针对目标检测的隐蔽式对抗扰动生成方法

Stealthy adversarial perturbation generation method for object detection

摘要:

针对现有面向目标检测的白盒攻击方法在不可察觉性上的不足,从扰动生成过程与扰动成本的限制两方面,提出一种隐蔽式对抗扰动生成方法(stealthy adversarial perturbation generation,SPG)。 该方法首先利用图像的纹理信息,赋予扰动在难以被人眼察觉的高纹理区域更高的权重,然后采用扰动位置选取策略降低修改的像素点数目,最后进行对抗扰动的解耦计算,自适应地搜索具有最佳L₂范数度量的对抗扰动。所提方法以4种主流目标检测器作为攻击对象,在COCO-MS 2014和PASCAL-VOC数据集上与对比方法进行了评估。实验结果表明,本文攻击方法的不可察觉性的度量值优于对比方法,其生成的对抗扰动具有低于0.239的L₀范数和2.9×10-5以内的L₂范数,同时使得目录检测器的mAP降低至9%以下。

Abstract:

To address the shortcomings of the current white-box adversarial attacks against object detection about imperceptibility,this paper proposes a stealthy adversarial perturbations generation (SPG) method from the perspective of both generation process and the limitation of perturbations cost.First,the perturbations in the high-texture region of images which is hard to detected by human eyes are assigned a higher weight by texture information.Then,a perturbations position selection strategy is applied to reduce the number of improved perturbed pixels.Finally,these adversarial perturbations are decoupled to adaptively search for the best L₂ norm metric.The proposed method and comparative methods are evaluated on the MS-COCO 2014 and PASCAL-VOC datasets against 4 dominant object detectors.Experimental results show that the metric value of imperceptibility of this method is greater than that of other methods.The mAP of the object detectors is degraded to below 9%.The L₀ norm is less than 0.239,and the L₂ norm of adversarial perturbations is less than 2.9×10-5 respectively.