高级检索
    刘昊, 张泽辉, 夏晓帆, 高铁杠. 一种基于几何探测的快速黑盒边界攻击算法[J]. 计算机研究与发展, 2023, 60(2): 435-447. DOI: 10.7544/issn1000-1239.202110991
    引用本文: 刘昊, 张泽辉, 夏晓帆, 高铁杠. 一种基于几何探测的快速黑盒边界攻击算法[J]. 计算机研究与发展, 2023, 60(2): 435-447. DOI: 10.7544/issn1000-1239.202110991
    Liu Hao, Zhang Zehui, Xia Xiaofan, Gao Tiegang. A Fast Black Box Boundary Attack Algorithm Based on Geometric Detection[J]. Journal of Computer Research and Development, 2023, 60(2): 435-447. DOI: 10.7544/issn1000-1239.202110991
    Citation: Liu Hao, Zhang Zehui, Xia Xiaofan, Gao Tiegang. A Fast Black Box Boundary Attack Algorithm Based on Geometric Detection[J]. Journal of Computer Research and Development, 2023, 60(2): 435-447. DOI: 10.7544/issn1000-1239.202110991

    一种基于几何探测的快速黑盒边界攻击算法

    A Fast Black Box Boundary Attack Algorithm Based on Geometric Detection

    • 摘要: 随着深度学习应用的愈发广泛,针对深度学习模型的安全性研究也变得至关重要.在商业应用中,深度学习的模型往往处于应用的底层,一旦对底层模型攻击成功,可能会给商业应用带来巨大的损失.好的攻击算法可以很好的对深度学习模型进行风险评估,从而避免损失.针对实际场景中存在的Hard-label问题,现存算法解决此问题都需要上万次查询,具有很高的攻击成本,提出了FastGBA(fast geometric boundary attack)攻击算法:一种在样本空间内针对决策边界进行几何探测的攻击算法,初始从具有较大扰动的对抗样本出发,进行二分逼近至决策边界附近,最终在决策边界附近进行邻域几何探测来缩短样本距离.FastGBA攻击算法在4个深度学习模型上同SurFree攻击算法以及HSJA(hop skip jump attack)攻击算法进行了对比实验,在查询次数不超过500次,中等扰动(L2距离 \leqslant 10)的限制条件下,攻击成功率在4个深度学习模型上相较于SurFree攻击算法提升了14.5% ~ 24.4%,相较于HSJA攻击算法提升了28.9% ~ 36.8%.

       

      Abstract: As DL(deep learning) has been widely used in various fields, the security research on deep learning model has become a very important research spot. In practical business, the deep learning model is often the core component of the application. Once the attack on the model is successful, it may bring huge business losses. A good attack algorithm can well expose potential risks for the DL-based models and avoid loss. For the Hard-label problem, the existing attack algorithms often need tens of thousands of queries to solve this problem, and the attack cost is high. To solve this problem, FastGBA(fast geometric boundary attack) algorithm is proposed. FastGBA is an attack method for geometric detection of decision boundary within sample space. Starting from the adversarial samples with large disturbance, the binary search is carried out near the decision boundary, and finally the neighborhood geometric detection is carried out near the decision boundary to shorten the sample distance. Our proposed attack algorithm are compared with SurFree and HSJA(hop skip jump attack) attack algorithms on four different deep learning models. Under the restriction of no more than 500 queries and medium disturbance (L2 distance is less than 10), the attack success rate are improved by 14.5%−24.4% compared with SurFree attack algorithm and 28.9%−36.8% compared with HSJA attack algorithm on the four deep learning models.

       

    /

    返回文章
    返回