基于Perlin增强与随机变换的黑盒攻击方法  

A Black-Box Attack Method Based on Perlin Enhancement and Random Transformation

作　　者：张朝阳 李晖[1] ZHANG Zhaoyang;LI Hui(School of Information Science and Engineering,Shenyang University of Technology,Shenyang 110870,China)

机构地区：[1]沈阳工业大学信息科学与工程学院,沈阳110870

出　　处：《微处理机》2023年第5期31-34,共4页Microprocessors

摘　　要：当前基于迁移性的黑盒攻击通常使用较高扰动系数生成具有较强可迁移性的对抗样本,导致对抗扰动较易被防御者察觉,针对此问题,提出一种基于Perlin增强与随机变换的黑盒攻击方法。方法利用Perlin噪声对干净样本进行数据增强,同时使用增强后的数据集和随机尺度与填充运算来改进现有的基于平移不变的对抗样本生成方法,以降低对抗样本的黑盒攻击能力与扰动系数的耦合程度。在ImageNet数据集中的实验结果表明,通过优化后的对抗攻击在不修改扰动系数的情况下增强了对抗样本的可迁移性。At present,black-box attacks based on transferability usually use high disturbance coeffi-cient to generate adversarial examples with strong transferability,which makes adversarial disturbance easier to be detected by defenders.To solve this problem,a black-box attack method based on Perlin enhancement and random transformation is proposed.By using Perlin noise,the method enhances the data of clean examples,and at the same time,it uses the enhanced data set and random scale and filling opera-tion to improve the existing translation-invariant adversarial examples generation method,so as to reduce the coupling degree between the black-box attack ability and the disturbance coefficient of adversarial examples.The experimental results in ImageNet data set show that the transferability of adversarial exam-ples is enhanced by the optimized adversarial attack without modifying the disturbance coefficient.

关 键 词：黑盒攻击 数据增强 对抗样本 可迁移性 优化方法 

分 类 号：TP391.41[自动化与计算机技术—计算机应用技术]