Method and device for generating an adversarial example

Abstract

The embodiment of this specification provides a method and device for generating an adversarial sample. The method includes: obtaining the current adversarial sample to be strengthened in the current round of iterations; and presetting the first number of current adversarial samples in the direction of reducing the target loss function Geometric deformation to obtain a deformed image; perform a second pixel-by-pixel update on the deformed image to obtain the first adversarial sample; perform a third pixel-by-pixel update on the current adversarial sample to obtain a second adversarial sample; determine the first adversarial sample and In the second adversarial example, the adversarial example with a smaller loss value is used as an updated adversarial example; when the stop iteration condition is met, the updated adversarial example is used as the final adversarial example; when the stop iteration condition is not met, the next round is performed based on the updated adversarial example iterate. It can make the generated adversarial samples more aggressive, so as to provide targeted defense.

Description

technical field [0001] One or more embodiments of this specification relate to the computer field, and in particular, to a method and an apparatus for generating an adversarial example. Background technique [0002] With the large-scale application of image recognition models, attacks against image recognition models emerge in an endless stream. It is necessary to follow up research in time to discover potential attack methods and prevent dangers before they happen. Among many attack methods, adversarial attack is a new type of attack method with strong aggressiveness. Adversarial attacks obtain adversarial samples by intentionally adding interference to input samples, and through adversarial samples, the image recognition model gives a wrong output with high confidence. [0003] In the generation methods of adversarial samples in the prior art, small high-frequency perturbations are often added to the original image to generate adversarial samples. Such adversarial samples...

AI Technical Summary

Problems solved by technology

[0003] In the generation methods of adversarial samples in the prior art, small high-frequency perturbations are often added to the original image to generate adversarial samples. Such adversarial samples are easily blocked by filter-type adversarial defense methods and are not very aggressive.

Images