基于动量的映射式梯度下降算法  

Projected Gradient Descent Algorithm with Momentum

作　　者：吴子斌 闫巧[1] WU Zi-bin;YAN Qiao(College of Computer Science&Software Engineering,Shenzhen University,Shenzhen,Guangdong 518060,China)

机构地区：[1]深圳大学计算机与软件学院,广东深圳518060

出　　处：《计算机科学》2022年第S01期178-183,共6页Computer Science

基　　金：国家自然科学基金面上项目(61976142)。

摘　　要：近年来,深度学习已被广泛应用于计算机视觉问题中,并取得了卓越的成功。但研究人员发现神经网络容易受到添加微弱扰动的原始样本的干扰,导致模型给出一个错误的输出,这类输入样本称为“对抗样本”。目前已有一系列生成对抗样本的算法被提出。针对已有的对抗样本生成算法——映射式梯度下降算法(Projected Gradient Descent),提出了结合动量并采用新的损失函数的改进方法MPGD;算法,以确保更新方向的稳定且避免不良局部最大值的出现,同时避免交叉熵损失函数可能出现的梯度消失情况。通过与包含3种架构4个鲁棒模型的实验,证实了所提MPGD;算法具有更优的攻击效果和更强的攻击迁移性。In recent years,deep learning is widely used in the field of computer vision and has achieved outstanding success.However,the researchers found that the neural network is easily disturbed by adding subtle perturbations in the dataset,that can cause the model to give incorrect outputs.Such input examples are called“adversarial examples”.At present,a series of algorithms for generating adversarial examples have emerged.Based on the existing adversarial sample generation algorithm-projected gradient descent(PGD),this paper proposes an improved method-MPGD;algorithm,which combines momentum and adopts a new loss function to ensure the stability of the update direction and avoid bad local maximums.At the same time,it can avoid the disappearance of the gradient by replacing the cross-entropy loss function.Experiments on 4 robust models containing 3 architecturesconfirm that the proposed MPGD;algorithm has better attack effect and stronger transfer attack capacity.

关 键 词：深度学习 卷积神经网络 图像对抗样本 对抗攻击 

分 类 号：TP391.41[自动化与计算机技术—计算机应用技术] TP18[自动化与计算机技术—计算机科学与技术]