Image classifier adversarial attack defense method based on disturbance evolution

Abstract

The invention discloses an image classifier adversarial attack defense method based on disturbance evolution. The method comprises the following steps that 1) the sample is attacked by different attack models so as to obtain different types of disturbance; 2) a block box model is attached by the adversarial sample corresponding to the disturbance and the attack effect is ordered; 3) cloning, crossing, variation and other operation are performed on the disturbance of great attack effect so as to obtain the new disturbance; 4) the disturbance is updated by using the parent-child hybrid selectionmode so as to achieve the objective of disturbance evolution; 5) an adversarial sample detector is trained by the adversarial sample corresponding to the evolved disturbance and the normal sample; and 6) when the detection sample is detected, detection is performed by using the adversarial sample detector firstly and then the normal sample is inputted to the black box model and the class is returned so as to achieve the adversarial attack defense effect.

Description

Technical field [0001] The invention belongs to the technical field of deep learning security, and specifically relates to a defense method for antagonistic attacks on image classifiers based on perturbation evolution. Background technique [0002] Deep learning is inspired by neuroscience. It can learn from a large amount of data to obtain more accurate classification results than general algorithms. It has powerful feature learning capabilities and feature expression capabilities. As deep learning is widely used in various fields such as VISION, speech recognition, language processing, financial fraud detection, and malware detection, the security issues of deep learning have gradually attracted attention. [0003] Although deep learning has a high classification effect in the field of computer vision, Szegedy et al. found that deep models are vulnerable to subtle disturbances. These small disturbances are almost imperceptible to the human visual system, but they can make the de...

AI Technical Summary

Problems solved by technology

[0005] There are already many attack models that can attack image classification models. If people only use this type of attack for training, they cannot defend against unknown attacks.

Although different adversarial attack methods have different structures and cannot be directly optimized or compared, they all output adversarial samples and perturbations

Images