針對深度學習型自助結帳系統的對抗性攻擊

Abstract

近年來隨著深度學習的成功發展，日常生活中出現了許多使用深度學習技術的應用。在零售產業上出現了使用深度學習的模型來進行自助結帳，但深度學習的模型容易受到對抗性攻擊所影響，此種狀況下的應用是有安全疑慮的。 本文中提出了在現實中可用來攻擊此種自助結帳系統的方法。藉由在商品上貼上產生特定模式的貼紙，造成辨識系統錯誤判讀。貼紙的紋路由產生對抗樣本的演算法產生，並透過微分進化演算法尋找最適合的擺放位置。 透過這個方法提出了兩種不同目標的的攻擊方式，一種目的在減少模型準確率，另外一種則是將物體轉換為特定的類別。實驗測試在YOLOv3與Faster R-CNN的模型上，可達成有效的攻擊，並且證明了此種攻擊具有可移轉性。根據我們的實驗結果，單純使用深度學習技術的自助結帳系統並不可靠，當遇到惡意的使用者時，可能產生辨識錯誤造成商家損失。

In recent years, with the successful development of deep learning, many applications adopting deep learning techniques have been used in our daily lives. In the retail industry, deep learning models have been used for self-checkout, but deep learning models are vulnerable to adversarial attacks. Such applications have security concerns. This thesis presents a method that can be used to attack such self-checkout systems in practical. The object detection model can be misled by attaching a sticker with a specific pattern to the product. The sticker is generated by an adversarial attack algorithm and is stuck to a specific location which is generated by a differential evolution algorithm. Two different purposes of the above attack are proposed through this method, one for reducing the precision of the model and the other for converting objects into a specific category. Experimental tests on the models of YOLOv3 and Faster R-CNN can achieve effective attacks and prove that such attacks are transferability. According to our experimental results, the self-checkout system only using deep learning object detection model is not reliable. When encountering a malicious user, it may cause identification errors and cause losses to the store.