arXiv:2411.06666cs.AI2024-11被引 2

用动态稳定性检测对抗样本,准确率超现有方法。

Adversarial Detection with a Dynamically Stable System

  • 将对抗样本生成视为李雅普诺夫系统扰动,设计稳定机制
  • 在三个数据集上达94.47%以上ROC-AUC,优于当前最优
  • 适合需要高可靠性对抗检测的模型安全场景

对抗检测旨在识别并拒绝由恶意构造的对抗样本,这些样本旨在干扰目标模型的分类。目前基于输入变换的方法多依赖经验,对新攻击缺乏可靠性。为此,本文提出并构建了动态稳定系统(DSS),通过输入样本的稳定性来有效区分对抗样本与正常样本。具体而言,将对抗样本生成视为李雅普诺夫动态系统的扰动过程,提出一种示例稳定性机制:在对抗样本生成中引入新型控制项,使正常样本可实现动态稳定,而对抗样本无法实现。基于该机制,设计出动态稳定系统(DSS),利用扰动与恢复动作判断输入样本的稳定性,通过稳定性变化检测对抗样本。在MNIST、CIFAR10和CIFAR100三个基准数据集上的实验表明,所提DSS分别取得99.83%、97.81%和94.47%的ROC-AUC,超越其他7种方法的当前最优结果(97.35%、91.10%和93.49%)。

原文摘要 · Abstract (English)

Adversarial detection is designed to identify and reject maliciously crafted adversarial examples(AEs) which are generated to disrupt the classification of target models. Presently, various input transformation-based methods have been developed on adversarial example detection, which typically rely on empirical experience and lead to unreliability against new attacks. To address this issue, we propose and conduct a Dynamically Stable System (DSS), which can effectively detect the adversarial examples from normal examples according to the stability of input examples. Particularly, in our paper, the generation of adversarial examples is considered as the perturbation process of a Lyapunov dynamic system, and we propose an example stability mechanism, in which a novel control term is added in adversarial example generation to ensure that the normal examples can achieve dynamic stability while the adversarial examples cannot achieve the stability. Then, based on the proposed example stability mechanism, a Dynamically Stable System (DSS) is proposed, which can utilize the disruption and restoration actions to determine the stability of input examples and detect the adversarial examples through changes in the stability of the input examples. In comparison with existing methods in three benchmark datasets(MNIST, CIFAR10, and CIFAR100), our evaluation results show that our proposed DSS can achieve ROC-AUC values of 99.83%, 97.81% and 94.47%, surpassing the state-of-the-art(SOTA) values of 97.35%, 91.10% and 93.49% in the other 7 methods.

对抗检测动态系统稳定性机制

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。