Two Souls in an Adversarial Image: Towards Universal Adversarial Example Detection using Multi-view Inconsistency
Two Souls in an Adversarial Image: Towards Universal Adversarial Example Detection using Multi-view Inconsistency
复制标题
DOI：
10.1145/3485832.3485904
复制
发表时间：
2021-09
期刊：
影响因子：
--
通讯作者：
Sohaib Kiani;S. Awan;Chao Lan;Fengjun Li;Bo Luo
中科院分区：
文献类型：
--
作者：
Sohaib Kiani;S. Awan;Chao Lan;Fengjun Li;Bo Luo
在针对深度神经网络（DNN）的逃避攻击中，攻击者生成视觉上与良性样本无法区分的敌对实例，并将其发送给目标DNN以触发错误分类。本文基于一种新的观测结果，提出了一种新的多视点对抗图像检测器，即Argos。也就是说，在一个对抗实例中存在两个“灵魂”，即视觉上不变的内容，对应于真实标签，以及添加的不可见扰动，对应于错误分类的标签。这种不一致性可以通过自回归生成方法进一步放大，该方法使用从原始图像中选择的种子像素、选择的标签和从训练数据中学习的像素分布来生成图像。如果标签是对抗性的，生成的图像（即“视图”）将明显偏离原始图像，这表明了Argos期望检测到的不一致性。为此，Argos首先使用一套再生机制放大攻击引起的图像视觉内容与其错误分类标签之间的差异，然后在复制视图偏离预设程度时将图像识别为对敌图像。我们的实验结果表明，Argos在检测精度和鲁棒性方面明显优于两种典型的对抗性检测器，以对抗六种已知的对抗性攻击。代码可从https://github.com/sohaib730/Argos-Adversarial_Detection获得
In the evasion attacks against deep neural networks (DNN), the attacker generates adversarial instances that are visually indistinguishable from benign samples and sends them to the target DNN to trigger misclassifications. In this paper, we propose a novel multi-view adversarial image detector, namely Argos, based on a novel observation. That is, there exist two “souls” in an adversarial instance, i.e., the visually unchanged content, which corresponds to the true label, and the added invisible perturbation, which corresponds to the misclassified label. Such inconsistencies could be further amplified through an autoregressive generative approach that generates images with seed pixels selected from the original image, a selected label, and pixel distributions learned from the training data. The generated images (i.e., the “views”) will deviate significantly from the original one if the label is adversarial, demonstrating inconsistencies that Argos expects to detect. To this end, Argos first amplifies the discrepancies between the visual content of an image and its misclassified label induced by the attack using a set of regeneration mechanisms and then identifies an image as adversarial if the reproduced views deviate to a preset degree. Our experimental results show that Argos significantly outperforms two representative adversarial detectors in both detection accuracy and robustness against six well-known adversarial attacks. Code is available at: https://github.com/sohaib730/Argos-Adversarial_Detection