论文标题
模糊的愚人网络 - 通过特征峰抑制和高斯模糊的对抗性攻击
Blurring Fools the Network -- Adversarial Attacks by Feature Peak Suppression and Gaussian Blurring
论文作者
论文摘要
在实际情况下，现有的像素级对抗性攻击可能会缺乏，因为在摄像机捕获和多个图像预处理步骤之后，数据上的像素级更改无法完全传递到神经网络。相反，在本文中，我们从另一个角度说，高斯模糊的图像预处理技术可以在特定场合具有侵略性，从而使网络暴露于现实世界中的对抗性攻击。我们首先通过抑制数据特征中的峰值元素值来提出一个名为峰抑制（PS）的对抗攻击演示。基于PS的模糊精神，我们进一步将高斯模糊应用于数据，以研究高斯模糊网络性能的潜在影响和威胁。实验结果表明，PS和精心设计的高斯模糊可以形成对抗性攻击，从而完全改变训练有素的目标网络的分类结果。凭借高斯模糊的强大意义和广泛的应用，拟议的方法也将能够进行现实世界的攻击。
Existing pixel-level adversarial attacks on neural networks may be deficient in real scenarios, since pixel-level changes on the data cannot be fully delivered to the neural network after camera capture and multiple image preprocessing steps. In contrast, in this paper, we argue from another perspective that gaussian blurring, a common technique of image preprocessing, can be aggressive itself in specific occasions, thus exposing the network to real-world adversarial attacks. We first propose an adversarial attack demo named peak suppression (PS) by suppressing the values of peak elements in the features of the data. Based on the blurring spirit of PS, we further apply gaussian blurring to the data, to investigate the potential influence and threats of gaussian blurring to performance of the network. Experiment results show that PS and well-designed gaussian blurring can form adversarial attacks that completely change classification results of a well-trained target network. With the strong physical significance and wide applications of gaussian blurring, the proposed approach will also be capable of conducting real world attacks.
