감쇠 요소가 적용된 데이터 어그멘테이션을 이용한 대체 모델 학습과 적대적 데이터 생성 방법 = A Substitute Model Learning Method Using Data Augmentation with a Decay Factor and Adversarial Data Generation Using Substitute Model

다국어 초록 (Multilingual Abstract)

Adversarial attack, which geneartes adversarial data to make target model misclassify the input data, is able to confusereal life applications of classification models and cause severe damage to the classification system. An Black-box adversarialattack learns a substitute model, which have similar decision boundary to the target model, and then generates adversarialdata with the substitute model. Jacobian-based data augmentation is used to synthesize the training data to learn substitutes,but has a drawback that the data synthesized by the augmentation get distorted more and more as the training loopproceeds. We suggest data augmentation with 'decay factor' to alleviate this problem. The result shows that attack successrate of our method is higher(around 8.5%) than the existing method.

국문 초록 (Abstract)

적대적 공격은 기계학습 분류 모델의 오분류를 유도하는 적대적 데이터를 생성하는 공격으로, 실생활에 적용된 분류 모델에 혼란을 야기하여 심각한 피해를 발생시킬 수 있다. 이러한 적대적 공격 중 블랙박스 방식의 공격은, 대상모델과 유사한 대체 모델을 학습시켜 대체 모델을 이용해 적대적 데이터를 생성하는 공격 방식이다. 이 때 사용되는야코비 행렬 기반의 데이터 어그멘테이션 기법은 합성되는 데이터의 왜곡이 심해진다는 단점이 있다. 본 논문은 기존의 데이터 어그멘테이션 방식에 존재하는 단점을 보완하기 위해 감쇠 요소를 추가한 데이터 어그멘테이션을 사용하여대체 모델을 학습시키고, 이를 이용해 적대적 데이터를 생성하는 방안을 제안한다. 실험을 통해, 기존의 연구 결과보다 공격 성공률이 최대 8.5% 가량 높음을 입증하였다.

참고문헌 (Reference)

1 N. Papernot, "Transferability in machine learning from phenomena to black-box attacks using adversarial samples"

2 N. Carlini, "Towards evaluating the robustness of neural networks" 39-57, 2017

3 N. Papernot, "The limitations of deep learning in adversarial settings" 372-387, 2016

4 M. Abadi, "Tensorlfow: A system for large-scale machine learning" 265-283, 2016

5 Y. Lecun, "Shape, contour and grouping in computer vision" Springer 319-345, 1999

6 S. Qiu, "Review of artificial intelligence adversarial attack and defense technologies" 9 (9): 909-938, 2019

7 N. Papernot, "Practical black-box attacks a gainst machine learning" 506-519, 2017

8 D. Bertsekas, "Nonlinear programming" 48 (48): 334-, 1997

9 H. Sak, "Long short-term memory recurrent neural network architectures for large scale acoustic modeling" 338-342, 2014

10 H. Sak, "Long short-term memory based recur rent neural network architectures for large vocabulary speech recognition"

11 L. Bottou, "Large-scale machine learning with stochastic gradient descent" Physica-Verlag HD 177-186, 2010

12 C. Szegedy, "Intriguing properites of neural networks"

13 A. Krizhevsky, "Imagenet classification with deep convolutional neural networks" 1 : 1097-1105, 2012

14 I. Goodfellow, "Explaining and harnessing adversarial examples"

15 B. Biggio, "Evasion attacks against machine learning at test time" 387-402, 2013

16 R. Caruana, "Ensemble selection from libraries of models" ACM 18-, 2004

17 Y. Liu, "Delving into transferable adversarial examples and black-box attacks"

18 X. Gao, "Boosting targeted black-box attacks via ensemble substitute training and linear augmentation" 9 (9): 2286-2300, 2019

19 L. Huang, "Adversarial machine learning" 43-58, 2011

20 X. Yuan, "Adversarial examples : attacks and defenses for deep learning" 9 (9): 2805-2824, 2019

21 D. Kingma, "Adam: A method for stochastic optimization"