【作者】 陈诚；

【导师】 王贝伦；

【作者基本信息】 东南大学 ， 计算机应用技术， 2023， 硕士

【摘要】 近年来,深度神经网络凭借其卓越的性能表现,实现了现实社会中应用部署量的爆炸式增长。然而以对抗攻击为首的外部攻击能够误导这些模型做出完全错误的决策输出,严重阻碍了神经网络应用在安全敏感领域的推广。为增强神经网络模型的鲁棒性,研究人员致力于为其设计安全可靠的对抗防御方法,建立高可信度的深度学习模型。现有的对抗防御方法主要针对模型鲁棒性和训练优化方法的鲁棒性而设计,通过采用额外训练、蒸馏模型等方式抵御已知的对抗攻击算法。然而这种针对现有攻击的补丁式防御仍然存在被攻克的风险,无法带来鲁棒性质的提升。此外,许多防御方法在可解释性方面的分析与评估有所欠缺,使得本属于黑盒模型的神经网络变得更难以被解释。针对以上问题,本文研究并设计了一种能够涵盖模型建立、训练优化、决策可视化分析这三个涉及神经网络的应用全过程的防御方法机制,全面提升深度神经网络的鲁棒性。具体而言分为以下三点研究成果:针对神经网络模型本身的鲁棒性增强,本文通过分析对抗攻击成功扰乱模型推断的内在原因,提出通过加强神经元的非线性表达能力,并对模型中间层激活结果进行微调的方式提升模型的内在鲁棒性,在不引入额外训练资源消耗的前提下避免模型受对抗攻击的操纵。基于以上成果,本文提出了CARENet架构,该架构采用脉冲神经网络这一受生物学启发、采用非线性脉冲信号传递信息的模型作为主干,并引入了可实现通道式激活再校准的防御模块CARE,通过加强神经元间相互作用抑制神经元的错误激发。通过在多个数据集上进行鲁棒性评估实验,证明了CARENet架构的内在鲁棒性。针对模型训练优化框架的鲁棒性提升,本文选择基于能充分利用大规模无标记数据的自监督学习框架,研究并设计了CLAM框架。该框架以CARENet架构的模型作为特征编码器,采用对比学习模式实现鲁棒性的模型预训练。为促使模型主动学习并提取数据蕴含的鲁棒特征,本文基于对抗性学习策略引入了遮蔽图像模型,通过遮挡目标语义实体部位的方式推动模型根据图像上下文语义进行推理。此外,CLAM框架还通过设计多视角对比模式,引入了传统的对抗训练方法,进一步增强框架鲁棒性。通过实验将CLAM框架与其他融合了对抗防御方法的自监督学习框架进行比较,证明了CLAM框架的鲁棒性优势。针对对抗防御方法的可解释性评估,本文充分利用了脉冲神经网络中脉冲信号所包含的时间信息,通过中间层特征可视化和模型决策结果热力图两种方式分别对CARENet和CLAM框架开展了可视化分析。中间层特征可视化将脉冲信号的时间间隔纳入特征重要性建模过程,模型决策结果热力图则基于Grad-CAM为代表的类激活图方法并综合考虑了多个时间窗口下的特征图。可视化分析结果证明了CARENet和CLAM在防御对抗扰动方面的有效性,并且产生的效果易于解释。综上所述,本文针对当前神经网络面对对抗攻击时的脆弱性和安全隐患,按照“构建鲁棒模型→训练模型提取数据鲁棒特征→在下游任务提供可解释性验证”的思路研究并设计了一整套对抗防御方法,并期望以该方法为基础实现神经网络模型在鲁棒性上的全面增强。更多还原

【Abstract】 Deep neural networks(DNN)have achieved explosive growth in real-world applications due to their superior performance in recent years.However,external attacks led by adversarial attacks are able to mislead these models to make completely wrong outputs,seriously hindering the deployment of neural network applications in security-sensitive fields.To enhance the robustness of DNN,researchers have worked on designing safe and secure adversarial defense methods and establishing highly trustworthy methods for deep learning models.Existing adversarial defense methods are mainly designed for model robustness and robustness of optimization methods against known adversarial attack algorithms by employing additional training,model distillation,etc.However,such patchy defenses against existing attacks still run the risk of being defeated.These defenses fail to bring a true improvement in robustness.In addition,many defense methods lack analysis and evaluation in terms of interpretability,making neural networks,which are originally black-box models,more difficult to be interpreted.To address the above problems,this thesis researches and designs a defense method mechanism that can cover the whole process of model building,training optimization,and decision visualization analysis,which involves the application of neural networks,to improve the robustness of deep neural networks in a comprehensive manner.Specifically,it is divided into the following three research results.For the robustness enhancement of the neural network model itself,this thesis analyzes the intrinsic reasons for the successful disruption of model inference by adversarial attacks.Then it proposes to enhance the inherent robustness of the model by strengthening the nonlinear expression ability of neurons and fine-tuning the activation results of the hidden layers of the model to avoid manipulation by adversarial attacks without introducing additional training.Based on these results,this thesis proposes CARENet,which uses Spiking Neural Network(SNN),a biologically inspired model that uses nonlinear spiking signals to convey information,as its backbone.It also introduces CARE(Channel-wise Activation Recalibration),a defense module that suppresses false activation of neurons by utilizing inter-neuron interactions.The inherent robustness of CARENet is demonstrated through robustness evaluation experiments on diverse datasets.For the robustness enhancement of the model training framework,this thesis chooses to design a framework CLAM based Self-Supervised Learning that can make full use of largescale unlabeled data.CLAM adopts CARENet as the feature encoder.It adopts the contrastive learning framework to achieve robust model pre-training.To motivate the model to actively learn and extract robust features in the data,this thesis introduces a masked image model based on an adversarial learning strategy,which drives the model to reason based on the semantic context by masking the semantic entities of the object.In addition,the CLAM framework also introduces a traditional adversarial training method by adding additional views into CLAM to further enhance its robustness.The robustness advantage of the CLAM framework is proved by comparing CLAM with other baseline SSL frameworks that incorporate adversarial defense methods.To evaluate the interpretability of the adversarial defense method,this thesis makes full use of the temporal information contained in the spiking signals in the spiking neural network.This thesis visualizes the CARENet and CLAM through the intermediate layer feature visualization and the heat map of model decisions,respectively.The intermediate layer feature visualization incorporates the time interval of the spiking signals into the feature importance modeling process,while the model decision heat map is based on the Grad-CAM-like class activation map methods.It integrates the feature maps under multiple time windows.The visualization results demonstrate the effectiveness of CARENet and CLAM in defending against perturbations.It also proves that both methods produce effects that are easy to interpret.In summary,this thesis studies and designs a complete set of defense methods to address the vulnerability and security risks of current neural networks in the face of adversarial attacks.The method follows the idea of ”constructing robust models → training models to extract robust features → providing interpretable verification in downstream tasks”.The method is expected to be used as a basis to achieve a comprehensive enhancement of the robustness in neural network models.更多还原