Anti-attack method based on training set data

Abstract

The invention discloses an anti-attack method based on training set data. The method comprises the following steps: step 1, training a detection model by using a VOC2007 image data set; step 2, screening the image in the training set to search a single-class training set image Y; step 3, using the image set Y to construct a KD-tree for storage; step 4, for a to-be-attacked picture, querying a non-same class training image closest to the to-be-attacked picture in Y through a KD-tree; step 5, constructing initial radial noise z *; step 6, constructing a disturbance space, and randomly sampling the disturbance space to obtain eta; step 7, adjusting the disturbance quantity in an image detection frame, and generating a new adversarial sample x' according to eta; step 8, querying the new adversarial sample x '; and step 9, repeating the steps 5, 6, 7 and 8 until the attack succeeds to obtain a final adversarial sample x ', and inputting the adversarial sample into the target model for classification to obtain a classification result F (x'). The attack effect can be achieved at the fastest speed, and the generated disturbance is very small.

Description

technical field

[0001] The invention relates to the technical field of machine learning security, in particular to a method for gray-box confrontation decision-making attacks oriented to a deep image recognition system. Background technique

[0002] Many deep learning models without defense measures are considered to be vulnerable to adversarial attacks. Adding small perturbations to the original image can maliciously mislead the model and make the model misclassify. Researchers have done a lot of research on designing different adversarial attack methods to fool state-of-the-art deep convolutional networks. Attacks can be roughly divided into three categories: ① Gradient-based iterative attacks, such as FGSM, I-FGSM, VR-IGSM and a series of FGSM variants; ② Optimization-based iterative attacks, such as C&W (Carlini&Wagner); ③ Decision boundary-based Attacks, such as boundary attack.

[0003] Tanay and Griffin provide a boundary-slanting perspective on the existence of adv...

Images