论文标题
关于基于补丁的对抗性攻击语义分割问题的可行性和普遍性
On the Feasibility and Generality of Patch-based Adversarial Attacks on Semantic Segmentation Problems
论文作者
论文摘要
深度神经网络被成功地用于无数应用中，但是在紧急情况下，对抗攻击仍然构成重大威胁。这些攻击在各种分类和检测任务上得到了证明，通常认为一般性的攻击是可以生成任意网络输出的。 在本文中，我们将通过模拟和现实生活中的简单案例研究来证明，可以利用基于补丁的攻击来改变分割网络的输出。通过一些示例和对网络复杂性的调查，我们还将证明，可以通过基于补丁的攻击给定尺寸生成的可能输出图的数量通常小于其影响区域或应在实际应用中攻击的区域。 我们将证明，基于这些结果，大多数基于贴片的攻击在实践中不可能是一般的，即它们无法生成任意输出图，或者如果可以的话，它们在空间上受到限制，并且该限制明显小于斑块的接受场。
Deep neural networks were applied with success in a myriad of applications, but in safety critical use cases adversarial attacks still pose a significant threat. These attacks were demonstrated on various classification and detection tasks and are usually considered general in a sense that arbitrary network outputs can be generated by them. In this paper we will demonstrate through simple case studies both in simulation and in real-life, that patch based attacks can be utilised to alter the output of segmentation networks. Through a few examples and the investigation of network complexity, we will also demonstrate that the number of possible output maps which can be generated via patch-based attacks of a given size is typically smaller than the area they effect or areas which should be attacked in case of practical applications. We will prove that based on these results most patch-based attacks cannot be general in practice, namely they can not generate arbitrary output maps or if they could, they are spatially limited and this limit is significantly smaller than the receptive field of the patches.
