蒋志文 郑怡亭 邓娇 张宜放

摘要：深度学习算法在很多领域取得了卓越的成就，但同时也容易受到对抗样本的攻击。使用对抗样本训练模型是抵御模型被攻击的有效手段，但这需要大量对抗样本的支持。为了提升对抗样本的生成效率，本文提出了一种基于抽样向量扰动的对抗样本生成方法（SPVT）。实验结果表明，该方法可以在短时间内生成大量有效对抗样本，并且能够自适应计算出FGSM算法的扰动幅度，并且和人为设定参数的FGSM算法相比对抗成功率提升了0.77%;生成相同数量的对抗样本，SPVT方法与DeepFool算法相比能够节约1/6的时间，解决了对抗样本生成效率不高的问题。

关键词： 对抗样本;深度学习;白盒攻击

Abstract： The deep learning algorithm has achieved remarkable achievements in many fields， but it is also vulnerable to adversarial examples. Adversarial training is an effective means to improve the robustness of deep learning models， but it needs a large number of adversarial examples. In order to improve the efficiency of generating adversarial examples， this paper proposes SPVT method that based on sample vector perturbation. Firstly， sampling from the test dataset and use an optimized based generation algorithm to calculate the perturbation vectors; Secondly， transform the perturbation vectors into the disturbance amplitude; Finally， using a gradient-based generation algorithm to generate a large number of adversarial examples. The experimental results show that SPVT can generate a large number of effective adversarial examples in a short time， and it can adapt the disturbance amplitude of FGSM， which has 0.77% higher success rate than that of FGSM with artificial parameters. When generating the same number of counter samples， SPVT method can save 1/6 of times compared with Deepfool， which solves the problem of low efficiency of adversarial examples generation problems.

Key words： adversarial example; deep learning; robustness of model

1前言

深度學习是人工智能的一个重要分支，被广泛地运用于计算机视觉和图像识别等领域，如人脸识别[1]和图片分类预测[2]等。在深度学习技术在生产和生活等领域普及的同时，其本身的安全性问题也越来越受到研究者的关注。目前CNN等深度学习模型在图像分类问题上的应用和效果表现得尤为突出，但这些高性能的图像分类器在面对对抗样本攻击的时候却暴露了其脆弱性。这些攻击深度学习模型的对抗样本只是在原始的输入图片上加入了微小量的像素扰动，却能够导致模型无法获得最终正确的分类结果，从而让对抗样本攻击对图像分类系统产生巨大的危害[3]，因此构造高鲁棒性的深度学习模型具有重要的研究意义。……