18results about How to "Improve attack success rate" patented technology

The invention discloses an image-to-video cross-modal adversarial sample generation method based on key frame identification. The method comprises the following steps: acquiring a video frame sequence; obtaining a key video clip through a sliding window strategy and the contribution degree of the video clip; selecting a key frame from the key video clip based on an optical flow method; forming a key frame set by all key frames in the key video clip; generating a corresponding confrontation sample for each key frame in the key frame set; and replacing the corresponding key frame in the video frame sequence X with the confrontation sample to obtain a confrontation video sequence of the video frame sequence X. By improving a key frame extraction method and an adversarial disturbance generation technology, the defects that in the prior art, key frame positioning is inaccurate, time sequence information is not fully considered during key frame extraction, and the robustness of a disturbance generation method is poor are effectively overcome, the accuracy and robustness of video adversarial attacks can be remarkably improved, and the robustness of video adversarial attacks is improved. And the requirements in practical application can be better met.

The invention relates to the technical field of network security vulnerability automatic testing, and discloses a curiosity-driven and deep reinforcement learning-based XSS automatic testing method, which comprises the steps of constructing an input environment for injection point exploration, constructing an intelligent agent with an internal reward mechanism, and constructing an XSS automatic testing system. A state flow diagram is constructed to record and manage a state flow path accessed by the intelligent agent in the exploration process, and injection point information is obtained; transmitting the injection point information to an intelligent agent in an attack vector generation model, and constructing a state space, an action space and a reward function in the attack vector generation model; and carrying out attack verification on the response page after the attack vector generation model sends the attack request to the target page, calculating a reward according to a verification result, and feeding back the reward to the attack vector generation model. According to the method, high coverage rate and high accuracy are achieved in the aspect of identifying the XSS injection points in the Web application, meanwhile, manual intervention is not needed in the training and testing process of the intelligent agent, and the testing efficiency and reliability are greatly improved.

The invention discloses an adversarial sample generation method and device for a face forgery detection model. The method comprises the following steps: obtaining a real category attention graph and a false category attention graph of an original sample by using a white-box face counterfeiting detection model, fusing the real category attention graph and the false category attention graph to obtain a fused attention graph, and processing the fused attention graph to obtain a dual hard mask; generating global disturbance of the original sample by using a spatial domain disturbance generator obtained by pre-training; cutting the global disturbance by using the dual hard mask to obtain local disturbance; and superposing the local disturbance to the original sample to obtain an adversarial sample. According to the scheme, the face forgery detection model can be attacked from a real area and a false area, a high attack success rate is achieved for the white box face forgery detection model and the black box face forgery detection model, and the attack effect of the confrontation sample is improved.

This invention relates to an active learning-based data-free black-box attack method and system based on multidimensional value assessment, belonging to the field of artificial intelligence security technology. This method constructs a pre-emptive "sample screening funnel," utilizing a local substitution model to perform multidimensional assessments of sample boundary approximation, information uncertainty, and geometric diversity before sending images to a commercial cloud API. Only high-value samples are selected for querying, thereby achieving low-cost, high-efficiency model theft and adversarial attacks. This invention ensures the diversity and training stability of data-free generated samples, significantly improves the transfer success rate of adversarial examples, and achieves "low-cost, low-risk" economical attacks. It has strong versatility and can be seamlessly integrated into various existing data-free attack frameworks, facilitating deployment and implementation in practical security assessment systems.

The application discloses an adversarial sample generation method based on AdvDrop, relates to the technical field of machine learning security, and processes two different branches of an image input space domain and a frequency domain; for the frequency domain attack AdvDrop, first, the input image is segmented into N*N blocks, and discrete cosine transform (DCT) is used on each block to convert them to the frequency domain; a quantization matrix M is introduced to reduce some specific frequencies of the transformed image; a tangent function is introduced in the quantization process to gradually approach the quantization function, and then the quantization matrix M is accurately adjusted through the new quantization function; then, the image is converted from the frequency domain to the space domain through inverse discrete cosine transform (IDCT) operation; finally, the space domain attack and the frequency domain attack fusion module are used to iteratively update the adversarial perturbation by using the gradients from different fields, and the adversarial sample is generated; the quality of the generated adversarial sample is improved, the difference between the distribution characteristics of the adversarial sample and the distribution characteristics of the real sample is reduced, and the attack success rate is improved.

This invention relates to the field of artificial intelligence security and discloses a method for generating adversarial examples for voiceprint recognition. It integrates multiple existing voiceprint recognition models to generate a substitute model to replace the target black-box voiceprint recognition model. Adversarial examples are generated by attacking the substitute model, thereby attacking the target black-box model. This overcomes the difficulty of obtaining model information from a black-box model and improves the low success rate of attacks. In generating adversarial examples, a Nesterov-based accelerated gradient method is used, which can find adversarial examples with better attack effects more quickly. During the generation of adversarial examples, the target black-box model is queried a small number of times to correct the direction of adversarial example generation, thus improving the success rate of the attack.

This invention discloses a backdoor attack method, system, and medium based on multi-object semantic coexistence in text-to-image diffusion models. This method utilizes the perspective of multi-object semantic coexistence in text-to-image diffusion models to develop MOBA backdoor attack schemes. First, by constructing a trigger alignment dataset and optimizing backdoor implantation and semantic preservation in parallel, the attack success rate and visual concealment are effectively improved, reducing the impact of semantic corruption on attack effectiveness. Second, during model training, an attention-based decoupling backdoor enhancement mechanism is adopted. By decoupling the attention regions of different objects, the semantic integrity of the input prompt is maintained while the backdoor is activated and the attention distribution is reasonably adjusted to reduce the impact of generation bias on attack concealment. The method of this invention ensures both visual concealment and model performance under benign input while achieving efficient backdoor attacks.

This invention proposes a transferable adversarial attack method based on generative adversarial networks (GANs). This method introduces an auxiliary generator into the generator to improve generation quality and sample diversity, and uses a pyramid attention mechanism to focus on features at different scales. Before the generator network, auxiliary information is first generated by the auxiliary generator network. This generated auxiliary information is then concatenated with the original image, and the concatenated input image is fed into the generator network. To further improve the performance of the generator network, a pyramid attention module is introduced, allowing the network to focus on important regions and features of the image at different scales. Through a series of neural network layers and transformations, a high-resolution, realistic image containing perturbations is generated. Such an image has a higher success rate in black-box adversarial attacks and increases the diversity and quality of adversarial samples. Compared to existing black-box attack methods, the adversarial samples generated by this scheme are more realistic and effective, have a higher success rate, and possess a certain degree of transferability. This invention provides an effective solution for adversarial attacks in black-box scenarios.

This invention relates to a white-box adversarial example generation method and system for liquid state machines, belonging to the field of neural network security. It aims to address the problem that existing methods cannot effectively handle non-differentiable cyclic components and gradient calculation failures caused by random pulse coding in liquid state machines. The method constructs a computable and stable gradient propagation path from model loss to the original input through gradient splitting and time-averaged gradient approximation. It includes a cyclic process of forward propagation and backward gradient calculation. The corresponding system includes a data input and preprocessing module, a target model loading and inference module, a gradient calculation module, an attack algorithm integration module, and an adversarial example synthesis and feedback module. This invention achieves an effective white-box attack on liquid state machines for the first time, with advantages such as high attack success rate, good perturbation concealment, and strong scalability, providing a powerful tool for evaluating the security of spiking neural networks.

The present invention discloses an image semantic adversarial attack sample generation system based on image brightness mapping, including: an image reading module, used to read the original image information, separate the color and brightness of the image, and obtain the image brightness matrix and the image color matrix; an image mapping module, used to intercept the effective brightness matrix and the invalid part of the image according to the brightness matrix of the original image, and use the mapping function to map the effective brightness matrix to obtain the original attack sample; a target network module, used to put the original attack sample into the target network for reasoning, and back propagate after obtaining the reasoning result, adjust the mapping function, and obtain a new mapping function; an image evaluation module, used to select to skip, save or update the current original attack sample according to the image reasoning result and the image quality score. The present invention also discloses a method for generating attack samples using the above-mentioned attack sample generation system.

The invention provides a federal learning backdoor attack method based on A2CTA, and the method comprises the steps: S1, receiving a global model by a client, and training and uploading a local model; s2, optimizing a local model according to an original label and a target label, calculating different cross entropy losses by using the original label for a sample with a partial trigger and using the target label for a sample with a composite trigger; s3, adjusting sample loss of different triggers through an adaptive algorithm to optimize a gradient distance; s4, calculating the global loss of the corresponding client by using the A2CTA; s5, calculating the gradient of the local model through the global loss, and updating the local model; and S6, calculating the gradient difference, and uploading the gradient difference to a server after local training is finished.

The invention discloses an unmanned aerial vehicle flight control system attack method and device, and relates to the field of unmanned aerial vehicle countering. The method and device are used for solving the problems that in the current unmanned aerial vehicle countering field, countering means are single and lack of pertinence, so that the attack effect is poor, and precise interference cannot be conducted on a target unmanned aerial vehicle. Comprising the following steps: combining a key row vector and a key column vector of a candidate matrix according to a PBH rank criterion to obtain a key matrix, and obtaining a tampered optimal attack matrix according to the key matrix; and obtaining a tampered input matrix, tampering parameters of the input matrix, a tampered output matrix and tampering parameters of the output matrix according to the tampered optimal attack matrix, and tampering internal parameters of the target unmanned aerial vehicle flight control system according to the tampering parameters of the input matrix and the tampering parameters of the output matrix.

The invention relates to a transferable adversarial sample generation method and device based on wavelet transform and multi-scale filling, and a storage medium, and the method comprises the following steps: obtaining an input image, converting the input image from a spatial domain to a frequency domain through wavelet transform, and carrying out the random block disruption of a high-frequency component block, and obtaining a preprocessed image; mI-FGSM-based sample updating is performed on the preprocessed image, and in the updating process, a global random multi-scale filling method is used, MI-FGSM input is transformed from multiple angles of a space domain and a frequency domain, a plurality of substitution models are combined, combined gradient loss is calculated, and training is performed to obtain an adversarial sample. Compared with the prior art, the method has the advantages of remarkably improving the migration capability of the adversarial sample among the black box models, improving the attack success rate and the like.

The present invention discloses a controllable lossy compression backdoor attack method based on prior knowledge, which belongs to the field of deep learning security; the specific steps are: first, for each clean sample of the image input by the ML model, the respective cross entropy loss value information is recorded respectively, and the variance is obtained after the maximum value is removed to obtain the loss volatility of each clean sample as prior knowledge; then, a clean sample with a loss volatility ratio of 5%-50% is selected as a poisoned sample, and the color space conversion and chromaticity sampling are performed and then divided into 8×8 blocks, and DCT is performed on each block, and its coefficients are quantized; all quantized coefficients are compressed after reordering using the ZigZag method; the compressed poisoned sample is mixed with the clean sample as a data set for deep learning training to obtain a poisoned model; the poisoned model is predicted as a normal label on the clean sample, and predicted as a preset label on the compressed image, so as to achieve the purpose of backdoor attack. The present invention is flexible and not easy to be discovered.

The application provides a frame-level alignment boundary adversarial attack method, system, device and equipment for a sequence recognition model and a medium, and belongs to the fields of computer vision, speech processing and adversarial machine learning. The method comprises the following steps: S1: inputting a sample into a target sequence recognition model in a test stage to obtain an initial reference alignment label sequence; S2: based on the initial reference alignment label sequence, constructing an alignment boundary margin between a reference alignment label and a competitive label; S3: based on the alignment boundary margin, generating a dynamic continuous gating weight by using a smoothing mapping, constructing a margin optimization target with gating weighting and iteratively updating to obtain a candidate adversarial sample; and S4: performing total variation (TV) smoothing under a success maintaining constraint and amplitude scaling search on the candidate adversarial sample to generate a high-fidelity adversarial sample. The application can improve the adversarial attack efficiency and success rate and can be used in sequence recognition model robustness evaluation and privacy protection, copyright protection and the like.

The invention discloses an implicit video attack method, which comprises the following steps of: 1, inputting malicious information and an original clean image into a first-stage encoder to obtain low-dimensional malicious information features and original clean image features; 2, attacking the original clean image features for the first time by using low-dimensional malicious information features to generate attacked image features; 3, inputting the attacked image features into a secondary encoder to obtain high-dimensional attacked image features; 4, attacking the original clean image again by using the high-dimensional attacked image features; and 5, designing a confrontation module to keep the visual consistency between the attacked image and the original clean image. According to the method, the video can be attacked with high efficiency and high quality, so that the attack efficiency of the model can be improved, and the concealment of malicious information is enhanced.

The invention discloses an unmanned aerial vehicle image detection confrontation sample generation method and system based on a black box normal form. The method comprises the steps of S1, candidate region generation: extracting multi-scale features from an input unmanned aerial vehicle image, and generating a candidate region set containing potential target frame coordinates through feature fusion and transformation; s2, target category retrieval and allocation: allocating a target category with the highest attack efficiency to each candidate region in the candidate region set based on pre-constructed object category correlation prior information to form a target category set; and S3, adversarial sample generation: combining the candidate region set with the target category set, generating a virtual instance set, and adding the virtual instance set into the original input image to obtain a final adversarial sample image. According to the method, efficient black box attacks are realized, calculation delay and energy consumption are innovatively induced, the attack pertinence is high, the concealment is high, the attack success rate is improved, the adaptability is high, and a new view angle is provided for security assessment and defense.

The application discloses a federated learning backdoor attack method based on global model reverse technology, and proposes a global model reverse technology-based federated learning backdoor attack method for injecting a backdoor behavior into a global model under the premise that a server of the federated learning cannot access any real training data. First, a global model reverse algorithm is used on the global model updated through aggregation to obtain a virtual data set. Then, a part of data in the virtual data set is randomly selected for poisoning, and the poisoned data is mixed with unpoisoned data to obtain a poisoned virtual data set. Finally, the model is retrained using the poisoned virtual data set to obtain a global model with a backdoor. The method of the application supplements the existing backdoor attack methods for the federated learning, supplements the backdoor attack methods for the federated learning initiated by a malicious server, reveals a new security threat in the federated learning, and thus achieves the purpose of damaging the model integrity in the federated learning.