论文标题
通过类有条件重建网络检测对抗贴片
Detecting Adversarial Patches with Class Conditional Reconstruction Networks
论文作者
论文摘要
防御物理对抗攻击是深度学习和计算机视觉中快速发展的话题。物理对抗攻击的突出形式，例如覆盖的对抗斑块和对象，与数字攻击共享相似之处，但对于人类来说很容易注意到。这使我们探讨了这样的假设：对抗性检测方法已被证明对自适应数字对抗性实例无效，可以有效地抵抗这些物理攻击。我们使用一种基于自动编码器体系结构的一种此类检测方法，并对MNIST，SVHN和CIFAR10对CNN体系结构和两个CAPSNET架构进行对抗性修补实验。我们还提出了对EM路由的CAPSNET体系结构，Agchine投票和矩阵胶囊辍学的两次修改，以提高其分类性能。我们的调查表明，该检测器即使针对自适应对抗斑块攻击也保留了一些有效性。此外，随着数据集复杂性的增加，所有体系结构之间的检测性能往往会降低。
Defending against physical adversarial attacks is a rapidly growing topic in deep learning and computer vision. Prominent forms of physical adversarial attacks, such as overlaid adversarial patches and objects, share similarities with digital attacks, but are easy for humans to notice. This leads us to explore the hypothesis that adversarial detection methods, which have been shown to be ineffective against adaptive digital adversarial examples, can be effective against these physical attacks. We use one such detection method based on autoencoder architectures, and perform adversarial patching experiments on MNIST, SVHN, and CIFAR10 against a CNN architecture and two CapsNet architectures. We also propose two modifications to the EM-Routed CapsNet architecture, Affine Voting and Matrix Capsule Dropout, to improve its classification performance. Our investigation shows that the detector retains some of its effectiveness even against adaptive adversarial patch attacks. In addition, detection performance tends to decrease among all the architectures with the increase of dataset complexity.
