Point attack method for generating adversarial sample based on weight spectrum

Abstract

The invention discloses a point attack method for generating an adversarial sample based on a weight spectrum, and belongs to the technical field of computer image processing. The technical scheme ofthe point attack method includes the steps: calculating average distances between singular points and adjacent points (4 or 8 points) of the singular points to serve as evaluation indexes to distinguish adversarial samples containing the singular points; designing an optimization function to improve the anti-detection performance, modifying optimization steps to achieve point-based attacks, solving the problems existing in a significance spectrum, and finally, designing a new point-based attack method to generate a countermeasure sample with good anti-perception capacity and anti-detection performance; and directly setting more tampering for the unstable area (the area with the large weight), and introducing new constraints for conveniently balancing the number of tampering points, the tampering degree and the attack success rate. The point attack method has the advantages that the positions and tampering degrees of points needing to be tampered are determined through the generated weight spectrum, and meanwhile on the premise that the tampering degrees are specified, confrontation samples can be generated through a fixed-point number or minimum-pixel-point attack method.

Description

technical field [0001] The invention belongs to the technical field of computer image processing, in particular to a point attack method for generating an adversarial sample based on a weight spectrum. Background technique [0002] In recent years, the emergence of adversarial examples has made investigators question the application of deep learning, although this situation is not only in deep learning. Due to the powerful learning ability, deep learning is widely used in various image domains. Some domains are related to real physical scenarios, such as self-driving cars. Szegedy et al. point out that small perturbations can lead to misclassification. Adversarial examples will always exist since the limited number of training sets cannot fit all physical world scenarios. Investigators have proposed many methods to attack previous classifiers to generate adversarial examples or defend against adversarial examples. All of these will help researchers move closer to underst...

AI Technical Summary

Problems solved by technology

[0008] In order to make the sample show better anti-detection ability, balance tampering degree and attack success rate, and solve the problem of combination of salient spectrum selection points in the attack process, the present invention proposes a point attack method based on weight spectrum to generate adversarial samples, The method proposes a classification detector for identifying adversarial samples containing singularities, a point-based attack, and a new constraint based on a weight map, which can balance the degree of tampering and attack success rate, and can easily set any number of fixed tampering points, or Automatic generation of adversarial examples via least pixel attack

Images