论文标题
在类似PGD的对抗攻击的痕迹上
On Trace of PGD-Like Adversarial Attacks
论文作者
论文摘要
对抗性攻击对深度学习应用构成了安全和保障问题，但其特征却没有探索。然而，在很大程度上不可察觉，在对抗性的例子中，PGD样攻击可能会留下很大的痕迹。回想一下，类似PGD的攻击触发了网络的``局部线性''，这意味着良性或对抗性示例的线性范围不同。受此启发，我们构建了一个对抗响应特征（ARC）功能，以反映模型围绕输入的梯度一致性，以指示线性的程度。在某些条件下，由于后者导致续集攻击效果（SAE），因此从良性示例到对抗示例，它质量地显示了逐渐变化的模式。为了定量评估ARC的有效性，我们在CIFAR-10和Imagenet上进行实验，以在充满挑战的环境中进行攻击检测和攻击类型识别。结果表明，SAE是通过ARC功能反映的PGD样攻击的有效且独特的痕迹。 ARC功能是直观的，轻度的，无侵蚀的和数据量的。
Adversarial attacks pose safety and security concerns to deep learning applications, but their characteristics are under-explored. Yet largely imperceptible, a strong trace could have been left by PGD-like attacks in an adversarial example. Recall that PGD-like attacks trigger the ``local linearity'' of a network, which implies different extents of linearity for benign or adversarial examples. Inspired by this, we construct an Adversarial Response Characteristics (ARC) feature to reflect the model's gradient consistency around the input to indicate the extent of linearity. Under certain conditions, it qualitatively shows a gradually varying pattern from benign example to adversarial example, as the latter leads to Sequel Attack Effect (SAE). To quantitatively evaluate the effectiveness of ARC, we conduct experiments on CIFAR-10 and ImageNet for attack detection and attack type recognition in a challenging setting. The results suggest that SAE is an effective and unique trace of PGD-like attacks reflected through the ARC feature. The ARC feature is intuitive, light-weighted, non-intrusive, and data-undemanding.
