基于高维特征的图像对抗攻击算法

Image adversarial attack algorithm based on high-dimensional feature

为了攻击最先进的对抗防御方法,提出一种基于高维特征的图像对抗攻击算法——FB-PGD(feature based projected gradient descent)。该算法通过迭代的方式给待攻击图像添加扰动,使待攻击图像的特征与目标图像的特征相似,从而生成对抗样本。实验部分,在多种数据集和防御模型上,与现存的攻击算法对比,证实了FB-PGD算法不仅在以往的防御方法上攻击性能优异,同时在最先进的两个防御方法上,攻击成功率较常见的攻击方法提升超过20%。因此,FB-PGD算法可以成为检验防御方法的新基准。

In order to attack state-of-the-art adversarial defense methods,an image adversarial attack algorithm based on high-dimensional features called FB-PGD(feature based projected gradient descent)is proposed.It increases the similarity between clean image features and target image features by adding perturbation to clean image iteratively,then adversarial examples will be generated.In the experimental section,by comparing with existing adversarial attack algorithms on different defense models,the result shows that this attack algorithm not only has strong attack performance in the previous defense methods but also increases attack success rate more than 20%compared to common adversarial attack algorithms in two state-of-the-art defense methods on a variety of datasets.So,the adversarial attack algorithm can be used as a new benchmark to test defense.