Adversarial Attacks with the Use of Different Gradient-based Methods

Shuming Shi ； Fengyang Weng ； Yicheng Zhang ； Yunquan Zhang

《International Core Journal of Engineering》 8卷2期 (2022/02) Pp. 303-312

https://doi.org/10.6919/ICJE.202202_8(2).0038

摘要

Image classification is an important part of image processing and has been widely used in various fields. Using deep neural networks developed in recent years to perform image classification has been proved to be efficient, which results in relatively high classification accuracy. However, deep neural networks are vulnerable to adversarial examples. These adversarial examples can interfere with the classifier by adding some imperceptible disturbances and finally mislead the classifiers. Predecessors have proposed several attack methods to craft adversarial examples. In this article, we first study the effectiveness of gradient-based attack methods (BIM, MI-FGSM, DI-FGSM, and TI-FGSM), under different perturbation and models (VGG16, ResNet18, ResNet50, Inception_V3, and DenseNet121). Then, we use the adversarial examples obtained in the first experiment (ϵ= 16) to test their transferability under different models. The results in the first experiment show that the effectiveness of all attack methods increases with the augment of perturbation ε. When ε = 2, ResNet18 misclassifies the most, followed by ResNet50 and then DenseNet121 and VGG16, while Inception_V3 misclassifies the least, which proves that InceptionV3 and VGG16 are less sensitive to disturbances than other models. Besides, in the second experiment, the results show that the success classification accuracy among the above five models using BIM is the highest, followed by MI-FGSM, DI-FGSM, and the success classification accuracy using TI-FGSM is the lowest, which proves that the generated adversarial example using TI-FGSM has the best transferability; while the generated adversarial example using BIM has the poorest transferability.

關鍵字

Adversarial Attacks ； Image Classification ； Deep Neural Networks

參考文獻

A. Arnab, O. Miksik, and P. H. Torr. On the robustness of semantic segmentation models to adversarial attacks. arXiv preprint arXiv:1711.09856, 2017.

Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In ICLR, 2016.

Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren and Alan Yuille. Improving Transferability of Adversarial Examples with Input Diversity. In CVPR, 2019.

Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In CVPR, 2018. 1.

Yinpeng Dong, Tianyu Pang, Hang Su and Jun Zhu. Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks. In CVPR, 2019. 1.