0%

Adversarial attack

攻击神经网络

Fast Gradient Method (Explaining & Harnessing Adversarial Examples)

linear model:

y=wTx=wTx+wTσ

where σ is the change of original input x, and we have:
σ=εsign(w)
理解: 在保持|σ| 不变情况下,y’ 变化最大只可能 使 wTσ=|w|1

DNN
σ=εsign(xJ(θ,x,ytrue))

where J is the loss function. In most cases (soft-max as classifier layer)

理解: 要让y’变化最大,及 应向loss 变大的方向变化。 即若(xJ(θ,x,y)) 为负数(loss 与 x 的gradient)则 x应变小 (σ需为负数)

Iterative method

Basic iterative method

update equation (1) x2=x1+σ

Targeted

(3) becomes:
σ=εsign(xJ(θ,x,ytargeted))

Our Method

What we have known and what we can obtained now?
  • Printable image size:

    P(i,j) as the indexed boxes with size: Black/white box: Ph×Pw

  • Actual image (100×100) per frame.

    SI: starting index of the billboard for each frame.

    RI: range of the billboard for each frame.

    GI: gradient of each pixel in the bill board/

What we need to calculate

GP :gradient of each box in P.

How?

Transform:

  • Nearest

  • SPP:

  • Binary

Powered By Valine
v1.5.2