论文标题
Gracias：玻璃曼尼亚的损坏图像的对抗安全
GraCIAS: Grassmannian of Corrupted Images for Adversarial Security
论文作者
论文摘要
基于输入转换的防御策略在防御强烈的对抗攻击方面缺乏。一些成功的防御能力采用的方法可以增加所应用转换内的随机性，或者使国防部计算的强化程度更大，从而使攻击者更具挑战性。但是，它限制了此类防御能力作为预处理步骤的适用性，类似于使用重新训练和网络修改以实现扰动性的计算沉重方法。在这项工作中，我们提出了一种防御策略，将随机图像腐败应用于输入图像，构建基于自相关的子空间，然后进行投影操作，以抑制对抗性扰动。由于其简单性，与最先进的防御能力相比，所提出的防御在计算上是有效的，但可以承受巨大的扰动。此外，我们通过将Grassmannian上的地球距离与Matrix Frobenius Norms相关的边界之间的界限开发出了干净图像的投影操作员与其对抗性扰动版本之间的接近关系。我们从经验上表明，我们的战略与JPEG压缩等其他弱防御能力相辅相成，并且可以与他们无缝集成以创造更强大的防御能力。我们在图像网络数据集上进行了四种不同模型的广泛实验，即InceptionV3，Resnet50，VGG16和Mobilenet模型设置为ε= 16。与最先进的方法不同，即使没有进行任何重新培训，提议的策略即使没有任何重新提高〜4.5％的防御精度，在Imagenet上的绝对提高了Imagenet On ImageNet on ImageNet上的绝对改善。
Input transformation based defense strategies fall short in defending against strong adversarial attacks. Some successful defenses adopt approaches that either increase the randomness within the applied transformations, or make the defense computationally intensive, making it substantially more challenging for the attacker. However, it limits the applicability of such defenses as a pre-processing step, similar to computationally heavy approaches that use retraining and network modifications to achieve robustness to perturbations. In this work, we propose a defense strategy that applies random image corruptions to the input image alone, constructs a self-correlation based subspace followed by a projection operation to suppress the adversarial perturbation. Due to its simplicity, the proposed defense is computationally efficient as compared to the state-of-the-art, and yet can withstand huge perturbations. Further, we develop proximity relationships between the projection operator of a clean image and of its adversarially perturbed version, via bounds relating geodesic distance on the Grassmannian to matrix Frobenius norms. We empirically show that our strategy is complementary to other weak defenses like JPEG compression and can be seamlessly integrated with them to create a stronger defense. We present extensive experiments on the ImageNet dataset across four different models namely InceptionV3, ResNet50, VGG16 and MobileNet models with perturbation magnitude set to ε = 16. Unlike state-of-the-art approaches, even without any retraining, the proposed strategy achieves an absolute improvement of ~ 4.5% in defense accuracy on ImageNet.
