[1]林庚右,周星宇,潘志松.基于掩膜的人脸压缩重建对抗攻击增强方法[J].计算机技术与发展,2023,33(08):88-94.[doi:10. 3969 / j. issn. 1673-629X. 2023. 08. 013]
　LIN Geng-you,ZHOU Xing-yu,PAN Zhi-song.Mask-based Face Compression-reconstruction Adversarial Attack Enhancement Method[J].,2023,33(08):88-94.[doi:10. 3969 / j. issn. 1673-629X. 2023. 08. 013]

点击复制

基于掩膜的人脸压缩重建对抗攻击增强方法()

《计算机技术与发展》[ISSN:1006-6977/CN:61-1281/TN]

卷:

33

期数:

2023年08期

页码:

88-94

栏目:

网络空间安全

出版日期:

2023-08-10

文章信息/Info

Title:

Mask-based Face Compression-reconstruction Adversarial Attack Enhancement Method

文章编号:

1673-629X(2023)08-0088-07

作者:

林庚右¹ ; 周星宇² ; 潘志松¹

1. 陆军工程大学 指挥控制工程学院,江苏 南京 210007;

2. 陆军工程大学 通信工程学院,江苏 南京 210007

Author(s):

LIN Geng-you1 ; ZHOU Xing-yu2 ; PAN Zhi-song1

1. School of Command & Control Engineering,Army Engineering University of PLA,Nanjing 210007,China;

2. School of Communication Engineering,Army Engineering University of PLA,Nanjing 210007,China

关键词:

对抗样本; 人脸识别; 深度神经网络; 对抗攻击; 压缩重建

Keywords:

adversarial example; face recognition; deep neural network; adversarial attack; compression &;  reconstruction

分类号:

TP391

DOI:

10. 3969 / j. issn. 1673-629X. 2023. 08. 013

摘要:

现有研究表明通过对输入的人脸图片施加扰动能够导致人脸识别系统发生误判,即对抗样本。 当前,许多对抗样本攻击方法通过在扰动生成过程中对扰动进行旋转、调整尺度、添加随机噪声等变换,以实现增强攻击性的目的。 该文首次发现对抗样本在由 ndarray 格式压缩为 PNG( Portable Network Graphics) 格式,再重建成 ndarray 格式时对抗性会得到增强。 基于此,提出了基于掩膜的人脸压缩重建对抗攻击增强方法———在对抗样本的迭代生成中,在预定迭代次数下设置断点,并在断点处反复地对对抗图片的掩膜区域进行压缩重建( Compression & Reconstruction,C&R)。 在 IFW 人脸检测数据集上分别进行了单模型攻击和集成模型攻击的实验,结果证明,该方法生成的对抗样本在白盒场景下攻击成功率最高提高了 2. 3% ,在黑盒场景中攻击成功率也有小幅提升。 最后,分别通过两组超参数实验探讨了参数的不同选取对该方法攻击效果的影响,并给出了最优参数以供后续研究参考。

Abstract:

Existing studies have shown that applying perturbations on the input face images can cause face recognition systems tomisjudge,that is,adversarial examples. Currently,many adversarial example attack methods achieve enhanced aggressiveness by rotating,rescaling,adding random noise and other transformations to the perturbation during perturbation generation. We find for the first time thatthe adversarial examples are enhanced when they are compressed from ndarray format to PNG ( Portable Network Graphics) format andthen reconstructed to ndarray format. Based on this, we propose a?

mask - based face compression - reconstruction adversarial attackenhancement method. In the iterative generation of the adversarial example,a break

point is set at a predetermined number of iterations,and the mask region of the adversarial image is repeatedly compressed and reconstructed at the breakpoint ( Compression &Reconstruction,C&R) . We conduct experiments on IFW face detection dataset for single-model attack and integrated-model attack respectively,and the results demonstrate that the adversarial samples generated by the method have a maximum improvement of 2. 3% inthe attack success rate in white-box scenarios and a small improvement in the attack success rate in black -box scenarios. Finally,weexplore the effects of different parameter selections on the attack effectiveness of the method through two sets of hyperparameterexperiments respectively,and give the optimal parameters for reference in subsequent studies.

常用功能