论文标题
要对文本到图像检索进行特洛伊木马攻击
Towards Making a Trojan-horse Attack on Text-to-Image Retrieval
论文作者
论文摘要
据报道，基于深度学习的图像检索容易受到对抗性攻击的攻击，但现有作品主要是在图像到图像检索上，其攻击通过查询修改在前端进行。相比之下，我们在本文中介绍了关于文本对图检索（T2IR）系统后端发生的威胁的第一项研究。我们的研究的激励是，由于来自Web爬网和广告商等各种来源的新图像的到来，该系统索引的图像收集将定期更新。有了索引恶意图像，攻击者可能会间接干扰检索过程，让用户看到某些完全无关的W.R.T.他们的疑问。我们提出了一种新颖的特洛伊马 - 马攻击（THA），将这种想法付诸实践。特别是，我们首先将特定于单词的对抗信息嵌入QR码，然后将代码放在良性广告图像上，构建一组Trojan-Horse图像。在两个流行的T2IR数据集（Flickr30k和MS-Coco）上进行的概念验证评估显示了在白盒模式下提出的THA的有效性。
While deep learning based image retrieval is reported to be vulnerable to adversarial attacks, existing works are mainly on image-to-image retrieval with their attacks performed at the front end via query modification. By contrast, we present in this paper the first study about a threat that occurs at the back end of a text-to-image retrieval (T2IR) system. Our study is motivated by the fact that the image collection indexed by the system will be regularly updated due to the arrival of new images from various sources such as web crawlers and advertisers. With malicious images indexed, it is possible for an attacker to indirectly interfere with the retrieval process, letting users see certain images that are completely irrelevant w.r.t. their queries. We put this thought into practice by proposing a novel Trojan-horse attack (THA). In particular, we construct a set of Trojan-horse images by first embedding word-specific adversarial information into a QR code and then putting the code on benign advertising images. A proof-of-concept evaluation, conducted on two popular T2IR datasets (Flickr30k and MS-COCO), shows the effectiveness of the proposed THA in a white-box mode.
