Target attack adversarial sample generation method for deep learning model

Abstract

The invention discloses a target attack adversarial sample generation method for a deep learning model, and belongs to the field of deep learning security. In order to detect blind spots of a deep learning model through a countermeasure attack method and focus on a specific area of the model, the invention designs a target attack countermeasure sample generation method for the deep learning model,which can extract a general mode which is suitable for most samples and contains semantic information missed by the model from a data set of a small number of samples. An adversarial sample capable of stably realizing high-success-rate adversarial attack can be quickly generated. A manifold represented by a polyhedral approximate deep learning model is used, an optimization technology is used tocalculate a minimum disturbance vector required for sending a certain point in a training set to a classification boundary of a region corresponding to a target class on the manifold, multi-point calculation is continuously aggregated, updated and projected, and the above steps are iteratively executed till the attacked target model reaches a preset attack success rate.

Description

technical field [0001] The invention relates to the field of deep learning security technology, in particular to a method for generating target attack adversarial samples for deep learning models. Background technique [0002] Deep learning models have shown excellent performance in many tasks and are widely used in many fields such as intelligent robots, autonomous driving, speech synthesis, natural language translation, and image processing. However, the actual application environment is often complex, highly uncertain, and there are situations such as incomplete information, information confrontation and interference. At the same time, the existing deep learning models rely too much on massive data or knowledge, and are vulnerable to confrontations that cannot be recognized by the human eye. The attack of the sample makes the model produce wrong output. Adversarial attack methods that generate adversarial examples have become an important tool for discovering potential p...

AI Technical Summary

Problems solved by technology

[0005] (2) Generation method of general disturbance

[0008] More importantly, adversarial examples represent the blind spot of the model, which means that the deep learning model has not learned the real concept, so the information related to the real concept is likely to be reflected in the adversarial example. However, all current research generates Fighting disturbances is messy

Images