车牌识别系统的黑盒对抗攻击

深度神经网络(Deep neural network, DNN)作为最常用的深度学习方法之一, 广泛应用于各个领域. 然而, DNN容易受到对抗攻击的威胁, 因此通过对抗攻击来检测应用系统中DNN的漏洞至关重要. 针对车牌识别系统进行漏洞检测, 在完全未知模型内部结构信息的前提下展开黑盒攻击, 发现商用车牌识别系统存在安全漏洞. 提出基于精英策略的非支配排序遗传算法(NSGA-II)的车牌识别黑盒攻击方法, 仅获得输出类标及对应置信度, 即可产生对环境变化较为鲁棒的对抗样本, 而且该算法将扰动控制为纯黑色块, 可用淤泥块代替, 具有较强的迷惑性. 为验证本方法在真实场景的攻击可复现性, 分别在实验室和真实环境中对车牌识别系统展开攻击, 并且将对抗样本用于开源的商业软件中进行测试, 验证了攻击的迁移性.

Black-box Adversarial Attack on License Plate Recognition System

Deep neural network(DNN)is one of the most commonly used deep learning methods and is widely used in various fields.However,DNN is vulnerable to adversarial attacks,so it is crucial to detect the vulnerabilities of DNN in the application system by adversarial attacks.In this paper,the vulnerability detection of the license plate recognition system is carried out.Under the premise of completely unknown internal structure information of the model,a black-box adversarial attack is launched,and security vulnerabilities in commercial license plate recognition system are found.The paper first proposes a black-box attack method for license plate recognition based on NSGA-II.Only by obtaining the output class label and corresponding confidence can produce a robust attack against environmental changes,and the algorithm controls the perturbation as a pure black block,which can be replaced by a silt block and has strong confusion.In order to verify the reproducibility of the attack of this method in real scenes,the license plate recognition system was attacked in the laboratory and the real environment,and the adversarial examples were tested in open source commercial software to verify the transferability of the attack.