Advbox: a toolbox to generate adversarial examples that fool neural networks
Dou Goodman , Hao Xin✉, Wang Yang✉, Xiong Junfeng、Zhang Huan Baidu X-Lab Beijing, China {wangyang62,
Abstract
In recent years, neural networks have been extensively deployed for computer vision tasks, particularly visual classification problems, where new algorithms reported to achieve or even surpass the human performance. Recent studies have shown that they are all vulnerable to the attack of adversarial examples. Small and often imperceptible perturbations to the input images are sufficient to fool the most powerful neural networks. Advbox is a toolbox suite to not only generate adversarial examples that fool neural networks in PaddlePaddle, PyTorch, Caffe2, MxNet, Keras, TensorFlow, but also benchmarks the robustness of machine learning models. Compared to previous work, our platform supports black box attacks on Machine-Learning-as-a-service, as well as more attack scenarios, such as Face Recognition Attack, Stealth T-shirt, and DeepFake Face Detect. AdvBox is openly available at https://github.com/advboxes/AdvBox. It now supports Python 3.
中文速览
深度神经网络在图像识别等任务上表现亮眼，却极易被"对抗样本"（adversarial examples）欺骗——只需在图片上叠加人眼几乎察觉不到的微小扰动，就能让模型做出错误判断。为此，作者开发了开源工具箱 AdvBox，集成了 FGSM、CW、PGD 等六种主流攻击算法和六种防御算法，并兼容 PaddlePaddle、PyTorch、TensorFlow 等主流深度学习框架，还支持对亚马逊、谷歌等云端机器学习服务（MLaaS）发起黑盒攻击。除了基础攻防能力，AdvBox 还覆盖了三个真实场景：针对 FaceNet 的人脸识别欺骗、能让摄像头"看不见"穿戴者的对抗 T 恤，以及 DeepFake 人脸检测接口。该工具箱填补了现有平台在真实攻击场景和云端黑盒攻击方面的空白，为研究者和安全从业者评估模型鲁棒性提供了一套实用的一站式解决方案。
原文 arXiv:2001.05574;中英对照 + 大白话阅读 https://aha.fim.ai/paper/2001.05574v5