Black box attack method based on migration model Jacobian matrix feature vector disturbance

Abstract

The invention provides a black box attack method based on migration model Jacobian matrix feature vector disturbance, and belongs to the technical field of machine learning system security and black box attack. The method comprises the following steps: firstly, determining a to-be-attacked black box model and a migration pre-training model, obtaining a to-be-attacked original sample and a label thereof, continuously applying disturbance to the original sample, and continuously updating the disturbance through iterative computation by utilizing a singular value decomposition result of a Jacobian matrix calculated by the migration pre-training model, and finally, the disturbed sample being no longer corresponding to a correct label through black box model classification. The method has the advantages that only one migratable pre-training network is needed, no training sample is needed, and the attack efficiency of a traditional black box model can be greatly improved.

Description

technical field [0001] The invention belongs to the technical field of machine learning system security and black-box attack, and particularly proposes a black-box attack method based on disturbance of Jacobian eigenvector of migration model. Background technique [0002] With the development of deep learning, the security issues of deep learning systems have gradually attracted the attention of the machine learning community. Since providers of general deep learning systems do not disclose the specific implementation of their systems, black-box attacks are often an effective means of attacking deep learning systems. Specifically, the black-box attack constructs a series of system input samples iteratively, and gradually reduces the degree of recognition of the samples by the deep learning system while ensuring that the difference between each input sample and the sample to be attacked is small, and finally reaches When a certain input, the output classification is complete...

AI Technical Summary

Problems solved by technology

In the former scheme, a white-box network is generally trained through some training samples, and then the known white-box network parameters are used to guide each iteration of the black-box attack, which is characterized by the need for a large number of pre-training samples, and the pre-training samples It is best to be closer to the classification task of the black-box network; in the latter scheme, the idea of ​​zero-order gradient optimization is usually used to estimate the gradient of the black-box network at a certain input point by sampling, so that the gradient descent iteratively finds an adversarial sample , which is characterized by no need for pre-training samples, but the attack efficiency is low

Images