Despite the high quality performance of the deep neural network in real-world
applications, they are susceptible to minor perturbations of adversarial
attacks. This is mostly undetectable to human vision. The impact of such
attacks has become extremely detrimental in autonomous vehicles with real-time
"safety" concerns. The black-box adversarial attacks cause drastic
misclassification in critical scene elements such as road signs and traffic
lights leading the autonomous vehicle to crash into other vehicles or
pedestrians. In this paper, we propose a novel query-based attack method called
Modified Simple black-box attack (M-SimBA) to overcome the use of a white-box
source in transfer based attack method. Also, the issue of late convergence in
a Simple black-box attack (SimBA) is addressed by minimizing the loss of the
most confused class which is the incorrect class predicted by the model with
the highest probability, instead of trying to maximize the loss of the correct
class. We evaluate the performance of the proposed approach to the German
Traffic Sign Recognition Benchmark (GTSRB) dataset. We show that the proposed
model outperforms the existing models like Transfer-based projected gradient
descent (T-PGD), SimBA in terms of convergence time, flattening the
distribution of confused class probability, and producing adversarial samples
with least confidence on the true class.
Abstract—Despite the high quality performance of the deep neural network in real-world applications, they are susceptible to minor perturbations of adversarial attacks.
The black-box adversarial attacks cause drastic misclassification in critical scene elements such as road signs and traffic lights leading the autonomous vehicle to crash into other vehicles or pedestrians.
In this paper, we propose a novel query-based attack method called Modified Simple blackbox attack (M-SimBA) to overcome the use of a white-box source in transfer based attack method.
Also, the issue of late convergence in a Simple black-box attack (SimBA) is addressed by minimizing the loss of the most confused class which is the incorrect class predicted by the model with the highest probability, instead of trying to maximize the loss of the correct class.
We show that the proposed model outperforms the existing models like Transfer-based projected gradient descent (T-PGD), SimBA in terms of convergence time, flattening the distribution of confused class probability, and producing adversarial samples with least confidence on the true class.
Index Terms—adversarial attacks, black-box attacks, deep
インデックス用語―敵攻撃、ブラックボックス攻撃、ディープ
0.67
learning methods, autonomous vehicles.
学習方法 自動運転車
0.49
I. INTRODUCTION Cybersecurity threats on Autonomous vehicles (AV) can cause serious safety and security issues as per the “Safety First” industry consortium paper [1] published by twelve industry leaders such as Audi, BMW, Volkswagen, among others.
I 導入 audi、bmw、volkswagenなど12の業界リーダーが発行した“safety first”産業コンソーシアムの論文[1]によると、自動運転車に対するサイバーセキュリティの脅威は深刻な安全とセキュリティの問題を引き起こす可能性がある。
0.56
AV is made possible due to the control functions of connected vehicles, onboard diagnostics for maintenance, and cloud backend system.
These capabilities also make it a rich and vulnerable attack surface for the adversary.
これらの能力は、敵に対するリッチで脆弱な攻撃面にもなります。
0.60
Cyber-attacks on such systems can have dangerous effects leading to malicious actors gaining arbitrary control of the vehicle with such multiple entities managed simultaneously on the road.
Cyber attacks often cause data corruption and intentional tampering by an unexpected source, which could be crucial elements in the training data for deep neural networks [2].
detection, and segmentation), they are known to be extremely vulnerable to adversarial attacks [3].
検出とセグメンテーション) 敵の攻撃に対して非常に脆弱であることが知られている[3]。
0.74
In this type of attack, the adversary induces minor but systematic perturbations in key model layers such as filters and input datasets as shown in Fig 1.
Even though this minor layer of noise is barely perceptible to human vision, it may cause drastic misclassification in critical scene elements such as road signs and traffic lights.
This may eventually lead to AV crashing into other vehicles or pedestrians.
これは最終的には他の車両や歩行者に衝突する可能性がある。
0.54
Stickers or paintings on the traffic signboards are the most common physical adversarial attacks, which can impact the functionality of the vehicular system.
This incorrect prediction can be hardly perceptible to the human eye and thus have dangerous repercussions for autonomous vehicles.
この誤った予測は人間の目にはほとんど知覚できないため、自動運転車に対する危険な影響がある。
0.64
Adversarial attacks are primarily of two types: (1) White-box where adversary customizes perturbations to the known deep neural network such as architecture, training data, parameter settings, and (2) Black-box where adversary has minimum to nil knowledge about the network.
Although white-box attacks have been under study, they may not be realistic for AV technology, because of the many dynamic elements primarily related to sensor data.
Seminal research articles [3], [4] to report adversarial attack problems for images in neural networks observed image that an imperceptible non-random noise to a test can lead to serious misprediction problems, thereby questioning the model robustness.
resulted from machine learning models of the sub-tasks in the computer vision domain, such as classification, detection, and segmentation, become sensitive to the adversarial perturbations in the input.
This is discussed in various prior works [7]–[10].
これは様々な先行研究[7]–[10]で議論されている。
0.80
Gradient estimation techniques such as Finite Differences (FD) and Natural Evolutionary Strategies (NES) are used in a black-box setting, because they are not directly accessible to the adversary.
Although several papers have verified the transferability properties [13], the focus of our work is on the gradient estimation technique [14] because of the convenience of attack.
This property transferability of adversarial attacks is investigated in [15] for dispersion reduction attack.
分散低減攻撃の[15]において, この特性伝達性について検討した。
0.67
It uses limited perturbations compared to the existing attacks and demonstrated its performance over different computer vision tasks (image classification, object detection, semantic segmentation).
The first work to generate adversarial examples for blackbox attacks in video recognition, V-BAD [16] framework utilizes tentative perturbations transferred from image models and partition-based rectifications to obtain good adversarial gradient estimates.
They demonstrate an effective and efficient attack with a ∼90% success rate using fewer queries to the target model.
ターゲットモデルへのクエリが少なく、90%の成功率で効果的で効率的な攻撃を示す。
0.76
More recently, the first article on adversarial examples for sign recognition systems in AV [17] has proposed two different attack methods: out-of-distribution and lenticular printing in black-box settings.
The adversarial perturbations by TREMBA have high-level semantics, which is effectively transferable.
TREMBAによる対向摂動は高レベルの意味論を持ち、効果的に伝達可能である。
0.49
Further, these perturbations help in enhancing the query efficiency of the black-box adversarial attack across the architectures of different target networks.
Boundary attacks usually require a large set of model queries for obtaining a successful human indistinguishable adversarial example.
境界攻撃は通常、人間の区別がつかない敵の例を得るのに大量のモデルクエリを必要とする。
0.58
To improve the efficiency of the boundary attack, it must be combined with a transfer-based attack.
境界攻撃の効率を向上させるためには、転送ベースの攻撃と組み合わせる必要がある。
0.76
The biased boundary attack [20], significantly reduces the number of model queries with the combination of low-frequency random noise and the gradient from a substitute model.
The boundary attack++ [21] is an algorithmic improvement of the boundary attack, which estimates the gradient direction with the help of binary information available at the decision boundary.
Another method [22] of decision-based attack, called qFool, used very few queries in the computation of adversarial examples.
qFoolと呼ばれる別の方法[22]は、敵の例の計算に非常に少ないクエリを使用した。
0.72
The qFool method can handle both non-targeted and targeted attacks with less number of queries.
qFoolメソッドは、クエリ数の少ない非ターゲット攻撃とターゲット攻撃の両方を処理できる。
0.74
A simple black-box adversarial attack, called SimBA [23] has emphasized that optimizing queries in black-box adversarial attacks continues to be an open problem.
This is happening even though there is a significant body of prior work [16], [18].
これは、[16], [18]という重要な先行作業があっても起こっています。
0.75
The algorithm in SimBA repeatedly picks a random direction from a pre-specified set of directions and uses continuousvalued confidence scores to perturb the input image by adding or subtracting the vector from the image.
We have extended their work by improving the efficiency and efficacy of the attack.
攻撃の効率と有効性を改善して作業を拡張しました。
0.75
Instead of maximizing the loss of the original class, our model searches for gradients in a direction that minimizes the loss of the “most confused class”.
There are three main advantages of our model: fast convergence, flattens the confused class probability distribution, and produces adversarial samples with the least confidence in true class.
In other words, the results demonstrate that our model is better at generating successful mis-predictions at a faster rate with a higher probability of failure.
Our work in building such models will serve two primary scientific communities.
このようなモデルを構築する作業は、2つの主要な科学コミュニティに役立ちます。
0.58
First, it contributes towards the safety and security of the primary users i.e.
第一に、プライマリユーザーの安全とセキュリティに貢献する。
0.62
passengers and pedestrians. Second, it helps AI researchers in developing robust and reliable models.
乗客と歩行者。 第二に、AI研究者が堅牢で信頼性の高いモデルを開発するのを助ける。
0.66
The main contributions of this work are: • A novel multi-gradient model for designing a black-box adversarial attack on traffic sign images by minimizing the loss of the most confused class.
• Result validation by comparison with transfer-based projected gradient descent (T-PGD) and simple black-box attack (SimBA) using German Traffic Sign Recognition Benchmark (GTSRB) dataset
• Our model outperforms on three metrics: iterations for convergence, class probability distribution, and confidence values on input class.
• モデルでは, 収束の反復, クラス確率分布, 入力クラスの信頼値の3つの指標より優れる。
0.81
The paper is organized as follows.
論文は以下の通り整理される。
0.65
In Section II, we describe the proposed architecture of black-box adversarial attacks.
第2節では,ブラックボックス攻撃のアーキテクチャについて述べる。
0.68
Section III contains discussions on the performance of the proposed method on the GTSRB dataset along with quantitative and qualitative analysis.
第3節では,GTSRBデータセットにおける提案手法の性能と定量的,定性的な分析について論じている。
0.62
The conclusions are presented and future work in Section IV.
結論は、第4節で示され、今後の作業である。
0.44
II. PROPOSED METHOD In this section, we are presenting the proposed method for black-box adversarial attacks in AV.
II。 提案方法 本稿では,AVにおけるブラックボックス攻撃の方法を提案する。
0.64
As shown in Fig 2, there are three main modules: (a) input module to sense/detect the traffic signs through the camera attached to the autonomous vehicle (b) multi gradient attack module, and (c) adversarial sample estimator that implements the target attack.
The gradient perturbations can be generated from one of the three methods: Transfer based projected gradient descent (TPGD), a Simple Black box attack (SimBA), and Modified Simple
A detailed explanation of this key attack module is given in the subsequent sections.
この攻撃モジュールの詳細な説明は、後続のセクションで述べられている。
0.67
A. Transfer based Projected Gradient Descent (T-PGD)
A。 T-PGD(Transfer Based Projected Gradient Descent)
0.82
In this white-box attack, the source CNN architecture is trained for a similar task.
このホワイトボックス攻撃では、ソースCNNアーキテクチャは同様のタスクのために訓練される。
0.67
The gradients from this model are used to produce an adversarial sample which is then transferred to attack the target.
このモデルからの勾配は、敵のサンプルを生成し、ターゲットを攻撃するために転送される。
0.76
Gradients updates are performed in the direction which maximizes the classification loss as per equation (1), where x, Advx are original and adversarial sample, respectively.
The term is the step size that decides the magnitude of the update.
という用語は、更新の規模を決定するステップサイズである。
0.73
The gradient of the loss function is denoted by ∇xJ and weights corresponding to the CNN is shown as θ.
損失関数の勾配は yxJ で表され、CNN に対応する重みは θ として表される。
0.71
The output label is shown y.
出力ラベルはyを示す。
0.66
Advx = x + ∗ sign(∇xJ (θ, x, y)).
Advx = x + y ∗ sign(xJ (θ, x, y))。
0.80
(1) Iterative gradient updates are performed until the loss converges to a higher value.
(1) 損失がより高い値に収束するまで、反復的な勾配更新を行う。
0.77
This treatment makes the adversarial image to deviate from the original image, making it unperceivable to humans.
この治療により、敵像は元の画像から逸脱し、人間には知覚できない。
0.67
Although T-PGD shows good generalization ability for samples generated on white box source model to be transferred to the black box model, it is limited by the need for the white box source model.
It has no knowledge of the model and its architecture.
モデルとそのアーキテクチャに関する知識はない。
0.63
Hence, the model parameters such as weights and biases are not known to calculate the gradient concerning the input image as done in previous transfer-based attacks.
This reduces the overall confidence of the network.
これによりネットワーク全体の信頼性が低下する。
0.75
For any given direction q and step size , one of the gradient term (x + q) or (x − q) is likely to decrease P (y|x).
任意の方向 q とステップサイズ y に対して、勾配項 (x + q ) または (x − q ) の1つは P (y|x) を減少させる。
0.83
To minimize the number of queries to the model, +q term is added.
モデルに対するクエリ数を最小化するために、+q 項が追加される。
0.72
In case, this decreases the probability P (y|x), then a step is taken in this direction.
この場合、これは確率 P (y|x) を減少させ、この方向に一歩進む。
0.80
Otherwise, the opposite of −q is considered.
さもなくば −q の逆を考える。
0.57
Although it is a simple method to be used to attack any unknown architecture, it requires an extensive gradient search which consumes a large number of iterations to converge.
To avoid the use of white-box source model of T-PGD attack and late convergence problems of SimBA attack, we are proposing a novel method by modifying the Simple Black box attack to call it M-SimBA.
It is the incorrect class where the model misclassifies with the highest probability.
これはモデルが最も高い確率で誤分類する誤ったクラスである。
0.82
As shown in Fig 4, firstly probability of the original model class is checked before the attack.
図4に示すように、最初のモデルクラスの確率は攻撃前にチェックされる。
0.79
In the next step, random gradients are initialized and are added to the input sample.
次のステップでは、ランダム勾配が初期化され、入力サンプルに追加される。
0.76
Subsequently, the black-box model probability is calculated in the most confused class.
その後、ブラックボックスモデル確率は最も混乱したクラスで計算される。
0.71
Initially, a positive update is considered.
最初はポジティブなアップデートが検討されている。
0.62
In case, it fails to improve the probability of a most confused class, a negative gradient update is performed.
この場合、最も混乱したクラスの確率を改善することができず、負の勾配更新が行われる。
0.74
If both positive and negative gradient updates fail to improve the probability, a new gradient is randomly initialized and the process is repeated until convergence.
To perform transfer based projected gradient descent (T-PGD) attack, a 2-layer customized white-box CNN architecture is designed which takes the input image of size (150x150).
The model classifies the original samples with 94% accuracy.
モデルは元のサンプルを94%の精度で分類する。
0.81
It serves as a white-box source to generate adversarial samples in the T-PGD attack.
t-pgd攻撃で敵のサンプルを生成するホワイトボックスのソースとして機能する。
0.60
To perform SimBA and M-SimBA attack methods, another 2-layer customized black-box CNN architecture with a larger number of max-pool and dropout layers compared to white-box CNN is designed.
It takes the input image of same size (150x150) to perform the attack.
同一サイズ(150x150)の入力画像を使って攻撃を行う。
0.75
It classifies the original samples with 96% accuracy.
元のサンプルを96%の精度で分類する。
0.80
C. Comparison results In this section, we are comparing the three attack methods based on their success rate.
c.比較結果 本稿では,この3つの攻撃手法を,その成功率に基づいて比較する。
0.81
It is defined as a fraction of generated samples that are successfully misclassified by the black-box model.
ブラックボックスモデルによって誤って分類された生成サンプルのごく一部として定義される。
0.69
As shown in Fig 6, the success rate increases with an increase in the number of iterations for all the three methods.
図6に示すように、成功率は、3つのメソッドのイテレーション数の増加とともに増加する。
0.74
This is an expected trend, gradient updates for adversarial sample become better with more processing time.
これは予想される傾向であり、より多くの処理時間で対向サンプルの勾配更新が改善する。
0.68
The success rate of T-PGD does not increase much with an increase in iterations, since it does not rely on random searching and requires only a fixed number of iterations to generate the sample.
In the result shown in Fig 7, a common trend is observed that as increases, the success rate decreases for all the three methods.
図7で示される結果から,3つの手法のすべてにおいて,成功率が減少する傾向が観察された。
0.75
This is expected behavior because, as we increase the step size, the value of the gradient update also increases.
ステップサイズが大きくなるにつれて、勾配更新の値も増加するため、これは予想される振る舞いである。
0.69
For
のために
0.51
英語（論文から抽出）
日本語訳
スコア
Fig. 2. Proposed method for black-box adversarial attacks in autonomous vehicle technology.
フィギュア。 2. 自動運転車技術におけるブラックボックス攻撃法の提案
0.68
(a) an input module to sense/detect the traffic signs through the camera attached to the autonomous vehicle (b) multi gradient attack module to generate 3 different gradient perturbations from Transfer based projected gradient descent (T-PGD), Simple Black box attack (SimBA), Modified Simple black-box attack (M-SimBA), and (c) a classification module which attacks the target black-box model
Finally, in Fig 8, it is observed that M-SimBA tends to show a higher success rate for the initial increase in the number of samples and continues to outperform other methods, because of its property of early convergence.
To achieve efficiency in the iterative process of reducing the number of queries searching the classifier, we focus on minimizing the loss of the most confused class.
We are showing the efficiency and efficacy of our model with three different metrics namely: iterations for convergence, class probability distribution, and confidence values on input class.
[2] Y. Deng, X. Zheng, T. Zhang, C. Chen, G. Lou, and M. Kim, “An analysis of adversarial attacks and defenses on autonomous driving models,” arXiv preprint arXiv:2002.02175, 2020.
[2] y. deng, x. zheng, t. zhang, c. chen, g. lou, m. kim, “自動運転モデルの敵対的攻撃と防御の分析” arxiv preprint arxiv:2002.02175, 2020。
0.77
[3] C. Szegedy, W. Zaremba,
[3] c. szegedy, w. zaremba,
0.71
J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” in International Conference on Learning Representations, 2014.
J. Bruna, D. Erhan, I. Goodfellow, R. Fergus, “Intriguing properties of neural networks” in International Conference on Learning Representations, 2014.
[4] I. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” in International Conference on Learning Representations, 2015.
4]i. goodfellow, j. shlens, c. szegedy, “explaining and harnessing adversarial examples” in international conference on learning representations, 2015 訳抜け防止モード: [4 ]I. Goodfellow, J. Shlens, C. Szegedy 2015年度の国際学習表現会議において,「敵対的事例の解説と活用」を行った。
0.82
[Online]. Available: http://arxiv.org/abs /1412.
[オンライン] 利用可能: http://arxiv.org/abs /1412。
0.56
6572 [5] Y. Liu, X. Chen, C. Liu, and D. Song, “Delving into transferable adversarial examples and black-box attacks,” arXiv preprint arXiv:1611.02770, 2016.
6572 Y. Liu, X. Chen, C. Liu, D. Song, “Delving into transferable adversarial examples and black-box attack” arXiv preprint arXiv:1611.02770, 2016
0.87
[6] C. Xie, J. Wang, Z. Zhang, Y. Zhou, L. Xie, and A. Yuille, “Adversarial examples for semantic segmentation and object detection,” in Proceedings of the IEEE International Conference on Computer Vision, 2017, pp.
C. Xie, J. Wang, Z. Zhang, Y. Zhou, L. Xie, and A. Yuille, “Adversarial examples for semantic segmentation and object detection” in Proceedings of the IEEE International Conference on Computer Vision, 2017 pp.
0.84
1369–1378.
1369–1378.
0.71
[7] N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in 2017 IEEE Symposium on Security and Privacy (SP), 2017, pp.
7] n. carlini氏とd. wagner氏は、2017年のieee symposium on security and privacy(sp)で、ニューラルネットワークのロバスト性の評価について述べている。 訳抜け防止モード: N. CarliniとD. Wagnerは、“ニューラルネットワークの堅牢性を評価する”。 2017年IEEE Symposium on Security and Privacy (SP)に参加。 2017年、p。
0.72
39–57.
39–57.
0.71
英語（論文から抽出）
日本語訳
スコア
Fig. 9. Visual Results on GTSRB - 1.
フィギュア。 9. GTSRB - 1のビジュアル結果。
0.66
True class of the input image is 0.
入力画像の真のクラスは 0 である。
0.80
The T-PGD method produces the adversarial sample highest probability (red box on T-PGD plot) compared to the other two attacks.
T-PGD法では,T-PGD法では,他の2つの攻撃と比較して高い確率(赤箱)が得られる。
0.74
M-SimBA (red box on M-SimBA plot) can attack the black-box model which outputs very low confidence in the input class i.e., 0.
It is a desirable behavior of a robust attack method to suppress the confidence of the original class.
これは、元のクラスの信頼性を抑えるための堅牢な攻撃方法の望ましい行動である。
0.78
[20] T. Brunner, F. Diehl, M. T. Le, and A. Knoll, “Guessing smart: Biased sampling for efficient black-box adversarial attacks,” in 2019 IEEE/CVF International Conference on Computer Vision (ICCV), 2019, pp.
T.Brunner, F. Diehl, M. T. Le, A. Knoll, “Guessing smart: Biased sample for efficient black-box adversarial attack” in 2019 IEEE/CVF International Conference on Computer Vision (ICCV), 2019, pp.
0.86
4957– 4965.
4957– 4965.
0.94
[21] I. Rosenberg, A. Shabtai, Y. Elovici, and L. Rokach, “Query-efficient black-box attack against sequence-based malware classifiers,” arXiv preprint arXiv:1804.08778, 2018.
I. Rosenberg, A. Shabtai, Y. Elovici, L. Rokach, “Query- efficient black-box attack against sequence-based malware classifications” arXiv preprint arXiv:1804.08778, 2018.
0.88
[22] Y. Liu, S. Moosavi-Dezfooli, and P. Frossard, “A geometry-inspired decision-based attack,” in 2019 IEEE/CVF International Conference on Computer Vision (ICCV), 2019, pp.
Y. Liu, S. Moosavi-Dezfooli, P. Frossard, “A geometry-inspired decision-based attack” in 2019 IEEE/CVF International Conference on Computer Vision (ICCV), 2019, pp.
0.93
4889–4897.
4889–4897.
0.71
[23] C. Guo, J. Gardner, Y.
[23] C. Guo, J. Gardner, Y。
0.95
You, A. G. Wilson, and K. Weinberger, “Simple black-box adversarial attacks,” ser.
Proceedings of Machine Learning Research, K. Chaudhuri and R. Salakhutdinov, Eds., vol.
機械学習研究の成果 K. Chaudhuri と R. Salakhutdinov, Eds., vol.
0.83
97. Long Beach, California, USA: PMLR, 09–15 Jun 2019, pp.
97. カリフォルニア州ロングビーチ, アメリカ:PMLR, 09-15 Jun 2019, pp.
0.86
2484–2493.
2484–2493.
0.71
[Online]. Available: http://proceedings.m lr.press/v97/guo19a. html
[オンライン] 利用可能: http://proceedings.m lr.press/v97/guo19a. html
0.48
[24] J. Stallkamp, M. Schlipsing, J. Salmen, and C. Igel, “The German Traffic Sign Recognition Benchmark: A multi-class classification competition,” in IEEE International Joint Conference on Neural Networks, 2011, pp.
24] j. stallkamp, m. schlipsing, j. salmen, c. igel, “the german traffic sign recognition benchmark: a multi-class classification competition” in ieee international joint conference on neural networks, 2011, pp. (英語)
0.84
1453–1460.
1453–1460.
0.71
[8] C. Szegedy, W. Zaremba,
[8]C.Szegedy, W. Zaremba,
0.87
J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” in International Conference on Learning Representations, 2014.
J. Bruna, D. Erhan, I. Goodfellow, R. Fergus, “Intriguing properties of neural networks” in International Conference on Learning Representations, 2014.
[9] M. Cisse, Y. Adi, N. Neverova, and J. Keshet, “Houdini: Fooling deep
9]M. Cisse, Y. Adi, N. Neverova, J. Keshet, “Houdini: Fooling Deep”
0.91
structured prediction models,” 07 2017.
構造化予測モデル”, 2017年7月7日閲覧。
0.55
[10] C. Xie, J. Wang, Z. Zhang, Y. Zhou, L. Xie, and A. Yuille, “Adversarial examples for semantic segmentation and object detection,” in 2017 IEEE International Conference on Computer Vision (ICCV), 2017, pp.
C. Xie, J. Wang, Z. Zhang, Y. Zhou, L. Xie, and A. Yuille, “Adversarial examples for semantic segmentation and object detection” in 2017 IEEE International Conference on Computer Vision (ICCV) 2017 pp. 2017年9月1日閲覧。
0.91
1378– 1387.
1378– 1387.
0.94
[11] N. Papernot, P. McDaniel, and I. Goodfellow, “Transferability in machine learning: from phenomena to black-box attacks using adversarial samples,” arXiv preprint arXiv:1605.07277, 2016.
N. Papernot, P. McDaniel, I. Goodfellow, “Transferability in machine learning: from phenomena to black-box attack using adversarial sample”. arXiv preprint arXiv:1605.07277, 2016.
0.93
[12] S.-M. Moosavi-Dezfooli and O. F. Alhussein Fawzi, “Pascal frossard.”,” in Universal adversarial perturbations.” 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2017.
12] s.-m. moosavi-dezfooli and o. f. alhussein fawzi, “pascal frossard.” in universal adversarial perturbations.” 2017 ieee conference on computer vision and pattern recognition (cvpr) 2017
0.80
[13] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” arXiv preprint arXiv:1706.06083, 2017.
A. Madry, A. Makelov, L. Schmidt, D. Tsipras, A. Vladu, “Towards Deep Learning models resistant to adversarial attack” arXiv preprint arXiv:1706.06083, 2017
0.87
[14] P.-Y. Chen, H. Zhang, Y. Sharma, J. Yi, and C.-J.
[14]P.-Y。 Chen, H. Zhang, Y. Sharma, J. Yi, C.-J
0.85
Hsieh, “Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models,” in Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, 2017, pp.
Hsieh, “Zoo: Zeroth Order Optimization based black-box attack to deep neural network without training instead model” in Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, 2017 pp。
0.80
15–26. [15] Y. Lu, Y. Jia, J. Wang, B. Li, W. Chai, L. Carin, and S. Velipasalar, “Enhancing cross-task black-box transferability of adversarial examples with dispersion reduction,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2020, pp.
15–26. 15] y. lu, y. jia, j. wang, b. li, w. chai, l. carin, s. velipasalar, “enhancing cross-task black-box transferability of adversarial examples with dispersion reduction” in the ieee/cvf conference on computer vision and pattern recognition, 2020, pp. (英語)
0.77
940–949. [16] L. Jiang, X. Ma, S. Chen, J. Bailey, and Y.-G. Jiang, “Black-box adversarial attacks on video recognition models,” in Proceedings of the 27th ACM International Conference on Multimedia, 2019, pp.
940–949. L. Jiang, X. Ma, S. Chen, J. Bailey, Y.-G. Jiang, “Black-box adversarial attacks on video recognition model” in Proceedings of the 27th ACM International Conference on Multimedia, 2019, pp.
0.81
864–872. [17] C. Sitawarin, A. N. Bhagoji, A. Mosenia, M. Chiang, and P. Mittal,
[19] W. Brendel, J. Rauber, and M. Bethge, “Decision-based adversarial attacks: Reliable attacks against black-box machine learning models,” arXiv preprint arXiv:1712.04248, 2017.
W. Brendel, J. Rauber, and M. Bethge, “Decision-based adversarial attack: Reliable attacks against black-box machine learning model, arXiv preprint arXiv:1712.04248, 2017”。
0.89
英語（論文から抽出）
日本語訳
スコア
Fig. 10.
フィギュア。 10.
0.64
Visual Results on GTSRB - 2.
GTSRB - 2のビジュアル結果。
0.72
True class of the input image is 9.
入力画像の真のクラスは9である。
0.78
M-SimBA flattens the distribution of confused class probabilities (red box on M-SimBA plot) compared to the other two attacks.