2019 年11月29日に行われた、「全脳アーキテクチャ若手の会第45会カジュアルトーク」での15分間の発表のスライドです。
数式は一切登場しません。
参考文献
[1] D. Hendrycks and T. Dietterich, “Benchmarking Neural Network Robustness to Common Corruptions and Perturbations,” 2019.
[2] A. Ilyas, S. Santurkar, D. Tsipras, L. Engstrom, B. Tran, and A. Madry, “Adversarial Examples Are Not Bugs, They Are Features,” May 2019.
[3] S. Santurkar, D. Tsipras, B. Tran, A. Ilyas, L. Engstrom, and A. Madry, “Computer Vision with a Single (Robust) Classifier,” Jun. 2019.
[4] D. Su, H. Zhang, H. Chen, J. Yi, P. Y. Chen, and Y. Gao, “Is robustness the cost of accuracy? – A comprehensive study on the robustness of 18 deep image classification models,” Lect. Notes Comput. Sci. (including Subser. Lect. Notes Artif. Intell. Lect. Notes Bioinformatics), vol. 11216 LNCS, pp. 644–661, Aug. 2018.
[5] M. A. Alcorn et al., “Strike (with) a Pose: Neural Networks Are Easily Fooled by Strange Poses of Familiar Objects,” Nov. 2018.
[6] S. Thys, W. Van Ranst, and T. Goedemé, “Fooling automated surveillance cameras: adversarial patches to attack person detection,” 2019.
[7] D. Tsipras, S. Santurkar, L. Engstrom, A. Turner, and A. Madry, “Robustness May Be at Odds with Accuracy,” 2018.
[8] R. Geirhos, P. Rubisch, C. Michaelis, M. Bethge, F. A. Wichmann, and W. Brendel, “ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness,” Nov. 2018.
[9] A. Athalye, L. Engstrom, A. Ilyas, and K. Kwok, “Synthesizing Robust Adversarial Examples,” 2018.
[10] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and Harnessing Adversarial Examples,” Dec. 2014.
[11] L. Engstrom, A. Ilyas, S. Santurkar, D. Tsipras, B. Tran, and A. Madry, “Learning Perceptually-Aligned Representations via Adversarial Robustness,” 2019.
[12] N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, and A. Swami, “Practical Black-Box Attacks against Machine Learning,” Feb. 2016.
11. 精度 VS 安全性
D. Tsipras, S. Santurkar, L. Engstrom, A.
Turner, and A. Madry, “Robustness May Be
at Odds with Accuracy,” 2018.
Adversarial trainingを行ったCNNは標準の
学習をしたCNNに比べて低精度
精度と敵対的サンプルへの防御力は両立
しない！？
* CNN: 畳み込みニューラルネットワーク
2019/11/29ADVERSARIAL EXAMPLE, FUKUCHI AKIHIKO 14
12. 精度 VS 安全性
D. Su, H. Zhang, H. Chen, J. Yi, P. Y. Chen, and Y.
Gao, “Is robustness the cost of accuracy? – A
comprehensive study on the robustness of 18
deep image classification models,” Lect. Notes
Comput. Sci. (including Subser. Lect. Notes Artif.
Intell. Lect. Notes Bioinformatics), vol. 11216
LNCS, pp. 644–661, Aug. 2018.
CNNのモデルのロバスト性の比較
標準の精度が高いモデルが高いほ
ど敵対的サンプルの攻撃に弱い
精度と安全性のトレードオフ
2019/11/29ADVERSARIAL EXAMPLE, FUKUCHI AKIHIKO 15
13. そもそもCNNはヒトと違う特徴を見てる
R. Geirhos, P. Rubisch, C. Michaelis, M. Bethge, F. A. Wichmann, and W. Brendel, “ImageNet-trained
CNNs are biased towards texture; increasing shape bias improves accuracy and robustness,” Nov. 2018.
CNNはテクスチャを判断の根拠にしがち。あまり形（空間的な配置）を見ていない。
2019/11/29ADVERSARIAL EXAMPLE, FUKUCHI AKIHIKO 16
14. CNNは何を見ているんだ？
A. Ilyas, S. Santurkar, D. Tsipras, L. Engstrom, B.
Tran, and A. Madry, “Adversarial Examples Are
Not Bugs, They Are Features,” May 2019.
Adversarial trainingをしたネットワークを用い
て、敵対的サンプルに対して「ロバストな特徴
量」と「ロバストでない特徴量」を抽出
人間には知覚できないような「弱い」特徴量を
使うことで、高精度を出しているのでは？
＊「ロバストでない特徴量」については批判的な議論もある
L. Engstrom et al., “A Discussion of ‘Adversarial Examples Are Not Bugs, They Are Features,’” Distill,
vol. 4, no. 8, p. e19, Aug. 2019.
2019/11/29ADVERSARIAL EXAMPLE, FUKUCHI AKIHIKO 17
“airplane’’ “ship’’ “dog’’ “frog’’“truck’’
DbDNR
bDR
(a)
16. 参考文献
[1] A. Ilyas, S. Santurkar, D. Tsipras, L. Engstrom, B. Tran, and A. Madry, “Adversarial Examples Are Not Bugs, They Are Features,” May 2019.
[2] D. Hendrycks and T. Dietterich, “Benchmarking Neural Network Robustness to Common Corruptions and Perturbations,” 2019.
[3] D. Su, H. Zhang, H. Chen, J. Yi, P. Y. Chen, and Y. Gao, “Is robustness the cost of accuracy? – A comprehensive study on the robustness of 18 deep image
classification models,” Lect. Notes Comput. Sci. (including Subser. Lect. Notes Artif. Intell. Lect. Notes Bioinformatics), vol. 11216 LNCS, pp. 644–661, Aug. 2018.
[4] M. A. Alcorn et al., “Strike (with) a Pose: Neural Networks Are Easily Fooled by Strange Poses of Familiar Objects,” Nov. 2018.
[5] S. Thys, W. Van Ranst, and T. Goedemé, “Fooling automated surveillance cameras: adversarial patches to attack person detection,” 2019.
[6] D. Tsipras, S. Santurkar, L. Engstrom, A. Turner, and A. Madry, “Robustness May Be at Odds with Accuracy,” 2018.
[7] R. Geirhos, P. Rubisch, C. Michaelis, M. Bethge, F. A. Wichmann, and W. Brendel, “ImageNet-trained CNNs are biased towards texture; increasing shape bias
improves accuracy and robustness,” Nov. 2018.
[8] A. Athalye, L. Engstrom, A. Ilyas, and K. Kwok, “Synthesizing Robust Adversarial Examples,” 2018.
[9] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and Harnessing Adversarial Examples,” Dec. 2014.
[10] L. Engstrom, A. Ilyas, S. Santurkar, D. Tsipras, B. Tran, and A. Madry, “Learning Perceptually-Aligned Representations via Adversarial Robustness,” 2019.
[11] N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, and A. Swami, “Practical Black-Box Attacks against Machine Learning,” Feb. 2016.
[12] S. Santurkar, D. Tsipras, B. Tran, A. Ilyas, L. Engstrom, and A. Madry, “Computer Vision with a Single (Robust) Classifier,” Jun. 2019.
[13] L. Engstrom et al., “A Discussion of ‘Adversarial Examples Are Not Bugs, They Are Features,’” Distill, vol. 4, no. 8, p. e19, Aug. 2019.
2019/11/29ADVERSARIAL EXAMPLE, FUKUCHI AKIHIKO 19
20. いろいろな敵対的サンプル
2019/11/29ADVERSARIAL EXAMPLE, FUKUCHI AKIHIKO 23
物体検出器で人間と識別されないようなパッチを作成
S. Thys, W. Van Ranst, and T. Goedemé, “Fooling automated surveillance cameras: adversarial patches to attack person detection,” 2019.
22. いろいろな敵対的サンプル
2019/11/29ADVERSARIAL EXAMPLE, FUKUCHI AKIHIKO 25
M. A. Alcorn et al., “Strike (with) a Pose: Neural Networks Are
Easily Fooled by Strange Poses of Familiar Objects,” Nov.
2018.
ニューラルネットワークが誤識別するような3D オブジェクトの配置を生成
