Image security identification method based on adversarial sample defense

Abstract

The invention provides an image security identification method based on adversarial sample defense. The method comprises the following steps: 1, firstly, collecting an image data set; 2, generating anadversarial sample by using a pixel attack method, according to the attack method, utilizing a differential evolution algorithm to iteratively modify each pixel of a test set image to generate a sub-image, then testing the attack effect of each sub-image, and using the sub-image with the best attack effect as an adversarial sample; 3, generating an adversarial sample by using a general disturbance generation method; 4, generating an adversarial test set based on the adversarial sample; 5, taking the image data of the training set as training data, and carrying out the fine adjustment of an original pre-trained model; and 6, performing image recognition on the test set, and checking an image recognition effect. The method has a good defense capability for one pixel generation confrontationdisturbance, has an excellent defense capability for a confrontation sample generated by general disturbance, cannot generate any influence on a generated image recognition model by the general disturbance, and can be used for recognition and classification of electronic files and the like.

Description

technical field [0001] The invention is an image security recognition method based on defense against examples, which belongs to the field of machine vision. Background technique [0002] In recent years, with the increasingly widespread application of deep learning technology in the field of computer vision and its excellent performance in various tasks, deep learning technology has attracted a large number of scholars for further research. In 2014, Szegedy et al. first proposed that the deep neural network is not perfect. Although it works well in the field of computer vision, it is easy to be disturbed by small vectors that are difficult for human eyes to detect, that is, such vectors are added to the image. , the image is difficult to see the obvious difference, but the deep neural network will get wrong results for such pictures. This kind of small and imperceptible vector that can perturb the deep neural network is called an adversarial perturbation, and the picture w...

AI Technical Summary

Problems solved by technology

In 2014, Szegedy et al. first proposed that the deep neural network is not perfect. Although it works well in the field of computer vision, it is easily disturbed by small vectors that are difficult for human eyes to detect, that is, such vectors are added to the image. , the image is difficult to see that there is a significant difference, but the deep neural network will get wrong results for such pictures

Images