L1-Norm Based Adversarial Example against CNN

為了構建由深度神經網路訓練的機器學習模型，且此模型還必須兼具穩定性和可靠性，抵抗捍衛對抗樣本(即在自然圖片上加上敵對擾動)，近年來已經成為深度學習和安全性相結合的新興研究領域。由探測器和圖片重組器組成的MagNet，是迄今為止黑箱環境中最強大的防禦之一。攻擊者的目標是製作一個不受防護的深度神經網路模型的可轉移對抗樣本，繞過防禦模組讓防禦模組不知道對抗樣本的存在。 MagNet可以成功防禦針對深度神經網路中的各種攻擊，包括基於Carlini和Wagner所提出的L2失真度量轉移攻擊。本文使用兩種受歡迎的圖像集─MNIST和CIFAR-10，在黑箱攻擊的設定下，我們展示基於L1失真度量所製作的對抗樣本，可輕鬆繞過MagNet並欺騙目標深度神經網路圖片分類器。我們還提供了理論上的解釋，說明為什麼所考慮的方法可以產生具有優異攻擊轉移能力的對抗樣本，並對MagNet進行大量實驗以驗證其對基於L1失真轉移攻擊的可靠性缺乏。我們的結果大大削弱了現有的轉移攻擊假設，即在攻擊防禦深度神經網路（即在灰箱設定下）時已知部署防禦技術。In recent years, defending adversarial perturbations to natural examples in order to build robust machine learning models trained by deep neural networks (DNNs) has become an emerging research field in the conjunction of deep learning and security. In particular, MagNet consisting of an adversary detector and a data reformer is by far one of the strongest defenses in the black-box setting, where the attacker aims to craft transferable adversarial examples from an undefended DNN model to bypass a defense module without knowing its existence. MagNet can successfully defend a variety of attacks in DNNs, including the Carlini and Wagner''s transfer attack based on the L2 distortion metric. However, in this thesis, under the black-box transfer attack setting we show that adversarial examples crafted based on the L1 distortion metric can easily bypass MagNet and fool the target DNN image classifiers on MNIST and CIFAR-10. We also provide theoretical justification on why the considered approach can yield adversarial examples with superior attack transferability and conduct extensive experiments on variants of MagNet to verify its lack of robustness to L1 distortion based transfer attacks. Notably, our results substantially weaken the existing transfer attack assumption of knowing the deployed defense technique when attacking defended DNNs (i.e., the gray-box setting).摘要 i Abdtract ii Contents iii List of Figures iv List of Tables vi Chapter 1 Introduction 1 Chapter 2 Background and related work 5 2.1 MagNet: Defending Adversarial Examples using Reformer and Detector 5 2.2 EAD: Elastic-Net Attacks to DNNs 5 Chapter 3 Experiments 8 3.1 Experiment Setup, Parameter Setting and Threat Model 8 3.2 Performance Evaluation of Oblivious Attacks on MagNet 9 3.2.1 MagNet with default setting on MNIST 9 3.2.2 EAD attack on robust MagNet on MNIST 12 3.2.3 Default MagNet on CIFAR-10 14 3.2.4 EAD attack on robust MagNet on CIFAR-10 14 3.2.5 Complete defense performance plots of MagNet 16 Chapter 4 Conclusion and Discussion 25 References 2