论文标题
具有秘密钥匙的块形图像转换，以防御强大的防御
Block-wise Image Transformation with Secret Key for Adversarially Robust Defense
论文作者
论文摘要
在本文中，我们提出了一种新颖的防御性转换，使我们能够在使用干净的图像和对抗性示例中保持高分类的精度，以进行对抗性强大的防御。所提出的转换是一种具有秘密钥匙以输入图像的区块预处理技术。我们开发了三种算法来实现所提出的转换：像素改组，钻头翻转和FFX加密。通过使用Black-Box和White-Box攻击（包括自适应的指标），在CIFAR-10和Imagenet数据集上进行了实验。结果表明，即使是首次在自适应攻击下，提议的防御能力也可以实现高精度接近使用干净的图像。在最佳场景中，通过使用FFX加密转换的图像（4个块大小）训练的模型在干净的图像上的准确度为92.30％，在PGD攻击下，噪声距离为8/255，在8/255下的精度为91.48％，该噪声距离为8/255，它接近了非验证的准确性（95.45％），可在Cifar-10的准确性（95.45％）上进行清晰的图像和52.的准确性。在同一攻击下，有71.43％的攻击，也接近Imagenet数据集的标准准确性（73.70％）。总体而言，所有三种提出的算法都被证明超过了最先进的防御能力，包括对抗性训练是否受到攻击。
In this paper, we propose a novel defensive transformation that enables us to maintain a high classification accuracy under the use of both clean images and adversarial examples for adversarially robust defense. The proposed transformation is a block-wise preprocessing technique with a secret key to input images. We developed three algorithms to realize the proposed transformation: Pixel Shuffling, Bit Flipping, and FFX Encryption. Experiments were carried out on the CIFAR-10 and ImageNet datasets by using both black-box and white-box attacks with various metrics including adaptive ones. The results show that the proposed defense achieves high accuracy close to that of using clean images even under adaptive attacks for the first time. In the best-case scenario, a model trained by using images transformed by FFX Encryption (block size of 4) yielded an accuracy of 92.30% on clean images and 91.48% under PGD attack with a noise distance of 8/255, which is close to the non-robust accuracy (95.45%) for the CIFAR-10 dataset, and it yielded an accuracy of 72.18% on clean images and 71.43% under the same attack, which is also close to the standard accuracy (73.70%) for the ImageNet dataset. Overall, all three proposed algorithms are demonstrated to outperform state-of-the-art defenses including adversarial training whether or not a model is under attack.
