基于Perlin增强与随机变换的黑盒攻击方法

A Black-Box Attack Method Based on Perlin Enhancement and Random Transformation

当前基于迁移性的黑盒攻击通常使用较高扰动系数生成具有较强可迁移性的对抗样本,导致对抗扰动较易被防御者察觉,针对此问题,提出一种基于Perlin增强与随机变换的黑盒攻击方法。方法利用Perlin噪声对干净样本进行数据增强,同时使用增强后的数据集和随机尺度与填充运算来改进现有的基于平移不变的对抗样本生成方法,以降低对抗样本的黑盒攻击能力与扰动系数的耦合程度。在ImageNet数据集中的实验结果表明,通过优化后的对抗攻击在不修改扰动系数的情况下增强了对抗样本的可迁移性。

At present,black-box attacks based on transferability usually use high disturbance coeffi-cient to generate adversarial examples with strong transferability,which makes adversarial disturbance easier to be detected by defenders.To solve this problem,a black-box attack method based on Perlin enhancement and random transformation is proposed.By using Perlin noise,the method enhances the data of clean examples,and at the same time,it uses the enhanced data set and random scale and filling opera-tion to improve the existing translation-invariant adversarial examples generation method,so as to reduce the coupling degree between the black-box attack ability and the disturbance coefficient of adversarial examples.The experimental results in ImageNet data set show that the transferability of adversarial exam-ples is enhanced by the optimized adversarial attack without modifying the disturbance coefficient.