A Step Size Adaptive Adversarial Attack Method Based on Model Extraction

Abstract

The invention discloses a step-size self-adaptive adversarial attack method based on model extraction, step 1, constructing an image data set; step 2, training a convolutional neural network on the image set IMG, as a target model to be attacked, and step 3, calculating The cross-entropy loss function realizes the model extraction of the convolutional neural network and initializes the gradient value and step size g of the iterative attack 1 ; Step 4, form a new adversarial sample x 1 ; Step 5, recalculate the cross-entropy loss function, and use the new gradient value to update the step size of adding anti-noise in the next step; Step 6, repeat the process of inputting the image-calculating the cross-entropy loss function-calculating the step size-updating the confrontation sample; Step 5 Repeat the operation T‑1 times to get the final iterative attack adversarial sample x′ i , and input the adversarial sample into the target model for classification, and obtain the classification result N(x′ i ). Compared with the prior art, the present invention can achieve better attack effect, and has stronger non-black-box attack capability than the current iterative method.

Description

technical field [0001] The invention relates to the field of machine learning security technology, in particular to a non-black-box anti-iterative attack method oriented to a deep image recognition system. Background technique [0002] In recent years, with the continuous progress and development of machine learning theory and technology, especially breakthroughs in the fields of computer vision and multimedia, technologies such as medical image processing, biological image recognition, and face recognition have been widely used. However, the rapid development of the field of machine learning also brings many security problems. In systems closely related to security and privacy, such as autonomous driving, health systems, and financial systems, the security of machine learning poses a potential threat to people's vital interests and even life. Therefore, how to maintain the security of machine learning systems and how to protect user privacy has become the basis for the dev...

AI Technical Summary

Problems solved by technology

At the same time, the existing methods use the gradient information obtained by the model extraction at each step only to calculate the sign of the gradient value

Images