PIDI-FGSM:一种对抗样本生成的梯度处理新方法

深度神经网络在多种模式识别任务上均取得卓越表现，然而相关研究表明深度神经网络非常脆弱，极易受到对抗样本的攻击。且人眼不易察觉的对抗样本还具有迁移性，即针对某个模型生成的对抗样本能够使得其他不同的深度模型也产生误判。主要研究提升对抗样本的迁移性，提出了基于PID控制优化器的快速梯度符号方法（PIDI-FGSM），用于替代原有的基于动量优化器生成方法（MI-FGSM）。不同于MI-FGSM只累加一阶动量项，PIDI-FGSM同时考虑当前梯度、一阶动量项和一阶微分动量项。此外，PIDI-FGSM经过相应变化后，可与现有其他对抗样本生成方法相结合，在不需要额外运行时间和运算资源的情况下大大提高了对抗样本对于黑盒防御模型的攻击成功率。在ImageNet数据集上的实验表明，结合了PIDI-FGSM的对抗样本生成方法能够更快速地生成攻击成功率更高的对抗样本。通过提出最强攻击组合NI-TI-DI-PIDM2，对6个经典黑盒防御模型的平均攻击达到87.4%的成功率，比现有的动量方法提高3.8%，对3个较为先进的黑盒防御模型的平均攻击达到80.0%的成功率，比现有的动量方法提高4.9%。

Generating Adversarial Examples with PID Iterative Fast Gradient Sign Method

Deep neural networks (DNNs) have achieved excellent performance on a variety of pattern recognition tasks. However, related studies have shown that DNNs are vulnerable to adversarial examples. In addition, adversarial examples that are difficult to detect by human eye are also transferable. In other words, adversarial examples crafted by a known DNN can also fool other black-box DNNs. This paper focuses on improving the transferability of adversarial examples and proposes a PID iterative fast gradient sign method (PIDI-FGSM) based on a PID control optimizer to replace the original momentum iterative fast gradient method (MI-FGSM). Unlike MI-FGSM, which only accumulates first-order momentum terms, PIDI-FGSM simultaneously takes into consideration the current gradient, first-order momentum terms, and first-order differential momentum terms. In addition, with some modifications, PIDI-FGSM can be combined with other existing adversarial example generation methods to greatly improve the attack success rate of adversarial examples against black-box defense models without requiring additional runtime and computing resources. The experiments on the ImageNet dataset show that the adversarial example generating methods combined with PIDI-FGSM can generate adversarial examples with a higher attack success rate and at a higher speed. The strongest attack combination NI-TI-DI-PIDM2 proposed in this paper can achieve an average attack success rate of 87.4% against the six classic black-box defense models and 80.0% against the three more advanced models, exceeding the existing momentum method by 3.8% and 4.9% respectively.