基于决策的目标检测器黑盒对抗攻击方法

Decision-based Black Box Adversarial Attack Method for Target Detector

摘要:

深度神经网络在目标检测领域有大量的应用已经落地，然而由于深度神经网络本身存在不可解释性等技术上的不足，导致其容易受到外界的干扰而失效，充分研究对抗攻击方法有助于挖掘深度神经网络易失效的原因以提升其鲁棒性。目前大多数对抗攻击方法都需要使用模型的梯度信息或模型输出的置信度信息，而工业界应用的目标检测器通常不会完全公开其内部信息和置信度信息，导致现有的白盒攻击方法不再适用。为了提升工业目标检测器的鲁棒性，提出一种基于决策的目标检测器黑盒对抗攻击方法，其特点是不需要使用模型的梯度信息和置信度信息，仅利用目标检测器输出的检测框位置信息，策略是从使目标检测器定位错误的角度进行攻击，通过沿着对抗边界进行迭代搜索的方法寻找最优对抗样本从而实现高效的攻击。实验结果表明所提出的方法使典型目标检测器Faster R-CNN在VOC2012数据集上的mAR从0.636降低到0.131，mAP从0.801降低到0.071，有效降低了目标检测器的检测能力，成功实现了针对目标检测器的黑盒攻击。

Abstract:

Deep neural network has been widely applied in the field of object detection. However, due to the poor interpretability and other technical deficiencies of deep neural network, it is easy to be invalidated by external interference. Full research on adversarial attack methods is helpful to explore the reasons for the invalidation of deep neural network and improve its robustness. At present, most of the adversarial attack methods need to use the gradient information of the model or the confidence information of the model output, but the object detectors used in the industry usually do not fully disclose their internal information and confidence information, so the existing white box attack methods are no longer applicable. To enhance the robustness of industrial object detector, this paper proposes a decision-based black box adversarial attack method for object detector. The characteristics of this method does not need to use gradient information and confidence information of the model, only the use of the object detector output detection box position information. The strategy of this method is to make the object detector locate wrong and attacks it, and to find the optimal adversarial examples by iterative search along the adversarial boundary so as to achieve efficient attack. Experimental results show that the proposed method reduces mAR from 0.636 to 0.131 and mAP from 0.801 to 0.071 on VOC2012 data set of typical object detector Faster R-CNN, effectively reducing the detection ability of object detector and successfully achieving black box attack on the object detector.