こんにちは、futabatoです。

今回は、The Limitations of Deep Learning in Adversarial Settings(Papernot, Nicolas, et al., 2016)の論文に目を通したので、論文メモとしてBlogに残しておきます。

The Limitations of Deep Learning in Adversarial Settings

論文の概要

著者: Papernot, Nicolas, et al.
年度: 2016
論文URL: https://arxiv.org/abs/1511.07528
被引用数: 3062
タグ: Whitebox, Targeted Attack

JSMAです。
Untargeted Attackに代表されるFGSMと同様に、Targeted Attackの攻撃方法についてイメージが湧きやすく、代表的な攻撃手法となっています。

Fig. 1: Adversarial sample generation - Distortion is added to input samples to force the DNN to output adversary selected classification

Abstract

Deep learning takes advantage of large datasets and computationally efficient training algorithms to outperform other approaches at various machine learning tasks. However, imperfections in the training phase of deep neural networks make them vulnerable to adversarial samples: inputs crafted by adversaries with the intent of causing deep neural networks to misclassify. In this work, we formalize the space of adversaries against deep neural networks (DNNs) and introduce a novel class of algorithms to craft adversarial samples based on a precise understanding of the mapping between inputs and outputs of DNNs. In an application to computer vision, we show that our algorithms can reliably produce samples correctly classified by human subjects but misclassified in specific targets by a DNN with a 97% adversarial success rate while only modifying on average 4.02% of the input features per sample. We then evaluate the vulnerability of different sample classes to adversarial perturbations by defining a hardness measure. Finally, we describe preliminary work outlining defenses against adversarial samples by defining a predictive measure of distance between a benign input and a target classification.

既存研究と比べてどこがすごい？

特定のクラスに誤分類させるために探索空間を効率的に探索することができる。

技術や手法のキモはどこ？

JSMAはWhitebox型の攻撃手法で、saliency(顕著性) mapに焦点を当てている。
入力された特徴量のスコアに対して偏微分を行うことでsaliency mapを得る。
得られたsaliency mapの最大となる要素をとって、その要素にノイズを加える。
(saliency mapの要素には偏微分されたものが入るので、大きいほどtargetクラスに向けて効率よく移動できるイメージ)
ノイズを加えた結果、targetクラスに誤分類されることができたら終了。