An image processing method for combating attacks

Abstract

The invention relates to the technical field of image processing. The invention discloses an image processing method for resisting attacks, which comprises the following steps of: a, collecting gradient information of an image x through a local known model; b, introducing a step size amplification factor to amplify the gradient of each step in the iterative processing process, and updating the accumulative amplification gradient at the same time; c, if the cumulative amplification gradient exceeds a set threshold range, cutting noise C is obtained, and otherwise, C is 0; and d, performing projection by using a projection kernel function Wp, uniformly projecting the cutting noise C to the surrounding area of the image x, and adding the amplification gradient of the current step to obtain asample image. The method is a regional-level attack resisting technology, and provides a new thought for the research of a deep neural network. The adversarial sample image has stronger migration capability, and can better attack unknown black box models to enable the unknown black box models to generate misclassification. The technical scheme of the invention can be easily combined with many other attack methods so as to generate an adversarial sample image with stronger attack capability.

Description

technical field [0001] The present invention relates to the technical field of image processing, in particular to an anti-attack technology for neural network image recognition, and in particular to an image processing method for anti-attack. Background technique [0002] With the development of deep neural networks, image classification tasks have been able to achieve very high recognition levels. However, due to the introduction of the concept of adversarial attack in recent years, people began to re-examine the robustness of deep neural networks. [0003] The basic idea of ​​the adversarial attack is to add certain special noise to the ordinary clean picture, so that the deep neural network can give an irrelevant prediction output, but this noise-added picture has no recognition problem for human eyes. [0004] Adversarial attack can be considered as a kind of image processing technology. Through the research of different types of adversarial attack, it can in turn promo...

AI Technical Summary

Problems solved by technology

[0007] The main purpose of the present invention is to provide an image processing method for adversarial attacks, to solve the problem that most of the adversarial attacks in the prior art belong to pixel-level attacks, and to study the noise processing technology of area-level attacks

Images