Certified Defense for Content Based Image Retrieval
Certified Defense for Content Based Image Retrieval
复制标题
DOI：
10.1109/wacv56688.2023.00454
复制
发表时间：
2023-01
期刊：
影响因子：
--
通讯作者：
Kazuya Kakizaki;Kazuto Fukuchi;Jun Sakuma
中科院分区：
文献类型：
--
作者：
Kazuya Kakizaki;Kazuto Fukuchi;Jun Sakuma
本文开发了一种基于深度神经网络（DNN）的基于内容的图像检索（CBIR）对抗对抗性示例（AX）的认证防御。以前的工作把他们的努力，认证防御分类，以提高认证的鲁棒性，这保证了没有AX造成误分类存在周围的样本。然而，这种认证防御不能直接应用于CBIR，因为对抗性分类攻击和CBIR的目标完全不同。为了开发CBIR的认证防御，我们首先定义了CBIR的新认证鲁棒性，这保证了在查询或候选图像周围不存在改变CBIR排名的AX。然后，我们提出了计算上易于处理的验证算法，验证是否通过利用扰动和非扰动图像的特征表示之间的距离的上界和下界实现CBIR的认证的鲁棒性。最后，我们提出了用于训练特征提取DNN的新目标函数，通过收紧上界和下界来增加满足CBIR认证鲁棒性的输入数量。实验结果表明，我们的目标函数显着提高认证的CBIR比现有的方法的鲁棒性。
This paper develops a certified defense for deep neural network (DNN) based content based image retrieval (CBIR) against adversarial examples (AXs). Previous works put their effort into certified defense for classification to improve certified robustness, which guarantees that no AX to cause misclassification exists around the sample. Such certified defense, however, could not be applied to CBIR directly because the goals of adversarial attack against classification and CBIR are completely different. To develop the certified defense for CBIR, we first define new certified robustness of CBIR, which guarantees that no AX that changes the ranking of CBIR exists around the query or candidate images. Then, we propose computationally tractable verification algorithms that verify whether the certified robustness of CBIR is achieved by utilizing upper and lower bounds of distances between feature representations of perturbed and non-perturbed images. Finally, we propose new objective functions for training feature extraction DNNs that increases the number of inputs that satisfy the certified robustness of CBIR by tightening the upper and lower bounds. Experimental results show that our objective functions significantly improve the certified robustness of CBIR than existing methods.