检索结果-内蒙古大学图书馆

DoFA: adversarial examples detection for SAR images by dual-objective feature attribution

EXPERT SYSTEMS WITH APPLICATIONS 2024年第PartC期255卷

作者： Zhang, Yu Zeng, Guo-Qiang Chen, Min-Rong Geng, Guang-Gang Weng, Jian Lu, Kang-Di Jinan Univ Coll Cyber Secur Guangzhou 510632 Peoples R China Jinan Univ Natl Joint Engn Res Ctr Network Secur Detect & Pro Guangzhou 510632 Peoples R China Wenzhou Univ Natl Local Joint Engn Lab Digitalize Elect Design Wenzhou 325035 Peoples R China South China Normal Univ Sch Comp Sci Guangzhou 510632 Peoples R China Zhejiang Univ Inst Cyber Syst & Control Natl Lab Ind Control Technol Hangzhou 310027 Peoples R China

Synthetic aperture radar (SAR) classification models based on convolutional neural networks have high accuracy, but the models' security is still threatened by adversarial examples. The high threat of adversarial examples derives from the invisible noise that can cause feature changes within the model. Among many adversarial examples detection methods, feature attribution that is sensitive to feature changes performs well in feature analysis. Unfortunately, the existing feature attribution-based detection methods cannot balance the computational efficiency and detection performance well due to the size and speckle noise of the images in SAR adversarial examples detection. In this work, we propose the Dual-objective Feature Attribution (DoFA) method by using the feature attribution scan block to find the suitable scan granularity. The DoFA method formulates the SAR adversarial examples detection issue as a dual-objective optimization problem and takes the number of subsamples generated by feature analysis and the area under curve (AUC) value of the logistic regression model as the objective functions while the feature scan block's size, stride, padding, and the number of selected model layers are the decision variables. Non-dominated Sorting Genetic Algorithm-II (NSGA-II) is adopted to search for the scan block parameters with Pareto optimality so that the DoFA method can automatically obtain the best feature analysis granularity in different scenarios. The experimental results on the FUSAR-Ship dataset have shown that the proposed DoFA method has a higher AUC value under five adversarial attacks and a smaller number of subsamples than the existing adversarial examples detection method.

关键词： Synthetic aperture radar adversarial examples detection Feature attribution Dual-objective optimization Evolutionary algorithms Logistic regression

来源：评论

学校读者我要写书评

暂无评论

adversarial examples detection BASED ON ERROR LEVEL ANALYSIS AND SPACE MAPPING 47

ADVERSARIAL EXAMPLES DETECTION BASED ON ERROR LEVEL ANALYSIS...

引用

47th IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)

作者： Huang, Sizhao Wang, Shuai Chen, Jian Li, Guozhi Wang, Wenyi Univ Elect Sci & Technol China Sch Informat & Commun Engn Chengdu Peoples R China Univ Elect Sci & Technol China Yangtze Delta Reg Inst Chengdu Peoples R China

ISBN: (纸本)9781665405409

Deep neural network (DNN) shows impressive performance on many tasks but they usually suffer from adversarial examples with human eyes invisible slight perturbation. Such examples can not be distinguished by human but can mislead DNN classifiers leading to its important role in DNN attack and defense. Many adversarial examples detection methods perform well in identifying global perturbation adversarial examples but less efficiently for local perturbation ones. We observe both global perturbation and local perturbation adversarial examples have similar BOF histogram distribution after JPEG compression and Error Level Analysis (ELA) while these distributions are clearly different to clean example's distribution. Meanwhile, researchers have found that the stability of adversarial example after space mapping is worse than that of the clean example. Therefore, we propose a two-branch architecture to detect adversarial examples based on the aforementioned strategies. Experiments show that our method has achieved better or similar performance compared to several state-of-the-art methods in terms of the detection accuracy and generation property for adversarial examples with global and local perturbation.

关键词： Global perturbation Local perturbation adversarial examples detection Generalization property

来源：评论

学校读者我要写书评

暂无评论

FEATURE DECOUPLING BASED adversarial examples detection METHOD FOR REMOTE SENSING SCENE CLASSIFICATION

FEATURE DECOUPLING BASED ADVERSARIAL EXAMPLES DETECTION METH...

引用

IEEE International Geoscience and Remote Sensing Symposium (IGARSS)

作者： Su, Yuru Mei, Shaohui Wan, Shuai Northwestern Polytech Univ Sch Elect & Informat Xian 710129 Peoples R China

ISBN: (纸本)9798350360332;9798350360325

Deep Neural Networks (DNNs) have demonstrated remarkable effectiveness in remote sensing (RS) image processing. However, they remain vulnerable to adversarial examples, which are generated by adding tiny but purposeful perturbations to clean examples. Such vulnerabilities in critical applications like environmental monitoring and urban planning can lead to significant negative consequences. To mitigate the interference of adversarial examples on DNNs, in this paper, a feature decoupling based adversarial examples detection (FD-AED) method for RS images is proposed, where non-robust features are employed in the detection process. Specifically, a loss function is designed for the decoupler to disentangle the features into robust and non-robust features. Non-robust features are particularly useful because they often contain subtle clues that distinguish between clean and adversarial examples. By focusing on these non-robust features, the adversarial example detector can more effectively capture the differences between clean and adversarial examples. Experimental results indicate that the proposed FD-AED method effectively decouples robust and non-robust features, achieving more precise and reliable detection of adversarial examples.

关键词： adversarial attacks non-robust features adversarial examples detection scene classification

来源：评论

学校读者我要写书评

暂无评论

adversarial examples detection through the sensitivity in space mappings

引用

IET COMPUTER VISION 2020年第5期14卷 201-213页

作者： Li, Xurong Ji, Shouling Ji, Juntao Ren, Zhenyu Wu, Chunming Li, Bo Wang, Ting Zhejiang Univ Dept Comp Sci & Technol Hangzhou Peoples R China Univ Illinois Dept Comp Sci Urbana IL USA Lehigh Univ Dept Comp Sci Bethlehem PA 18015 USA

adversarial examples (AEs) against deep neural networks (DNNs) raise wide concerns about the robustness of DNNs. Existing detection mechanisms are often limited to a given attack algorithm. Therefore, it is highly desirable to develop a robust detection approach that remains effective for a large group of attack algorithms. In addition, most of the existing defences only perform well for small images (e.g. MNIST and Canadian institute for advanced research (CIFAR)) rather than large images (e.g. ImageNet). In this paper, the authors propose a robust and effective defence method for analysing the sensitivity of various AEs, especially in a much harder case (large images). Their method first creates a feature map from the input space to the new feature space, by utilising 19 different feature mapping methods. Then, a detector is learned with the machine-learning algorithm to recognise the unique distribution of AEs. Their extensive evaluations on their proposed detector show that their detector can achieve: (i) low false-positive rate (<1%), (ii) high true-positive rate (higher than 98%), (iii) low overhead (<0.1 s per input), and (iv) good robustness (work well across different learning models, attack algorithms, and parameters), which demonstrate the efficacy of the proposed detector in practise.

关键词： adversarial examples detection space mappings feature mapping detection mechanisms machine learning neural nets object detection DNN feature space deep neural networks AE detection learning (artificial intelligence)

来源：评论

学校读者我要写书评

暂无评论

Robust Person Re-identification with adversarial examples detection and Perturbation Extraction 5th

Robust Person Re-identification with Adversarial Examples De...

引用

5th Chinese Conference on Pattern Recognition and Computer Vision (PRCV)

作者： Chen, Qizheng Li, Ya Ma, Yuming Guangzhou Univ Guangzhou 510006 Peoples R China

ISBN: (纸本)9783031189128;9783031189135

Person re-identification (ReID) systems, those based on deep neural networks, have been shown their vulnerability to adversarial examples, i.e. images that only added slight perturbations. In previous defense methods, those input transformations based are easy to reduce the recognition accuracy, while those adversarial examples detection based only prevent the possible adversarial samples from entering the system rather than really improving the system's robustness. In this paper, we aim to construct a robust person ReID model, which not only can defend against the adversarial attack, but also maintains the recognition accuracy. We combine the advantages of adversarial example detection and adversarial training in the model implementation. On the one hand, we propose a novel adversarial examples detection method based on perturbation information. This method not only has high detection accuracy, but also can purify the adversarial examples through a simple perturbation removal operation. On the other hand, we propose an adversarial example generation method for the matching problem, and use the adversarial examples generated by this method to extract the perturbation. That is, we train a perturbation extractor in a way like adversarial training. Experiments show the effectiveness of our method. For example, when facing Deep Mis-Ranking attack, the strongest attacker at present, our model's accuracy is greatly improved from 36.68% to 73.97% compared to previous state-of-the-art defense model. In addition, our defense method can be deployed as a plug-and-play defense solution to protect ReID systems.

关键词： Person re-identification adversarial examples detection adversarial defense Perturbation extract

来源：评论

学校读者我要写书评

暂无评论

A Framework for Robust Deep Learning Models Against adversarial Attacks Based on a Protection Layer Approach

引用

IEEE ACCESS 2024年 12卷 17522-17540页

作者： Al-Andoli, Mohammed Nasser Tan, Shing Chiang Sim, Kok Swee Goh, Pey Yun Lim, Chee Peng Univ Teknikal Malaysia Melaka Fac Informat & Commun Technol Durian Tunggal 76100 Malaysia Multimedia Univ Fac Informat Sci & Technol Melaka 75450 Malaysia Multimedia Univ Fac Engn & Technol Melaka 75450 Malaysia Deakin Univ Inst Intelligent Syst Res & Innovat Waurn Ponds Vic 3216 Australia

Deep learning (DL) has demonstrated remarkable achievements in various fields. Nevertheless, DL models encounter significant challenges in detecting and defending against adversarial samples (AEs). These AEs are meticulously crafted by adversaries, introducing imperceptible perturbations to clean data to deceive DL models. Consequently, AEs pose potential risks to DL applications. In this paper, we propose an effective framework for enhancing the robustness of DL models against adversarial attacks. The framework leverages convolutional neural networks (CNNs) for feature learning, Deep Neural Networks (DNNs) with softmax for classification, and a defense mechanism to identify and exclude AEs. Evasion attacks are employed to create AEs to evade and mislead the classifier by generating malicious samples during the test phase of DL models i.e., CNN and DNN, using the Fast Gradient Sign Method (FGSM), Basic Iterative Method (BIM), Projected Gradient Descent (PGD), and Square Attack (SA). A protection layer is developed as a detection mechanism placed before the DNN classifier to identify and exclude AEs. The detection mechanism incorporates a machine learning model, which includes one of the following: Fuzzy ARTMAP, Random Forest, K-Nearest Neighbors, XGBoost, or Gradient Boosting Machine. Extensive evaluations are conducted on the MNIST, CIFAR-10, SVHN, and Fashion-MNIST data sets to assess the effectiveness of the proposed framework. The experimental results indicate the framework's ability to effectively and accurately detect AEs generated by four popular attacking methods, highlighting the potential of our developed framework in enhancing its robustness against AEs.

关键词： Deep learning adversarial machine learning adversarial examples security adversarial attacks adversarial examples detection

来源：评论

学校读者我要写书评

暂无评论

Hierarchical Distribution-aware Testing of Deep Learning

引用

ACM TRANSACTIONS ON SOFTWARE ENGINEERING AND METHODOLOGY 2024年第2期33卷 1-35页

作者： Huang, Wei Zhao, Xingyu Banks, Alec Cox, Victoria Huang, Xiaowei Purple Mt Labs Nanjing Peoples R China Univ Liverpool Liverpool Merseyside England Univ Warwick WMG Coventry W Midlands England Def Sci & Technol Lab Salisbury Wilts England

With its growing use in safety/security-critical applications, Deep Learning (DL) has raised increasing concerns regarding its dependability. In particular, DL has a notorious problem of lacking robustness. Input added with adversarial perturbations, i.e., adversarial examples (AEs), are easily mispredicted by the DL model. Despite recent efforts made in detecting AEs via state-of-the-art attack and testing methods, they are normally input distribution-agnostic and/or disregard the perceptual quality of adversarial perturbations. Consequently, the detected AEs are irrelevant inputs in the application context or noticeably unrealistic to humans. This may lead to a limited effect on improving the DL model's dependability, as the testing budget is likely to be wasted on detecting AEs that are encountered very rarely in its real-life operations. In this article, we propose a new robustness testing approach for detecting AEs that considers both the feature-level distribution and the pixel-level distribution, capturing the perceptual quality of adversarial perturbations. The two considerations are encoded by a novel hierarchical mechanism. First, we select test seeds based on the density of feature-level distribution and the vulnerability of adversarial robustness. The vulnerability of test seeds is indicated by the auxiliary information, which are highly correlated with local robustness. Given a test seed, we then develop a novel genetic algorithm-based local test case generation method, in which two fitness functions work alternatively to control the perceptual quality of detected AEs. Finally, extensive experiments confirm that our holistic approach considering hierarchical distributions is superior to the state-of-the-arts that either disregard any input distribution or only consider a single (non-hierarchical) distribution, in terms of not only detecting imperceptible AEs but also improving the overall robustness of the DL model under testing.

关键词： Deep learning robustness adversarial examples detection natural perturbations distribution-aware testing robustness growth safe AI

来源：评论

学校读者我要写书评

暂无评论

Increasing the Confidence of Deep Neural Networks by Coverage Analysis

引用

IEEE TRANSACTIONS ON SOFTWARE ENGINEERING 2023年第2期49卷 802-815页

作者： Rossolini, Giulio Biondi, Alessandro Buttazzo, Giorgio Scuola Superiore Sant Anna Dept Excellence Robot & AI I-56127 Pisa Italy

The great performance of machine learning algorithms and deep neural networks in several perception and control tasks is pushing the industry to adopt such technologies in safety-critical applications, as autonomous robots and self-driving vehicles. At present, however, several issues need to be solved to make deep learning methods more trustworthy, predictable, safe, and secure against adversarial attacks. Although several methods have been proposed to improve the trustworthiness of deep neural networks, most of them are tailored for specific classes of adversarial examples, hence failing to detect other corner cases or unsafe inputs that heavily deviate from the training samples. This paper presents a lightweight monitoring architecture based on coverage paradigms to enhance the model robustness against different unsafe inputs. In particular, four coverage analysis methods are proposed and tested in the architecture for evaluating multiple detection logic. Experimental results show that the proposed approach is effective in detecting both powerful adversarial examples and out-of-distribution inputs, introducing limited extra-execution time and memory requirements.

关键词： Neural networks coverage DNNs robustness adversarial examples detection

来源：评论

学校读者我要写书评

暂无评论

Detecting adversarial examples via Reconstruction-based Semantic Inconsistency 24

Detecting Adversarial Examples via Reconstruction-based Sema...

引用

ACM Turing Award Celebration Conference (ACM-TURC)

作者： Zhang, Chi Zhou, Wenbo Zhang, Kui Zhang, Jie Zhang, Weiming Yu, Nenghai Univ Sci & Technol China Hefei Peoples R China Nanyang Technol Univ Singapore Singapore

ISBN: (纸本)9798400710117

adversarial attacks have been demonstrated a huge threat to the field of artificial intelligence security. To address it, adversarial training is proposed, but it requires a high computation cost and will degrade the original performance. For easy deployment, some detection solutions have emerged. However, most existing methods mainly leverage the vulnerability of adversarial perturbation against input-level processing and differences in distribution such as reconstruction or bit reduction, but it is difficult for them to detect attacks with different perturbation patterns and strengths. To address it, a very recent method, ContraNet, leverages the victim model's prediction to guide the input reconstruction, but this will decrease the detection rate on clean images. This paper also focuses on input-reconstruction but utilizes semantic similarity comparison. Different from ContraNet, we attempt to amplify the semantic inconsistency between the adversarial example and its reconstruction format based on the intrinsic features of the target classifier. In other words, this paper proposes a reconstruction-based detection via intrinsic features of the classifier to explore adversarial examples from the perspective of the target classifier rather than the distribution in pixel space perceived by humans. Based on this, a feature extractor can be learned in unsupervised learning through a modified SimCLR to perform semantic extraction, while the reconstruction of adversarial examples has inconsistent semantic information on the pixels, thus distinguishing clean samples and AEs. Our method can effectively defend against various disturbances and different types of attacks, maintaining a high detection robustness accuracy, and a high clean detection rate.

关键词： adversarial examples detection reconstruction semantic inconsistency

来源：评论

学校读者我要写书评

暂无评论

A Novel adversarial detection Method for UAV Vision Systems via Attribution Maps

引用

DRONES 2023年第12期7卷

作者： Zhang, Zhun Liu, Qihe Wu, Chunjiang Zhou, Shijie Yan, Zhangbao Univ Elect Sci & Technol China Sch Informat & Software Engn Chengdu 610054 Peoples R China

With the rapid advancement of unmanned aerial vehicles (UAVs) and the Internet of Things (IoTs), UAV-assisted IoTs has become integral in areas such as wildlife monitoring, disaster surveillance, and search and rescue operations. However, recent studies have shown that these systems are vulnerable to adversarial example attacks during data collection and transmission. These attacks subtly alter input data to trick UAV-based deep learning vision systems, significantly compromising the reliability and security of IoTs systems. Consequently, various methods have been developed to identify adversarial examples within model inputs, but they often lack accuracy against complex attacks like C&W and others. Drawing inspiration from model visualization technology, we observed that adversarial perturbations markedly alter the attribution maps of clean examples. This paper introduces a new, effective detection method for UAV vision systems that uses attribution maps created by model visualization techniques. The method differentiates between genuine and adversarial examples by extracting their unique attribution maps and then training a classifier on these maps. Validation experiments on the ImageNet dataset showed that our method achieves an average detection accuracy of 99.58%, surpassing the state-of-the-art methods.

关键词： UAVs vision systems adversarial examples detection deep learning attribution map

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：