2021-09-28

[论文笔记]Transferable Adversarial Attacks for Image and Video Object Detection

2019 IJCAI
https://github.com/LiangSiyuan21/Adversarial-Attacks-for-Image-and-Video-Object-Detection

论文动机

现存的对抗攻击方案，都是基于梯度回传，每次单张图片迭代优化，所以产生的对抗样本具有弱的迁移性以及大的运算量。为了解决这个问题，作者提出来了生成对抗攻击的方案，参考GAN的思路，使用生成器来对输入样布进行攻击，可以一次训练，使用的时候只是前向推理即可得到结果，大大提升运算速度。

论文提出的方案

The generator is an encoder-decoder network with 19components. The discriminator is similar to ResNet-32 forCIFAR-10 and MNIST.
生成器和判别器

self.generator = nn.Sequential(  # input is (nc) x 32 x 32
            nn.Conv2d(num_channels, ngf, 3, 1, 1, bias=True),
            nn.LeakyReLU(0.2, inplace=True),
            # nn.Dropout2d(),
            # state size. 48 x 32 x 32
            nn.Conv2d(ngf, ngf, 3, 1, 1, bias=True),
            nn.LeakyReLU(0.2, inplace=True),
            # nn.Dropout2d(),
            # state size. 48 x 32 x 32
            nn.Conv2d(ngf, ngf, 3, 1, 1, bias=True),
            nn.LeakyReLU(0.2, inplace=True),
            # nn.Dropout(),
            # state size. 48 x 32 x 32
            nn.Conv2d(ngf, ngf, 3, 1, 1, bias=True),
            nn.LeakyReLU(0.2, inplace=True),
            # nn.Dropout(),
            # state size. 48 x 32 x 32
            nn.Conv2d(ngf, ngf, 3, 1, 1, bias=True),
            nn.LeakyReLU(0.2, inplace=True),
            # state size. 48 x 32 x 32
            nn.Conv2d(ngf, ngf, 3, 1, 1, bias=True),
            nn.LeakyReLU(0.2, inplace=True),
            # state size. 48 x 32 x 32
            nn.Conv2d(ngf, ngf, 1, 1, 0, bias=True),
            nn.LeakyReLU(0.2, inplace=True),
            # state size. 3 x 32 x 32
            nn.Conv2d(ngf, num_channels, 1, 1, 0, bias=True),
            nn.Tanh()
        )


class NLayerDiscriminator(nn.Module):
    def __init__(self, input_nc, ndf=64, n_layers=3, norm_layer=nn.BatchNorm2d, use_sigmoid=False):
        super(NLayerDiscriminator, self).__init__()
        if type(norm_layer) == functools.partial:
            use_bias = norm_layer.func == nn.InstanceNorm2d
        else:
            use_bias = norm_layer == nn.InstanceNorm2d

        kw = 4
        padw = 1
        sequence = [
            nn.Conv2d(input_nc, ndf, kernel_size=kw, stride=2, padding=padw),
            nn.LeakyReLU(0.2, True)
        ]

        nf_mult = 1
        nf_mult_prev = 1
        for n in range(1, n_layers):
            nf_mult_prev = nf_mult
            nf_mult = min(2**n, 8)
            sequence += [
                nn.Conv2d(ndf * nf_mult_prev, ndf * nf_mult,
                          kernel_size=kw, stride=2, padding=padw, bias=use_bias),
                norm_layer(ndf * nf_mult),
                nn.LeakyReLU(0.2, True)
            ]

        nf_mult_prev = nf_mult
        nf_mult = min(2**n_layers, 8)
        sequence += [
            nn.Conv2d(ndf * nf_mult_prev, ndf * nf_mult,
                      kernel_size=kw, stride=1, padding=padw, bias=use_bias),
            norm_layer(ndf * nf_mult),
            nn.LeakyReLU(0.2, True)
        ]

        sequence += [nn.Conv2d(ndf * nf_mult, 1, kernel_size=kw, stride=1, padding=padw)]

        if use_sigmoid:
            sequence += [nn.Sigmoid()]

        self.model = nn.Sequential(*sequence)

    def forward(self, input):
        return self.model(input)

LOSS函数设计

结论

使用GAN网络进行生成噪声，并使用判别器来进行修正使他和原图更加接近。接着加入DAG的loss与多层特征LOss来进行对抗攻击的训练，从生成网络的角度来进行对抗攻击，提高攻击的攻击速度，同时可以做到一次训练，多次生成的效果。