论文标题
通过基于密钥转换的图像训练的模型合奏
Ensemble of Models Trained by Key-based Transformed Images for Adversarially Robust Defense Against Black-box Attacks
论文作者
论文摘要
我们提出了通过使用块的转换图像和秘密钥匙进行训练的模型的投票合奏，以进行对抗性强大的防御。证明基于密钥的对抗防御能够超过针对基于梯度的（白色框）攻击的最先进防御能力。但是，基于密钥的防御措施在不需要任何秘密密钥的情况下对无梯度（黑框）攻击的有效性不够。因此，我们旨在通过使用模型的投票集合来增强针对黑盒攻击的鲁棒性。在拟议的合奏中，通过使用用不同的键和块大小转换的图像来训练许多模型，然后将投票合奏应用于模型。在图像分类实验中，证明了拟议的辩护以捍卫最新的攻击。拟议的防御能力达到95.56％的干净准确性，在攻击下，攻击成功率在CIFAR-100数据集上的噪声距离为8/255。
We propose a voting ensemble of models trained by using block-wise transformed images with secret keys for an adversarially robust defense. Key-based adversarial defenses were demonstrated to outperform state-of-the-art defenses against gradient-based (white-box) attacks. However, the key-based defenses are not effective enough against gradient-free (black-box) attacks without requiring any secret keys. Accordingly, we aim to enhance robustness against black-box attacks by using a voting ensemble of models. In the proposed ensemble, a number of models are trained by using images transformed with different keys and block sizes, and then a voting ensemble is applied to the models. In image classification experiments, the proposed defense is demonstrated to defend state-of-the-art attacks. The proposed defense achieves a clean accuracy of 95.56 % and an attack success rate of less than 9 % under attacks with a noise distance of 8/255 on the CIFAR-10 dataset.
