| As the most prominent representative of artificial intelligence,Deep Neural Network(DNN)has been applied in various fields of our life.However,recent studies show that DNN models with high accuracy are extremely vulnerable to adversarial examples(AEs).AEs are artificially crafted malicious examples that are generated by specific adversarial attack algorithms,which are imperceptible to humans but cause the DNN models to make a wrong prediction or classification with high confidence.Therefore,AE is a significant security weakness in DNN,which exposes the vulnerability of DNN.It is important for improving the robustness of DNN against AEs in the following research and the applications of DNN.This paper researches and improves the robustness of DNN models from the aspects of the cause of AEs,the detection methods of AEs and adversarial training.The main research contents of this article are as follows:(1)This paper proposes the Trap-based Ensemble Adversarial Defense Network,TrapNet.First,adversarial space hypothesis from the feature space perspective is proposed in this paper.Adversarial space hypothesis takes the target data manifold as the center space and divides the model’s feature space into two disjoint space.The target manifold is closely near the target classification transaction.While the adversarial space outside the target manifold and training data is the space that has not been labeled by training data.After that,according to the adversarial space hypothesis,Trap-Net takes the targeted process on the adversarial space,which eliminates the harm of AEs from the root of the feature space perspective.As a detection method of AEs,Trap-Net does not require to design the new external modules nor rely on the information from generated AEs.Trap-Net first marks the adversarial space through trap data and judges whether the input is AEs by identifying whether the output hits the trap label.The experimental results show that Trap-Net has a strong generalization of AEs without losing the accuracy of native data.In the low-perturbation of the white-box attack scenario,Trap-Net has a detection rate of AEs over 85%.In high-perturbation whitebox and black-box attack scenarios,the detection rate of Trap-Net against AEs is almost100%.(2)This paper proposes Padding adversarial training(P-AT),which uses a padding generative function to generate padding data to mark the adversarial space.P-AT can improve the generalization of DNN models and perfectly combines the benefits of AT and the detection mechanism.The experimental results show that the robustness provided by standard AT is maintained under low perturbation conditions,and the detection rate under high perturbation conditions is about 80% to 98%.Noticeably,P-AT increases the upper limit of AT perturbation by 20% compared with traditional AT methods.(3)This paper designs and implements the robustness enhancement system of the image network.First,through analyzing the requirements of the system and designing the architecture and modules of the system,the system is implemented by combining the Trapbased ensemble adversarial defense network and the Padding adversarial training method.Users can select datasets and set parameters by themselves in this system,and finally enhance the robustness of the above two methods for the targeted models.Through the comparison of the model’s accuracy before and after robustness enhancement,there is a significant improvement when the target DNN model is attacked by the prepared adversarial algorithm. |
