Adversarial sample generation method and device

Abstract

Embodiments of the invention provide an adversarial sample generation method and device. The method comprises the steps of obtaining a to-be-enhanced current adversarial sample in the current iteration; in the decreasing direction of the target loss function, performing preset geometric deformation on the current adversarial sample for a first time to obtain a deformed image; executing second-timepixel-by-pixel updating on the deformed image to obtain a first adversarial sample; performing third pixel-by-pixel updating on the current adversarial sample to obtain a second adversarial sample; determining an adversarial sample with a smaller corresponding loss value in the first adversarial sample and the second adversarial sample as an updated adversarial sample; when the iteration stoppingcondition is met, taking the updated adversarial sample as a final adversarial sample; and when the iteration stopping condition is not met, performing the next round of iteration based on the updated adversarial sample. The generated adversarial sample can have stronger aggressivity, so that targeted defense is realized.

Description

technical field [0001] One or more embodiments of this specification relate to the computer field, and in particular, to a method and an apparatus for generating an adversarial example. Background technique [0002] With the large-scale application of image recognition models, attacks against image recognition models emerge in an endless stream. It is necessary to follow up research in time to discover potential attack methods and prevent dangers before they happen. Among many attack methods, adversarial attack is a new type of attack method with strong aggressiveness. Adversarial attacks obtain adversarial samples by intentionally adding interference to input samples, and through adversarial samples, the image recognition model gives a wrong output with high confidence. [0003] In the generation methods of adversarial samples in the prior art, small high-frequency perturbations are often added to the original image to generate adversarial samples. Such adversarial samples...

AI Technical Summary

Problems solved by technology

[0003] In the generation methods of adversarial samples in the prior art, small high-frequency perturbations are often added to the original image to generate adversarial samples. Such adversarial samples are easily blocked by filter-type adversarial defense methods and are not very aggressive.

Images