A point attack method for generating adversarial samples based on weight spectrum

Abstract

A point attack method for generating adversarial samples based on a weight spectrum belongs to the technical field of computer image processing. Technical solution: Calculate the average distance between singular points and their neighboring points (4 or 8 points) as an evaluation index to distinguish adversarial samples containing singular points; design optimization functions to improve anti-detection performance, modify optimization steps to achieve point-based attack, solve the problem of saliency spectrum, and finally realize the design of a new point-based attack method to generate anti-perception and anti-detection performance better adversarial samples; choose to directly set more tampering, introducing new constraints for the convenience of weighing the number of tampering points, degree of tampering, and attack success rate. The beneficial effect is that: the present invention uses the generated weight spectrum to determine the position and degree of tampering point, and at the same time, under the premise of specifying the degree of tampering, a fixed number of points or a minimum pixel point attack method can be used to generate an adversarial sample.

Description

technical field [0001] The invention belongs to the technical field of computer image processing, in particular to a point attack method for generating an adversarial sample based on a weight spectrum. Background technique [0002] In recent years, the emergence of adversarial examples has made investigators question the application of deep learning, although this situation is not only in deep learning. Due to the powerful learning ability, deep learning is widely used in various image domains. Some domains are related to real physical scenarios, such as self-driving cars. Szegedy et al. point out that small perturbations can lead to misclassification. Adversarial examples will always exist since the limited number of training sets cannot fit all physical world scenarios. Investigators have proposed many methods to attack previous classifiers to generate adversarial examples or defend against adversarial examples. All of these will help researchers move closer to underst...

AI Technical Summary

Problems solved by technology

[0008] In order to make the sample show better anti-detection ability, balance tampering degree and attack success rate, and solve the problem of combination of salient spectrum selection points in the attack process, the present invention proposes a point attack method based on weight spectrum to generate adversarial samples, The method proposes a classification detector for identifying adversarial samples containing singularities, a point-based attack, and a new constraint based on a weight map, which can balance the degree of tampering and attack success rate, and can easily set any number of fixed tampering points, or Automatic generation of adversarial examples via least pixel attack

Images