摘要
如果对抗样本的迁移性越强,则其攻击结构未知的深度神经网络模型的效果越好,所以设计对抗样本生成方法的一个关键在于提升对抗样本的迁移性。然而现有方法所生成的对抗样本,与模型的结构和参数高度耦合,从而难以对结构未知的模型进行有效攻击。类别显著性映射能够提取出样本的关键特征信息,而且在不同网络模型中有较高的相似度。基于显著性映射的这一特点,在样本生成过程中,引入类别显著性映射进行约束,实验结果表明,该方法生成的对抗样本具有较好的迁移性。
The adversarial examples,if their transferability is stronger,will be more effective to attack models with unknown structure.Therefore,a key to design adversarial examples generation method is to improve the transferability of adversarial examples.However,the existing method for generating adversarial examples are highly coupled with the structure and parameters of the local model,which make the generated adversarial examples difficult to attack other models.The class activation map can extract the key feature information of the example,and it has high similarity in different neural network models.Based on this observation,the class activation map is used to constrain the process of example generation.Experimental results show that the adversarial examples generated by this method have good transferability.
作者
叶启松
戴旭初
Ye Qisong;Dai Xuchu(School of Cyberspace Security,University of Science and Technology of China,Hefei 230026,China)
出处
《信息技术与网络安全》
2021年第6期9-14,共6页
Information Technology and Network Security
关键词
深度学习
安全
对抗样本
迁移性
deep learning
security
adversarial example
transferability