 간 예측 값의 차이를 이용하여 적대적 예제를 탐지하는 모델을 제안한다. 객체의 엣지를 추출하여 학습에 반영하는 과정만으로 분류 모델의 강건성을 높일 수 있으며, 모델 간 예측값의 차이를 통하여 적대적예제를 탐지하기 때문에 경제적이면서 효율적인 탐지가 가능하다. 실험 결과, 적대적 예제(eps={0.02, 0.05, 0.1, 0.2, 0.3})에 대한 일반 모델의 분류 정확도는 {49.9%, 29.84%, 18.46%, 4.95%, 3.36%}를 보인 반면, Canny 엣지 모델은 {82.58%, 65.96%, 46.71%, 24.94%, 13.41%}의 정확도를 보였고 다른 엣지 모델들도 이와 비슷한 수준의 정확도를 보여, 엣지 모델이 적대적 예제에 더 강건함을 확인할 수 있었다. 또한 모델 간 예측값의 차이를 이용한 적대적 예제 탐지 결과, 각epsilon별 적대적 예제에 대하여 {85.47%, 84.64%, 91.44%, 95.47%, 87.61%}의 탐지율을 확인할 수있었다. 본 연구가 관련 연구 분야 및 의료, 자율주행, 보안, 국방 등의 응용 산업 분야에서 딥러닝 모델의 신뢰성 제고에 기여할 것으로 기대한다.
Abstract
Although deep learning models are making innovative achievements in the field of computer vision, the problem of vulnerability to adversarial examples continues to be raised. Adversarial examples are attack methods that inject fine noise into images to induce misclassification, which can pose a serious threat to the application of deep learning models in the real world. In this paper, we propose a model that detects adversarial examples using differences in predictive values between edge-learned classification models and underlying classification models. The simple process of extracting the edges of the objects and reflecting them in learning can increase the robustness of the classification model, and economical and efficient detection is possible by detecting adversarial examples through differences in predictions between models. In our experiments, the general model showed accuracy of {49.9%, 29.84%, 18.46%, 4.95%, 3.36%} for adversarial examples (eps={0.02, 0.05, 0.1, 0.2, 0.3}), whereas the Canny edge model showed accuracy of {82.58%, 65.96%, 46.71%, 24.94%, 13.41%} and other edge models showed a similar level of accuracy also, indicating that the edge model was more robust against adversarial examples. In addition, adversarial example detection using differences in predictions between models revealed detection rates of {85.47%, 84.64%, 91.44%, 95.47%, and 87.61%} for each epsilon-specific adversarial example. It is expected that this study will contribute to improving the reliability of deep learning models in related research and application industries such as medical, autonomous driving, security, and national defense.
참고문헌 (18)
- K. Eykholt, "Robust physical-world attacks on deep learning visual classification", Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp.1625~1634 (2018)
- A. Liu, "X-adv: Physical adversarial object attacks against x-ray prohibited item detection", 32nd USENIX Security Symposium (USENIX Security 23), pp.3781~3798 (2023)
- Xingjun Ma, "Understanding adversarial attacks on deep learning based medical image analysis systems", Pattern Recognition, 110, pp.107332~ (2021), Elsevier BV[DOI]
- Naveed Akhtar, "Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey", IEEE Access, 6, pp.14410~14430 (2018), Institute of Electrical and Electronics Engineers (IEEE)[DOI]
- A. Madry, "Towards deep learning models resistant to adversarial attacks", International Conference on Learning Representations (2018)
- D. Tsipras, "Robustness may be at odds with accuracy", International Conference on Learning Representations (2019)
- A. Borji, "Shape defense", I (Still) can'T Believe it's Not Better!Workshop at NeurIPS 2021, pp.15~20 (2022)
- W. Xu, "Feature squeezing: Detecting adversarial examples in deep neural networks", NDSS Symposium (2018)
- S. Moosavi-Dezfooli, "Deepfool: A simple and accurate method to fool deep neural networks", Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp.2574~2582 (2016)
- N. Carlini, "Towards evaluating the robustness of neural networks", 2017 IEEE Symposium on Security and Privacy (Sp), pp.39~57 (2017)
- D. Meng, "Magnet: A two-pronged defense against adversarial examples", Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp.135~147 (2017)
- J. H. Metzen, "On detecting adversarial perturbations", International Conference on Learning Representations (2017)
- L. G. Roberts, "Machine Perception of Three-Dimensional Solids", PhD, pp.1963
- I. Sobel, "A 3x3 isotropic gradient operator for image processing", a talk at the Stanford Artificial Project in, 271~272 (1968)
- JOHN CANNY, "A Computational Approach to Edge Detection", Readings in Computer Vision, pp.184~203 (1987), Elsevier[DOI]
- "Optimal operators in digital image processing"[URL]
- "ANIMALS(30 Animal Species for Easy train)"[URL]