Adversarial-Examples(对抗样本).pptxVIP

Adversarial Examples;Introduction;Introduction;Fig. 1: Example of attacks on deep learning models with ‘universal adversarial perturbations’ : The attacks are shown for the CaffeNet, VGG-F network and GoogLeNet. All the networks recognized the original clean images correctly with high confidence. After small perturbations were added to the images, the networks predicted wrong labels with similar high confidence. Notice that the perturbations are hardly perceptible for human vision system, however their effects on the deep learning models are catastrophic. ;Definition of terms;The existence of adversarial examples;Linear explanation;;Deep learning security is a trending topic in ICLR 2018;Overview of Adversarial Examples in ICLR;Attack;How to attack;Attacking Methods (white-box attack);Attacking Methods (white-box attack);Attacking Methods (white-box attack);Attacking Methods (white-box attack);Attacking Methods (black-box attack);Attacking Methods (black-box attack);Fig. 2: Illustration of one pixel adversarial attacks: The correct label is mentioned with each image. The corresponding predicted label is given in parentheses.;Attacking Methods (black-box attack);Decision-based attacks;It iteratively takes steps along the decision boundary while trying to minimize the distance to the original positive example. ;2018/5/15;;2018/5/15;Defense;Why is defense difficult?;Currently, the defenses against the adversarial attacks are being developed along three main directions: Using modified training during learning or modified input during testing. 2) Modifying networks, e.g. by adding more layers/subnetworks, changing loss/activation functions etc. 3) Using external models as network add-on when classifying unseen examples.;2018/5/15;Prior work;Prior work;Prior work;Modified training/input ;Certifying Some Distributional Robustness with Principled Adversarial Training;2018/5/15;Figure 1 tells us three important pieces of information: 1. The more fluent the decision bound