期刊
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY
卷 17, 期 -, 页码 373-385出版社
IEEE-INST ELECTRICAL ELECTRONICS ENGINEERS INC
DOI: 10.1109/TIFS.2021.3138616
关键词
Computational and artificial intelligence; neural networks; feedforward neural network; multi-layer neural network; signal processing; quantization (signal)
资金
- Direction Generale de l'Armement, French, under the Ministry for the Armed Forces
- French National Research Agency under the ALASKA Project [ANR-18-ASTR-0009]
- French Agence Innovation pour la Defense under the chaire Security of Artificial Intelligence for Defense Applications (SAIDA) [ANR-20-CHIA-0011-01]
- challenge DEtection de FALSifications dans des images et videos (DEFALS) Program [ANR-16-DEFA-0003]
- Agence Nationale de la Recherche (ANR) [ANR-20-CHIA-0011] Funding Source: Agence Nationale de la Recherche (ANR)
This paper proposes a method dedicated to quantizing adversarial perturbations while minimizing quantization error and maintaining image adversarial after quantization. The method operates in both spatial and JPEG domains with low complexity.
Many adversarial attacks produce floating-point tensors which are no longer adversarial when converted to raster or JPEG images due to rounding. This paper proposes a method dedicated to quantize adversarial perturbations. This smart quantization is conveniently implemented as versatile post-processing. It can be used on top of any white-box attack targeting any model. Its principle is tantamount to a constrained optimization problem aiming to minimize the quantization error while keeping the image adversarial after quantization. A Lagrangian formulation is proposed and an appropriate search of the Lagrangian multiplier enables to increase the success rate. We also add a control mechanism of the l(infinity)-distortion. Our method operates in both spatial and JPEG domains with little complexity. This study shows that forging adversarial images is not a hard constraint: our quantization does not introduce any extra distortion. Moreover, adversarial images quantized as JPEG also challenge defenses relying on the robustness of neural networks against JPEG compression.
作者
我是这篇论文的作者
点击您的名字以认领此论文并将其添加到您的个人资料中。
推荐
暂无数据