2.765

2022影响因子

(CJCR)

  • 中文核心
  • EI
  • 中国科技核心
  • Scopus
  • CSCD
  • 英国科学文摘

留言板

尊敬的读者、作者、审稿人, 关于本刊的投稿、审稿、编辑和出版的任何问题, 您可以本页添加留言。我们将尽快给您答复。谢谢您的支持!

姓名
邮箱
手机号码
标题
留言内容
验证码

针对身份证文本识别的黑盒攻击算法研究

徐昌凯 冯卫栋 张淳杰 郑晓龙 张辉 王飞跃

徐昌凯, 冯卫栋, 张淳杰, 郑晓龙, 张辉, 王飞跃. 针对身份证文本识别的黑盒攻击算法研究. 自动化学报, 2024, 50(1): 103−120 doi: 10.16383/j.aas.c230344
引用本文: 徐昌凯, 冯卫栋, 张淳杰, 郑晓龙, 张辉, 王飞跃. 针对身份证文本识别的黑盒攻击算法研究. 自动化学报, 2024, 50(1): 103−120 doi: 10.16383/j.aas.c230344
Xu Chang-Kai, Feng Wei-Dong, Zhang Chun-Jie, Zheng Xiao-Long, Zhang Hui, Wang Fei-Yue. Research on black-box attack algorithm by targeting ID card text recognition. Acta Automatica Sinica, 2024, 50(1): 103−120 doi: 10.16383/j.aas.c230344
Citation: Xu Chang-Kai, Feng Wei-Dong, Zhang Chun-Jie, Zheng Xiao-Long, Zhang Hui, Wang Fei-Yue. Research on black-box attack algorithm by targeting ID card text recognition. Acta Automatica Sinica, 2024, 50(1): 103−120 doi: 10.16383/j.aas.c230344

针对身份证文本识别的黑盒攻击算法研究

doi: 10.16383/j.aas.c230344
基金项目: 科技创新2030 —— “新一代人工智能”重大项目(2020AAA0108401), 北京市自然科学基金(JQ20022), 国家自然科学基金(62072026, 72225011), 中国人工智能学会 —— 昇腾CANN学术基金, OpenI启智社区资助
详细信息
    作者简介:

    徐昌凯:2023年获得北京交通大学计算机与信息技术学院硕士学位. 主要研究方向为计算机视觉与对抗攻防技术. E-mail: 20120320@bjtu.edu.cn

    冯卫栋:北京交通大学硕士研究生. 2022年获得中国地质大学(北京)学士学位. 主要研究方向为计算机视觉与对抗攻防技术. E-mail: wdfeng@bjtu.edu.cn

    张淳杰:北京交通大学计算机与信息技术学院教授. 主要研究方向为图像处理与理解, 计算机视觉和多媒体数据处理与分析. 本文通信作者. E-mail: cjzhang@bjtu.edu.cn

    郑晓龙:中国科学院自动化研究所研究员. 主要研究方向为大数据与社会计算和多模态数据感知与理解. E-mail: xiaolong.zheng@ia.ac.cn

    张辉:北京航空航天大学交通科学与工程学院教授. 主要研究方向为车辆动力学及其控制, 鲁棒控制, 网络控制系统以及信号处理. E-mail: huizhang285@buaa.edu.cn

    王飞跃:中国科学院自动化研究所研究员, 复杂系统管理与控制国家重点实验室主任, 中国科学院大学中国经济与社会安全研究中心主任, 澳门科技大学特聘教授. 主要研究方向为社会计算, 平行智能与知识自动化. E-mail: feiyue.wang@ia.ac.cn

Research on Black-box Attack Algorithm by Targeting ID Card Text Recognition

Funds: Supported by Scientific and Technological Innovation 2030 - “New Generation Artificial Intelligence” of the Ministry of Science and Technology of China (2020AAA0108401), Beijing Natural Science Foundation (JQ20022), National Natural Science Foundation of China (62072026, 72225011), CAAI-CANN Open Foundation, and OpenI Community
More Information
    Author Bio:

    XU Chang-Kai He received his master degree from the School of Computer and Information Technology, Beijing Jiaotong University in 2023. His research interest covers computer vision and adversarial attack-defense techniques

    FENG Wei-Dong Master student at Beijing Jiaotong University. He received his bachelor degree from China University of Geosciences (Beijing) in 2022. His research interest covers computer vision and adversarial attack-defense techniques

    ZHANG Chun-Jie Professor at the School of Computer and Information Technology, Beijing Jiaotong University. His research interest covers image processing and understanding, computer vision and multimedia data processing and analysis. Corresponding author of this paper

    ZHENG Xiao-Long Professor at the Institute of Automation, Chinese Academy of Sciences. His research interest covers big data and social computing, and multimodal data sensing and understanding

    ZHANG Hui Professor at the School of Transportation Science and Engineering, Beihang University. His research interest covers vehicle dynamics and control, robust control, networked control systems, and signal processing

    WANG Fei-Yue Professor at the Institute of Automation, Chinese Academy of Sciences, director of the State Key Laboratory for Management and Control of Complex Systems, director of China Economic and Social Security Research Center at University of Chinese Academy of Sciences, distinguished professor at Macau University of Science and Technology. His research interest covers social computing, parallel intelligence, and knowledge automation

  • 摘要: 身份证认证场景多采用文本识别模型对身份证图片的字段进行提取、识别和身份认证, 存在很大的隐私泄露隐患. 并且, 当前基于文本识别模型的对抗攻击算法大多只考虑简单背景的数据(如印刷体)和白盒条件, 很难在物理世界达到理想的攻击效果, 不适用于复杂背景、数据及黑盒条件. 为缓解上述问题, 本文提出针对身份证文本识别模型的黑盒攻击算法, 考虑较为复杂的图像背景、更严苛的黑盒条件以及物理世界的攻击效果. 本算法在基于迁移的黑盒攻击算法的基础上引入二值化掩码和空间变换, 在保证攻击成功率的前提下提升了对抗样本的视觉效果和物理世界中的鲁棒性. 通过探索不同范数限制下基于迁移的黑盒攻击算法的性能上限和关键超参数的影响, 本算法在百度身份证识别模型上实现了100%的攻击成功率. 身份证数据集后续将开源.
  • 图  1  针对图像分类模型的对抗样本[14] (左: 正常样本,中: 对抗噪声, 右: 对抗样本)

    Fig.  1  Adversarial examples for the image classification model[14] (Left: normal samples, Middle: Adversarial noise, Right: Adversarial examples)

    图  2  几种典型的黑盒迁移攻击算法关系图[29]

    Fig.  2  Relationships among several transfer-based black-box adversarial attacks[29]

    图  3  CRNN文本识别模型架构图[30] (CNN表示卷积神经网络. “-”表示空字符)

    Fig.  3  CRNN text recognition model architecture diagram[30] (CNN stands for convolutional neural network. “-” indicates a null character)

    图  4  当前工作生成的对抗样本示例图[32-37]

    Fig.  4  Adversarial examples generated by recent work[32-37]

    图  5  针对身份证识别模型的黑盒对抗攻击算法流程图 (身份证信息为随机生成)

    Fig.  5  Pipeline of the black-box adversarial attack algorithm for ID card recognition model (Information on ID card is randomly generated)

    图  6  身份证数据集样张

    Fig.  6  Examples of the ID card dataset

    图  7  不同范数限制下的攻击成功率趋势图 (上: 针对mbv3的黑盒攻击实验, 下: 针对res34的黑盒攻击实验)

    Fig.  7  Trend graph of attack success rate under different norm constraints (Top: Black-box attack experiment for mbv3; Bottom: Black-box attack experiment for res34)

    图  8  不同卷积核大小下的攻击成功率趋势图 (左: 针对res34的黑盒攻击结果, 右: 针对mbv3的黑盒攻击结果)

    Fig.  8  Trend chart of attack success rate under different convolution kernel sizes (Left: Black-box attack results against res34; Right: Black-box attack results against mbv3)

    图  9  不同卷积核尺寸生成的对抗样本示例图

    Fig.  9  Adversarial examples generated with different convolution kernel sizes

    图  10  二值化掩码消融实验中生成的对抗样本示例图

    Fig.  10  Adversarial examples generated in the ablation experiment of the binarized mask

    图  11  身份证对抗样本及百度身份证模型识别结果 (第一行: 加入二值化掩码, 第二行: 剔除二值化掩码)

    Fig.  11  ID card adversarial examples and Baidu ID card recognition results (The first line: Add binarization mask; The second line: Cancel binarization mask)

    图  12  不同拍摄距离和光照下的身份证对抗样本

    Fig.  12  ID card adversarial examples under different shooting distances and lighting conditions

    表  1  本工作与已有工作的对比

    Table  1  Comparison of this work with existing work

    工作攻击条件图像数据攻击方式商用模型物理世界
    1白盒白色背景基于优化$\times$$\times$
    2白盒白色背景基于梯度 + 水印$\times$$\times$
    3白盒彩色背景基于梯度 + 优化$\checkmark$$\times$
    4黑盒彩色背景基于查询$\checkmark$$\times$
    5白盒白色背景多方式集成$\times$$\times$
    6白盒灰色背景基于梯度$\times$$\times$
    7白盒彩色背景基于优化$\times$$\times$
    8白盒灰色背景基于生成$\times$$\times$
    9白盒灰色背景基于优化$\checkmark$$\times$
    本文黑盒彩色背景基于迁移 + 二值化掩码$\checkmark$$\checkmark$
    下载: 导出CSV

    表  2  身份证关键字段文本图像生成标准

    Table  2  ID card key field text image generation standard

    类别字典长度字段长度频率训练集测试集
    文字6270姓名[2, 4]5011087511088
    住址[1, 11]15015675015675
    数字11出生日期[1, 4]5000200002000
    身份证号1818000100001000
    下载: 导出CSV

    表  3  第一组实验中针对替代模型res34的白盒攻击结果

    Table  3  White-box attack results against the surrogate model res34 in the first set of experiments

    评价指标白盒条件范数限制指标均值
    对抗攻击算法481632486480
    攻击成功率(%)MI-FGSM100.00100.00100.00100.00100.00100.00100.00100.00
    TMI-FGSM100.00100.00100.00100.00100.00100.00100.00100.00
    SI-NI-TMI88.24100.00100.00100.00100.00100.00100.0098.32
    DMI-FGSM96.4798.82100.00100.00100.00100.00100.0099.33
    SI-NI-DMI100.00100.00100.00100.00100.00100.00100.00100.00
    DI-TIM90.5992.9498.82100.00100.00100.00100.0097.48
    VNI-SI-DI-TIM92.9498.82100.00100.00100.00100.00100.0098.82
    平均编辑距离MI-FGSM0.46120.61200.82030.93820.97050.99100.99390.83
    TMI-FGSM0.43280.63990.83450.91900.95190.91690.99030.81
    SI-NI-TMI0.31560.42000.56790.65800.75360.80830.84540.62
    DMI-FGSM0.41480.57570.73790.89070.93750.96930.98690.79
    SI-NI-DMI0.50380.66760.79980.88890.97160.97640.98870.83
    DI-TIM0.32790.41150.54320.66890.70930.76850.80070.60
    VNI-SI-DI-TIM0.40460.51940.61160.68760.75060.77300.83780.65
    下载: 导出CSV

    表  4  第二组实验中针对替代模型mbv3的白盒攻击结果

    Table  4  White-box attack results against the surrogate model mbv3 in the second set of experiments

    评价指标白盒条件范数限制指标均值
    对抗攻击算法481632486480
    攻击成功率(%)MI-FGSM100.00100.00100.00100.00100.00100.00100.00100.00
    TMI-FGSM98.82100.00100.00100.00100.00100.00100.00100.00
    SI-NI-TMI98.82100.00100.00100.00100.00100.00100.0099.83
    DMI-FGSM95.29100.00100.00100.00100.00100.00100.0099.33
    SI-NI-DMI98.82100.00100.00100.00100.00100.00100.00100.00
    DI-TIM90.5998.82100.00100.00100.00100.00100.0098.49
    VNI-SI-DI-TIM90.5995.2998.82100.00100.00100.00100.0097.81
    平均编辑距离MI-FGSM0.65400.69110.85570.95940.98950.99450.99750.88
    TMI-FGSM0.66830.69300.89010.96520.99820.99910.99960.89
    SI-NI-TMI0.57560.63480.79500.92630.98760.99270.99560.84
    DMI-FGSM0.52270.64200.75920.93950.97010.98130.98590.83
    SI-NI-DMI0.64780.78810.89620.98330.99410.99650.99900.90
    DI-TIM0.52940.62570.73600.84300.87560.91360.95070.78
    VNI-SI-DI-TIM0.46190.57400.62400.73920.82170.88870.91760.72
    下载: 导出CSV

    表  5  第一组实验中针对黑盒模型mbv3的黑盒攻击结果

    Table  5  Black-box attack results against the black-box model mbv3 in the first set of experiments

    评价指标黑盒条件范数限制指标均值
    对抗攻击算法481632486480
    攻击成功率(%)MI-FGSM7.067.0618.8241.1862.3587.0690.5944.87
    TMI-FGSM7.067.0612.9435.2947.0671.7690.5938.82
    SI-NI-TMI7.067.0617.6536.4767.0684.7189.4144.20
    DMI-FGSM7.067.0612.9449.4188.2494.1298.8251.09
    SI-NI-DMI7.069.4116.4763.5387.0695.29100.0054.12
    DI-TIM7.069.4121.1837.6564.7188.2489.4145.38
    VNI-SI-DI-TIM7.069.4116.4775.2992.9496.67100.0056.83
    平均编辑距离MI-FGSM0.03160.03160.04460.13860.20620.31480.41560.17
    TMI-FGSM0.03160.03160.03980.11520.15350.28150.39210.15
    SI-NI-TMI0.03160.03160.05260.11610.2330.31530.42650.17
    DMI-FGSM0.03160.03160.06310.15450.3620.41910.59420.24
    SI-NI-DMI0.03160.04020.06160.22520.38620.49430.56950.26
    DI-TIM0.03160.03500.05770.13900.21790.32890.43310.18
    VNI-SI-DI-TIM0.03160.03780.05190.26090.44500.52630.62020.28
    下载: 导出CSV

    表  6  第二组实验中针对黑盒模型res34的黑盒攻击结果

    Table  6  Black-box attack results against the black-box model res34 in the second set of experiments

    评价指标黑盒条件范数限制指标均值
    对抗攻击算法481632486480
    攻击成功率(%)MI-FGSM7.067.0627.0658.8289.4191.7698.8254.28
    TMI-FGSM7.069.4121.1855.2983.5389.4195.2951.60
    SI-NI-TMI7.069.4123.5362.3588.2489.4197.6553.95
    DMI-FGSM7.068.2430.5983.2491.2995.46100.0059.41
    SI-NI-DMI5.887.0636.4787.0694.12100.00100.0061.51
    DI-TIM7.069.4123.5362.3588.2490.59100.0054.45
    VNI-SI-DI-TIM7.064.7140.0089.4197.65100.00100.0062.69
    平均编辑距离MI-FGSM0.01820.02010.08100.28210.46290.54470.64660.29
    TMI-FGSM0.01820.02100.07260.24410.42710.47970.51730.25
    SI-NI-TMI0.01820.02540.06540.28330.44350.51060.56900.27
    DMI-FGSM0.01820.01920.08150.48070.65090.73770.84330.40
    SI-NI-DMI0.01730.01850.10240.49610.69310.75050.87710.42
    DI-TIM0.01820.02320.09080.30270.45060.51380.62110.29
    VNI-SI-DI-TIM0.01820.01690.10210.47450.64710.81970.96200.43
    下载: 导出CSV

    表  7  第三组实验中针对黑盒模型res34-att的黑盒攻击结果

    Table  7  Black-box attack results against the black-box model res34-att in the third set of experiments

    评价指标黑盒条件范数限制指标均值
    对抗攻击算法81632486480
    攻击成功率(%)MI-FGSM65.1774.7684.1394.5799.07100.0086.28
    TMI-FGSM65.6769.6280.8399.04100.00100.0083.03
    SI-NI-TMI70.8270.5685.0395.74100.00100.0087.02
    DMI-FGSM65.6075.5280.3999.4599.81100.0086.80
    SI-NI-DMI65.0075.9269.6490.1099.42100.0083.35
    DI-TIM74.7276.4782.4494.0198.6698.9687.55
    VNI-SI-DI-TIM70.3465.7489.82100.00100.00100.0087.65
    平均编辑距离MI-FGSM0.77000.78000.78000.80000.85000.96000.8200
    TMI-FGSM0.76930.77430.78420.80250.86180.97150.8270
    SI-NI-TMI0.77010.77500.78230.80680.87410.94450.8257
    DMI-FGSM0.76990.77450.78010.79720.86450.96390.8250
    SI-NI-DMI0.76980.77450.78140.80000.86220.96520.8260
    DI-TIM0.68470.80350.78400.77960.84580.99090.8148
    VNI-SI-DI-TIM0.76900.77690.78410.81000.87560.99000.8340
    下载: 导出CSV

    表  8  第三组实验中针对黑盒模型NRTR的黑盒攻击结果

    Table  8  Black-box attack results against the black-box model NRTR in the third set of experiments

    评价指标黑盒条件范数限制指标均值
    对抗攻击算法81632486480
    攻击成功率(%)MI-FGSM59.2974.9384.0594.5999.08100.0085.32
    TMI-FGSM65.1169.3379.4599.3299.6599.6285.41
    SI-NI-TMI69.1969.7784.0894.5198.9699.0685.93
    DMI-FGSM64.1074.9579.39100.0099.0899.6186.19
    SI-NI-DMI64.3974.3769.0688.8999.0199.2782.50
    DI-TIM74.7676.7380.5793.2696.9898.5186.80
    VNI-SI-DI-TIM69.4665.0888.6399.4999.60100.0087.04
    平均编辑距离MI-FGSM0.74930.74140.72700.77650.83020.93570.7933
    TMI-FGSM0.75330.76020.79550.75060.86731.00990.8228
    SI-NI-TMI0.78050.76180.80340.76460.89520.93100.8228
    DMI-FGSM0.76120.74750.79290.75230.82450.95290.8052
    SI-NI-DMI0.77810.74530.79280.81430.80720.92820.8110
    DI-TIM0.70370.74940.74280.75760.83730.95090.8076
    VNI-SI-DI-TIM0.78280.80200.76530.82930.83070.93570.8243
    下载: 导出CSV

    表  9  卷积核尺寸消融实验, 第一组实验中针对黑盒模型res34的攻击结果

    Table  9  Convolution kernel size ablation experiment, the attack results against the black-box model res34 in the first set of experiments

    评价指标黑盒条件范数限制指标均值
    卷积核对抗攻击算法481632486480
    攻击成功率(%)$5\times5$TMI7.067.068.2123.9731.3455.4977.9830.16
    VNI-SI-DI-TIM7.068.1113.5666.3780.7187.6793.3850.98
    $15\times15$TMI7.067.0612.9435.2947.0671.7690.5938.82
    VNI-SI-DI-TIM7.069.4116.4775.2992.9496.67100.0056.83
    下载: 导出CSV

    表  10  卷积核尺寸消融实验, 第二组实验中针对黑盒模型mbv3的攻击结果

    Table  10  Convolution kernel size ablation experiment, the attack results against the black-box model mbv3 in the second set of experiments

    评价指标黑盒条件范数限制指标均值
    卷积核对抗攻击算法481632486480
    攻击成功率(%)$5\times5$TMI5.887.0615.6744.3172.1579.7684.8144.23
    VNI-SI-DI-TIM5.887.0629.8678.0385.6988.9692.1155.37
    $15\times15$TMI7.069.4121.1855.2983.5389.4195.2951.60
    VNI-SI-DI-TIM7.064.7140.0089.4197.65100.00100.0062.69
    下载: 导出CSV

    表  11  针对百度身份证识别模型的攻击结果

    Table  11  Attack results against Baidu ID card recognition model

    评价指标对抗攻击算法字段范数限制指标均值
    VNI-SI-DI-TIM48648096128
    攻击成功率(%)二值化掩码$ \checkmark$姓名112458410048.4
    身份证号29448010047.0
    $\times$姓名215468610049.8
    身份证号211468210048.2
    下载: 导出CSV
  • [1] Krizhevsky A, Sutskever I, Hinton G E. ImageNet classification with deep convolutional neural networks. In: Proceedings of the 25th International Conference on Neural Information Processing Systems. Lake Tahoe, USA: Curran Associates Inc., 2012. 1097−1105
    [2] Liu Z, Mao H Z, Wu C Y, Feichtenhofer C, Darrell T, Xie S N. A ConvNet for the 2020s. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). New Orleans, USA: IEEE, 2022. 11966−11976
    [3] Bahdanau D, Chorowski J, Serdyuk D, Brakel P, Bengio Y. End-to-end attention-based large vocabulary speech recognition. In: Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). Shanghai, China: IEEE, 2016. 4945−4949
    [4] Afkanpour A, Adeel S, Bassani H, Epshteyn A, Fan H B, Jones I, et al. BERT for long documents: A case study of automated ICD coding. In: Proceedings of the 13th International Workshop on Health Text Mining and Information Analysis (LOUHI). Abu Dhabi, United Arab Emirates: Association for Computational Linguistics, 2022. 100−107
    [5] Ouyang L, Wu J, Jiang X, Almeida D, Wainwright C L, Mishkin P, et al. Training language models to follow instructions with human feedback. In: Proceedings of the 36th Conference on Neural Information Processing Systems (NeurIPS). 2022. 27730−27744
    [6] Silver D, Huang A, Maddison C J, Guez A, Sifre L, van den driessche G, et al. Mastering the game of Go with deep neural networks and tree search. Nature, 2016, 529(7587): 484-489 doi: 10.1038/nature16961
    [7] Jumper J, Evans R, Pritzel A, Green T, Figurnov M, Ronneberger O, et al. Highly accurate protein structure prediction with AlphaFold. Nature, 2021, 596(7873): 583-589 doi: 10.1038/s41586-021-03819-2
    [8] Sallam M. ChatGPT utility in healthcare education, research, and practice: Systematic review on the promising perspectives and valid concerns. Healthcare, 2023, 11(6): Article No. 887 doi: 10.3390/healthcare11060887
    [9] Wang J K, Yin Z X, Hu P F, Liu A S, Tao R S, Qin H T, et al. Defensive patches for robust recognition in the physical world. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). New Orleans, USA: IEEE, 2022. 2446−2455
    [10] Yuan X Y, He P, Zhu Q L, Li X L. Adversarial examples: Attacks and defenses for deep learning. IEEE Transactions on Neural Networks and Learning Systems, 2019, 30(9): 2805-2824 doi: 10.1109/TNNLS.2018.2886017
    [11] Wang B H, Li Y Q, Zhou P. Bandits for structure perturbation-based black-box attacks to graph neural networks with theoretical guarantees. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). New Orleans, USA: IEEE, 2022. 13369−13377
    [12] Jia X J, Zhang Y, Wu B Y, Ma K, Wang J, Cao X C. LAS-AT: Adversarial training with learnable attack strategy. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). New Orleans, USA: IEEE, 2022. 13388−13398
    [13] Li T, Wu Y W, Chen S Z, Fang K, Huang X L. Subspace adversarial training. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). New Orleans, USA: IEEE, 2022. 13399−13408
    [14] Xu C K, Zhang C J, Yang Y W, Yang H Z, Bo Y J, Li D Y, et al. Accelerate adversarial training with loss guided propagation for robust image classification. Information Processing & Management, 2023, 60(1): Article No. 103143
    [15] Chen Z Y, Li B, Xu J H, Wu S, Ding S H, Zhang W Q. Towards practical certifiable patch defense with vision transformer. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). New Orleans, USA: IEEE, 2022. 15127−15137
    [16] Suryanto N, Kim Y, Kang H, Larasati H T, Yun Y, Le T T H, et al. DTA: Physical camouflage attacks using differentiable transformation network. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). New Orleans, USA: IEEE, 2022. 15284−15293
    [17] Zhong Y Q, Liu X M, Zhai D M, Jiang J J, Ji X Y. Shadows can be dangerous: Stealthy and effective physical-world adversarial attack by natural phenomenon. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). New Orleans, USA: IEEE, 2022. 15324−15333
    [18] Chen P Y, Zhang H, Sharma Y, Yi J F, Hsieh C J. ZOO: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In: Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security. Dallas, USA: ACM, 2017. 15−26
    [19] Ilyas A, Engstrom L, Athalye A, Lin J. Black-box adversarial attacks with limited queries and information. In: Proceedings of the 35th International Conference on Machine Learning (ICML). Stockholm, Sweden: PMLR, 2018. 2137−2146
    [20] Uesato J, O'donoghue B, Kohli P, Oord A. Adversarial risk and the dangers of evaluating against weak attacks. In: Proceedings of the 35th International Conference on Machine Learning (ICML). Stockholm, Sweden: PMLR, 2018. 5025−5034
    [21] Li Y D, Li L J, Wang L Q, Zhang T, Gong B Q. NATTACK: Learning the distributions of adversarial examples for an improved black-box attack on deep neural networks. In: Proceedings of the 36th International Conference on Machine Learning (ICML). Long Beach, USA: PMLR, 2019. 3866−3876
    [22] Brendel W, Rauber J, Bethge M. Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. In: Proceedings of the 6th International Conference on Learning Representations (ICLR). Vancouver, Canada: OpenReview.net, 2018.
    [23] Dong Y P, Su H, Wu B Y, Li Z F, Liu W, Zhang T, et al. Efficient decision-based black-box adversarial attacks on face recognition. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). Long Beach, USA: IEEE, 2019. 7706−7714
    [24] Rahmati A, Moosavi-Dezfooli S M, Frossard P, Dai H Y. GeoDA: A geometric framework for black-box adversarial attacks. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). Seattle, USA: IEEE, 2020. 8443−8452
    [25] Dong Y P, Liao F Z, Pang T Y, Su H, Zhu J, Hu X L, et al. Boosting adversarial attacks with momentum. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. Salt Lake City, USA: IEEE, 2018. 9185−9193
    [26] Lin J D, Song C B, He K, Wang L W, Hopcroft J E. Nesterov accelerated gradient and scale invariance for adversarial attacks. In: Proceedings of the 8th International Conference on Learning Representations (ICLR). Addis Ababa, Ethiopia: OpenReview.net, 2020.
    [27] Xie C H, Zhang Z S, Zhou Y Y, Bai S, Wang J Y, Ren Z, et al. Improving transferability of adversarial examples with input diversity. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). Long Beach, USA: IEEE, 2019. 2725−2734
    [28] Dong Y P, Pang T Y, Su H, Zhu J. Evading defenses to transferable adversarial examples by translation-invariant attacks. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). Long Beach, USA: IEEE, 2019. 4307−4316
    [29] Wang X S, He K. Enhancing the transferability of adversarial attacks through variance tuning. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). Nashville, USA: IEEE, 2021. 1924−1933
    [30] Shi B G, Bai X, Yao C. An end-to-end trainable neural network for image-based sequence recognition and its application to scene text recognition. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2017, 39(11): 2298-2304 doi: 10.1109/TPAMI.2016.2646371
    [31] Graves A, Fernández S, Gomez F, Schmidhuber J. Connectionist temporal classification: Labelling unsegmented sequence data with recurrent neural networks. In: Proceedings of the 23rd International Conference on Machine Learning. Pittsburgh Pennsylvania, USA: ACM, 2006. 369−376
    [32] Song C Z, Shmatikov V. Fooling OCR systems with adversarial text images. arXiv preprint arXiv: 1802.05385, 2018.
    [33] Jiang H, Yang J T, Hua G, Li L X, Wang Y, Tu S H, et al. FAWA: Fast adversarial watermark attack. IEEE Transactions on Computers, DOI: 10.1109/TC.2021.3065172
    [34] Xu X, Chen J F, Xiao J H, Gao L L, Shen F M, Shen H T. What machines see is not what they get: Fooling scene text recognition models with adversarial text images. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). Seattle, USA: IEEE, 2020. 12301−12311
    [35] Xu Y K, Dai P W, Li Z K, Wang H J, Cao X C. The best protection is attack: Fooling scene text recognition with minimal pixels. IEEE Transactions on Information Forensics and Security, 2023, 18: 1580-1595 doi: 10.1109/TIFS.2023.3245984
    [36] Zhang J M, Sang J T, Xu K Y, Wu S X, Zhao X, Sun Y F, et al. Robust CAPTCHAs towards malicious OCR. IEEE Transactions on Multimedia, 2021, 23: 2575-2587 doi: 10.1109/TMM.2020.3013376
    [37] Ding K Y, Hu T, Niu W N, Liu X L, He J P, Yin M Y, et al. A novel steganography method for character-level text image based on adversarial attacks. Sensors, 2022, 22(17): Article No. 6497 doi: 10.3390/s22176497
    [38] Yang M K, Zheng H T, Bai X, Luo J B. Cost-effective adversarial attacks against scene text recognition. In: Proceedings of the 25th International Conference on Pattern Recognition (ICPR). Milan, Italy: IEEE, 2021. 2368−2374
    [39] Chen L, Xu W. Attacking optical character recognition (OCR) systems with adversarial watermarks. arXiv preprint arXiv: 2002.03095, 2020.
    [40] 徐昌凯. 基于深度学习的对抗样本防御与生成算法研究 [硕士学位论文], 北京交通大学, 2023.

    Xu Chang-Kai. Research on Adversarial Example Defense and Generation Algorithm Based on Deep Learning [Master thesis], Beijing Jiaotong University, China, 2023.
    [41] Hu Z H, Huang S Y, Zhu X P, Sun F C, Zhang B, Hu X L. Adversarial texture for fooling person detectors in the physical world. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). New Orleans, USA: IEEE, 2022. 13297−13306
    [42] Hu Y C T, Chen J C, Kung B H, Hua K L, Tan D S. Naturalistic physical adversarial patch for object detectors. In: Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV). Montreal, Canada: IEEE, 2021. 7828−7837
    [43] Huang L F, Gao C Y, Zhou Y Y, Xie C H, Yuille A L, Zou X Q, et al. Universal physical camouflage attacks on object detectors. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). Seattle, USA: IEEE, 2020. 717−726
    [44] Athalye A, Engstrom L, Ilyas A, Kwok K. Synthesizing robust adversarial examples. In: Proceedings of the 35th International Conference on Machine Learning (ICML). Stockholm, Sweden: PMLR, 2018. 284−293
  • 加载中
图(12) / 表(11)
计量
  • 文章访问数:  204
  • HTML全文浏览量:  81
  • PDF下载量:  62
  • 被引次数: 0
出版历程
  • 收稿日期:  2023-06-08
  • 录用日期:  2023-10-16
  • 网络出版日期:  2023-11-08
  • 刊出日期:  2024-01-20

目录

    /

    返回文章
    返回