An adversarial sample detection method based on the distance from a sample to a decision boundary

Abstract

An adversarial sample detection method based on the distance from a sample to a decision boundary. Adversarial samples are generated on the basis of common samples, feature extraction is performed onall samples, that is to say, a distance estimation value from each sample to a decision boundary is calculated, the distance estimation values are taken as features of the samples to train a classifier, and the trained classifier is the detector, which is used to detect the adversarial samples. The method can be widely applied to machine learning models based on classifiers, such as speech recognition, image classification and the like, to improve the detection rate of antagonistic samples. The method can be used in an artificial intelligence API, input samples can be filtered, and the security of artificial intelligence has been significantly improved.

Description

technical field [0001] The present invention relates to a technology in the field of artificial intelligence confrontation, in particular to a method for detecting confrontation samples based on the distance from samples to decision boundaries. Background technique [0002] Artificial intelligence has developed rapidly in recent years and has been applied in more and more fields. However, research has found that artificial intelligence classifiers have relatively serious security vulnerabilities. Malicious attackers can make small disturbances to normal recognition samples to make them adversarial samples. Adversarial samples can make classifiers identify mistakes. To a certain extent, it resists adversarial sample attacks, but the effect is always unsatisfactory. Therefore, many researchers hope to detect adversarial samples through some inherent characteristics of adversarial samples, so as to resist adversarial attacks. Contents of the invention [0003] Aiming at the ...

AI Technical Summary

Problems solved by technology

However, research has found that artificial intelligence classifiers have relatively serious security vulnerabilities. Malicious attackers can make small perturbations to normal recognition samples to make them adversarial samples. Adversarial samples can make classifiers identify mistakes. To a certain extent, it resists adversarial sample attacks, but the effect is always unsatisfactory. Therefore, many researchers hope to detect adversarial samples through some inherent characteristics of adversarial samples, so as to resist adversarial attacks.

Images