Adversarial sample defense method based on spoofing attacker

Abstract

The invention discloses an adversarial sample defense method based on a spoofing attacker, and belongs to the technical field of computer image processing. According to the technical scheme, a classification system is constructed on the basis that the classification performance of an original classifier is not changed, a buffer is added into the classification system in a parallel mode, and an attacker is well cheated by constructing a classifier 2 poor in generalization performance with the original classifier; an additional detector is arranged in front of an original classifier, single-stepattacks are defended, the difficulty of the attack process is improved, and only the original classifier is adopted to classify images classified into normal labels by the detected device; a comparator or an ensemble learning block is adopted to replace a detector, better classification performance and non-gradient return characteristics are obtained, and the comparator does not bear any specificattack strategy and disturbance mode. The method has the beneficial effects that the generation process of the adversarial sample is hindered by adopting the buffer, the comparator and the like, andthe defensive performance of the classification network on the adversarial sample is improved under the condition that the classification performance of the normal sample is not influenced.

Description

technical field [0001] The invention belongs to the technical field of computer image processing, and in particular relates to an adversarial sample defense method based on deceiving attackers. Background technique [0002] Recently, with the advent of deep learning and the establishment of large databases, deep neural networks have significantly improved the performance of image classification and other similar tasks. Until now, deep neural networks still work like black boxes. pointed out that small perturbations to the original image will lead to misclassification by the classification network. Meanwhile, Goodfellow et al. show that it is the high linearity of deep learning that leads to the generation of adversarial examples. Based on this, they propose the Fast Gradient Sign Method (FGSM). FGSM only performs one-step gradient update along the direction of the gradient sign at the image pixel. In order to improve the attack performance of FGSM, Dong et al. use moment...

AI Technical Summary

Problems solved by technology

We don't know if the perturbation produced by this method is general or specific to each classifier, but this method produces more perturbations than just attacking one classifier

By investigating several defense methods, He et al. show that using multiple defense methods simultaneously does not significantly improve defense performance

However, it seems that this conclusion does not apply to all defense methods

Images