论文标题
HRFA：基于高分辨率的攻击
HRFA: High-Resolution Feature-based Attack
论文作者
论文摘要
长期以来，已经开发出了对抗性攻击来通过向输入中添加不可察觉的扰动来揭示深神经网络（DNN）的脆弱性。大多数方法都会产生诸如正常噪声之类的扰动，这是不可解释的，没有语义含义。在本文中，我们提出了基于高分辨率功能的攻击（HRFA），产生了真实的对抗示例，最高$ 1024 \ times 1024 $分辨率。 HRFA通过修改图像的潜在特征表示形式来发挥攻击，即，渐变不仅可以通过受害者DNN传播，还可以通过将特征空间映射到图像空间的生成模型传播。通过这种方式，HRFA生成了具有高分辨率，现实，无噪声的对抗性示例，因此能够逃避几种基于Denoising的防御能力。在实验中，通过分别使用Biggan和StyleGan攻击对象分类和面对验证任务来验证HRFA的有效性。 HRFA的优势是根据防御能力所面临的高质量，高真实性和高攻击成功率来验证的。
Adversarial attacks have long been developed for revealing the vulnerability of Deep Neural Networks (DNNs) by adding imperceptible perturbations to the input. Most methods generate perturbations like normal noise, which is not interpretable and without semantic meaning. In this paper, we propose High-Resolution Feature-based Attack (HRFA), yielding authentic adversarial examples with up to $1024 \times 1024$ resolution. HRFA exerts attack by modifying the latent feature representation of the image, i.e., the gradients back propagate not only through the victim DNN, but also through the generative model that maps the feature space to the image space. In this way, HRFA generates adversarial examples that are in high-resolution, realistic, noise-free, and hence is able to evade several denoising-based defenses. In the experiment, the effectiveness of HRFA is validated by attacking the object classification and face verification tasks with BigGAN and StyleGAN, respectively. The advantages of HRFA are verified from the high quality, high authenticity, and high attack success rate faced with defenses.
