通过分析攻击对网络层的非均匀影响,高效检测对抗样本。
Universal and Efficient Detection of Adversarial Data through Nonuniform Impact on Network Layers
- 用轻量回归模型预测深层特征,基于预测误差检测对抗样本。
- 在多种数据类型上检测准确率超95%,推理延迟低于1毫秒。
- 无需修改主模型,适配任意网络架构,适合实时系统部署。
深度神经网络(DNN)对带有微小扰动的对抗输入极为敏感。尽管已有大量针对原始输入进行细微修改的攻击方法被提出,但相应的防御技术仍相对不足。现有防御方法要么通过增强DNN鲁棒性来抵消扰动影响,要么使用辅助模型检测对抗样本。本文关注更具实用价值的检测方法,指出当前检测手段或对先进攻击无效,或计算开销过大难以实时处理。为此,我们提出一种新型通用且高效的对抗样本检测方法:通过分析攻击对不同网络层造成的影响差异。该方法训练一个轻量级回归模型,从浅层特征预测深层特征,并利用预测误差识别对抗样本。通过理论论证与大量实验,证明该方法在图像、视频和音频等多领域均表现优异,具备高检测精度、极低延迟、与任意DNN架构兼容的特点,适用于实时系统。
原文摘要 · Abstract (English)
Deep Neural Networks (DNNs) are notoriously vulnerable to adversarial input designs with limited noise budgets. While numerous successful attacks with subtle modifications to original input have been proposed, defense techniques against these attacks are relatively understudied. Existing defense approaches either focus on improving DNN robustness by negating the effects of perturbations or use a secondary model to detect adversarial data. Although equally important, the attack detection approach, which is studied in this work, provides a more practical defense compared to the robustness approach. We show that the existing detection methods are either ineffective against the state-of-the-art attack techniques or computationally inefficient for real-time processing. We propose a novel universal and efficient method to detect adversarial examples by analyzing the varying degrees of impact of attacks on different DNN layers. {Our method trains a lightweight regression model that predicts deeper-layer features from early-layer features, and uses the prediction error to detect adversarial samples.} Through theoretical arguments and extensive experiments, we demonstrate that our detection method is highly effective, computationally efficient for real-time processing, compatible with any DNN architecture, and applicable across different domains, such as image, video, and audio.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。