论文标题
对抗性示例转移到攻击基于云的图像分类器服务
Transferability of Adversarial Examples to Attack Cloud-based Image Classifier Service
论文作者
论文摘要
近年来，深度学习（DL）技术已被广泛部署到计算机视觉任务，尤其是视觉分类问题，其中据报道新算法可以实现甚至超过人类的性能。尽管最近的许多作品表明DL模型容易受到对抗示例的影响。幸运的是，生成对抗性示例通常需要对受害者模型进行白色框访问，而基于现实的云的图像分类服务比白盒分类器更复杂，云平台上DL模型的体系结构和参数无法由攻击者获得。攻击者只能访问云平台打开的API。因此，将模型保持在云中通常可以给出（错误的）安全感。在本文中，我们主要专注于研究基于云的现实图像分类服务的安全性。具体而言，（1）我们提出了一种基于替代模型的新型攻击方法，快速特征损失PGD（FFL-PGD）攻击，该攻击达到了高旁路率，查询数量非常有限。我们的方法没有在先前的研究中进行数百万个查询，而是使用每个图像的两个查询找到了对抗性示例。 （2）我们首次尝试对针对基于云的现实云的分类服务进行黑盒攻击进行广泛的实证研究。通过在包括亚马逊，Google，Microsoft，Clarifai在内的四个流行云平台上进行评估，我们证明了FFL-PGD攻击在不同的分类服务中的成功率超过90 \％。 （3）我们讨论了在基于云的分类服务中解决这些安全挑战的可能防御。我们的防御技术主要分为模型训练阶段和图像预处理阶段。
In recent years, Deep Learning(DL) techniques have been extensively deployed for computer vision tasks, particularly visual classification problems, where new algorithms reported to achieve or even surpass the human performance. While many recent works demonstrated that DL models are vulnerable to adversarial examples. Fortunately, generating adversarial examples usually requires white-box access to the victim model, and real-world cloud-based image classification services are more complex than white-box classifier,the architecture and parameters of DL models on cloud platforms cannot be obtained by the attacker. The attacker can only access the APIs opened by cloud platforms. Thus, keeping models in the cloud can usually give a (false) sense of security. In this paper, we mainly focus on studying the security of real-world cloud-based image classification services. Specifically, (1) We propose a novel attack method, Fast Featuremap Loss PGD (FFL-PGD) attack based on Substitution model, which achieves a high bypass rate with a very limited number of queries. Instead of millions of queries in previous studies, our method finds the adversarial examples using only two queries per image; and (2) we make the first attempt to conduct an extensive empirical study of black-box attacks against real-world cloud-based classification services. Through evaluations on four popular cloud platforms including Amazon, Google, Microsoft, Clarifai, we demonstrate that FFL-PGD attack has a success rate over 90\% among different classification services. (3) We discuss the possible defenses to address these security challenges in cloud-based classification services. Our defense technology is mainly divided into model training stage and image preprocessing stage.
