Generalized Grad-CAM attacking method based on adversarial patch

Nianwen SI; Wenlin ZHANG; Dan QU; Heyu CHANG; Shengxiang LI; Tong NIU

doi:10.11959/j.issn.1000-436x.2021025

您当前的位置：

首页 >

文章列表页 >

Generalized Grad-CAM attacking method based on adversarial patch

Papers | 更新时间：2024-06-05

- Generalized Grad-CAM attacking method based on adversarial patch
- Journal on Communications Vol. 42, Issue 3, Pages: 23-35(2021)
- 作者机构：
  
  1. 信息工程大学信息系统工程学院，河南郑州 450001
  2. 信息工程大学密码工程学院，河南郑州 450001
- 作者简介：
- 基金信息：
  
  The National Natural Science Foundation of China(61673395)
- DOI：10.11959/j.issn.1000-436x.2021025
  CLC： TP391
- Online First：2021-03，
  
  Published：25 March 2021
- 稿件说明：
移动端阅览
Nianwen SI, Wenlin ZHANG, Dan QU, et al. Generalized Grad-CAM attacking method based on adversarial patch[J]. Journal on Communications, 2021, 42(3): 23-35.
DOI：

Nianwen SI, Wenlin ZHANG, Dan QU, et al. Generalized Grad-CAM attacking method based on adversarial patch[J]. Journal on Communications, 2021, 42(3): 23-35. DOI： 10.11959/j.issn.1000-436x.2021025.

摘要

为了验证Grad-CAM解释方法的脆弱性，提出了一种基于对抗补丁的Grad-CAM攻击方法。通过在CNN分类损失函数后添加对Grad-CAM类激活图的约束项，可以针对性地优化出一个对抗补丁并合成对抗图像。该对抗图像可在分类结果保持不变的情况下，使Grad-CAM解释结果偏向补丁区域，实现对解释结果的攻击。同时，通过在数据集上的批次训练及增加扰动范数约束，提升了对抗补丁的泛化性和多场景可用性。在ILSVRC2012数据集上的实验结果表明，与现有方法相比，所提方法能够在保持模型分类精度的同时，更简单有效地攻击Grad-CAM解释结果。

Abstract

To verify the fragility of the Grad-CAM

a Grad-CAM attack method based on adversarial patch was proposed.By adding a constraint to the Grad-CAM in the classification loss function

an adversarial patch could be optimized and the adversarial image could be synthesized.The adversarial image guided the Grad-CAM interpretation result towards the patch area while the classification result remains unchanged

so as to attack the interpretations.Meanwhile

through batch-training on the dataset and increasing perturbation norm constraint

the generalization and the multi-scene usability of the adversarial patch were improved.Experimental results on the ILSVRC2012 dataset show that compared with the existing methods

the proposed method can attack the interpretation results of the Grad-CAM more simply and effectively while maintaining the classification accuracy.

关键词

Keywords

references

SIMONYAN K , ZISSERMAN A . Very deep convolutional networks for large-scale image recognition [J ] . arXiv Preprint,arXiv:1409.1556v6 , 2014 .

HE K M , ZHANG X Y , REN S Q , et al . Deep residual learning for image recognition [C ] // IEEE Conference on Computer Vision and Pattern Recognition . Piscataway:IEEE Press , 2016 : 770 - 778 .

HUANG G , LIU Z , MAATEN L V D , et al . Densely connected convolutional networks [C ] // IEEE Conference on Computer Vision and Pattern Recognition . Piscataway:IEEE Press , 2017 : 2261 - 2269 .

VASWANI A , SHAZEER N , PARMAR N , et al . Attention is all you need [J ] . arXiv Preprint,arXiv:1706.03762v5 , 2017 .

DEVLIN J , CHANG M W , LEE K , et al . Bert:pre-training of deep bidirectional transformers for language understanding [J ] . arXiv Preprint,arXiv:1810.04805 , 2018 .

SIMONYAN K , VEDALDI A , ZISSERMAN A . Deep inside convolutional networks:visualising image classification models and saliency maps [J ] . arXiv Preprint,arXiv:1312.6034 , 2013 .

SPRINGENBERG J T , DOSOVITSKIY A , BROX T , et al . Striving for simplicity:the all convolutional net [J ] . arXiv Preprint,arXiv:1412.6806 , 2014 .

SMILKOV D , THORAT N , KIM B , et al . SmoothGrad:removing noise by adding noise [J ] . arXiv Preprint,arXiv:1706.03825 , 2017 .

SUNDARARAJAN M , TALY A , YAN Q Q . Axiomatic attribution for deep networks [J ] . arXiv Preprint,arXiv:1703.01365 , 2017 .

ZHOU B , KHOSLA A , LAPEDRIZA A , et al . Learning deep features for discriminative localization [C ] // IEEE Conference on Computer Vision and Pattern Recognition . Piscataway:IEEE Press , 2016 : 2921 - 2929 .

SELVARAJU R R , COGSWELL M , DAS A , et al . Grad-CAM:visual explanations from deep networks via gradient-based localization [C ] // IEEE Conference on Computer Vision and Pattern Recognition . Piscataway:IEEE Press , 2017 : 618 - 626 .

CHATTOPADHAY A , SARKAR A , HOWLADER P , et al . Grad-CAM++:generalized gradient-based visual explanations for deep convolutional networks [C ] // 2018 IEEE Winter Conference on Applications of Computer Vision . Piscataway:IEEE Press , 2018 : 839 - 847 .

WANG H F , DU M N , YANG F , et al . Score-CAM:improved visual explanations via score-weighted class activation mapping [J ] . arXiv Preprint,arXiv:1910.01279 , 2019 .

GHORBANI A , ABID A , ZOU J . Interpretation of neural networks is fragile [C ] // Proceedings of the AAAI Conference on Artificial Intelligence . Palo Alto:AAAI Press , 2018 : 3681 - 3688 .

DOMBROWSKI A K , ALBER M , ANDERS C , et al . Explanations can be manipulated and geometry is to blame [J ] . arXiv Preprint,arXiv:1906.07983 , 2019 .

HEO J , JOO S , MOON T . Fooling neural network interpretations via adversarial model manipulation [J ] . arXiv Preprint,arXiv:1902.02041 , 2019 .

BROWN T B , MANÉ D , ROY A , et al . Adversarial patch [J ] . arXiv Preprint,arXiv:1712.09665v2 , 2017 .

RUSSAKOVSKY O , DENG J , SU H , et al . ImageNet large scale visual recognition challenge [J ] . International Journal of Computer Vision , 2015 , 115 ( 3 ): 211 - 252 .

FUKUI H , HIRAKAWA T , YAMASHITA T , et al . Attention branch network:learning of attention mechanism for visual explanation [C ] // IEEE Conference on Computer Vision and Pattern Recognition . Piscataway:IEEE Press , 2019 : 10705 - 10714 .

LI K P , WU Z Y , PENG K C , et al . Tell me where to look:guided attention inference network [C ] // IEEE Conference on Computer Vision and Pattern Recognition . Piscataway:IEEE Press , 2018 : 9215 - 9223 .

SUBRAMANYA A , PILLAI V , PIRSIAVASH H . Fooling network interpretation in image classification [C ] // IEEE Conference on Computer Vision and Pattern Recognition . Piscataway:IEEE Press , 2019 : 2020 - 2029 .

SZEGEDY C , ZAREMBA W , SUTSKEVER I , et al . Intriguing properties of neural networks [J ] . arXiv Preprint,arXiv:1312.6199v4 , 2013 .

GOODFELLOW I J , SHLENS J , SZEGEDY C . Explaining and harnessing adversarial examples [J ] . arXiv Preprint,arXiv:1412.6572v3 , 2014 .

PASZKE A , GROSS S , CHINTALA S , et al . Automatic differentiation in PyTorch [C ] // Advances in Neural Information Processing Systems Workshop . Massachusetts:MIT Press , 2017 : 1 - 4 .

DONG Y P , LIAO F Z , PANG T Y , et al . Boosting adversarial attacks with momentum [C ] // IEEE Conference on Computer Vision and Pattern Recognition . Piscataway:IEEE Press , 2018 : 9185 - 9193 .

Views

1428

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Trajectory reconstruction attacks on differential privacy based on a CNN-BiLSTM-Attention hybrid model

Intrusion detection method based on data augmentation and multi-explanation method fusion

Modulation recognition method based on multiscale convolutional fusion coding networks

Malicious DNS traffic detection based neural networks

Privacy-preserving convolutional neural network inference scheme based on homomorphic ciphertext transformation

Related Author

XIE Lixia

ZHAO Erkang

YANG Hongyu

LIU Zheli

ZHAO Yongxin

Xiong Xuanrui

GUO Xingyou

NING Zhaolong

Related Institution

School of Computer Science and Technology, Civil Aviation University of China

School of Computer Science and Engineering, Tianjin University of Technology

College of Cyber Science, Nankai University

School of Safety Science and Engineering, Civil Aviation University of China

School of Communications and Information Engineering, Chongqing University of Posts and Telecommunications

AI问答

⁰