Adversarial sample generation method for image recognition model classification boundary sensitivity

Abstract

The invention discloses an adversarial sample generation method for image recognition model classification boundary sensitivity, and belongs to the field of neural network security and machine adversary. The method comprises the following steps: step 1, setting initial parameters; 2, generating an initial gene population; step 3, carrying out gene crossover; step 4, carrying out gene variation; step 5, carrying out gene selection; step 6, performing gene evolution iteration; step 7, reducing the number of different pixel points of the adversarial sample and the original sample; step 8, reducing the number of different RGB channels of the adversarial sample and the original sample; and step 9, reducing the pixel value difference between the adversarial sample and the original picture. The black box attack method provided by the invention does not depend on the confidence coefficient returned by the model, and only needs one final classification label; the method has a very good effect on generating adversarial samples for large-scale pictures; under the condition that parameter adjustment is appropriate, the number of query times required by the method is smaller than that requiredby a common decision boundary-based attack method.

Description

technical field [0001] The invention relates to a method for generating an adversarial sample that is sensitive to classification boundaries of an image recognition model, and belongs to the technical fields of machine learning and image recognition. [0002] technical background [0003] Since the deep neural network was proposed, the deep neural network has been greatly developed. At present, deep neural networks have been applied in natural language processing, text mining, malware detection, speech recognition, image recognition and other fields. Especially in the field of image recognition, deep neural networks have shown greater advantages over traditional image recognition algorithms. Because the deep neural network does not need to extract the features of the picture when it recognizes and labels the image, it only needs a large number of pictures as training data for training, so that the neural network can learn its own experience and knowledge to achieve the effec...

AI Technical Summary

Problems solved by technology

The black-box model does not know any information about the model, and can only perform image query operations on the model

Images