Small adversarial patch generation method and device

Abstract

The invention discloses a small adversarial patch generation method and device, and the method comprises the steps: carrying out the random initialization of an adversarial patch image, adding the initialized adversarial patch image to a selected pasting region on a target object in training data, and manufacturing an adversarial sample; transmitting the adversarial samples into a deep learning model for adversarial feature extraction, and transmitting benign samples without adversarial patch images into the deep learning model for benign feature extraction; jointly inputting the adversarial features and the benign features into a feature enhancement loss function for loss calculation to obtain a loss result; adding a loss result into a model loss function, and updating a pixel value of the adversarial patch through an optimizer after back propagation; and after preset times of iteration, enabling the adversarial patch to enable the deep learning model to output an error result, and ending the adversarial patch processing process. According to the method, the size of the anti-patch in the physical world can be smaller, the manufacturing cost is reduced, the identifiability of the anti-patch is reduced, and a defense method based on detection is broken through more easily.

Description

technical field [0001] The invention relates to the technical field of machine learning, in particular to a method and device for generating a small-scale confrontation patch. Background technique [0002] An adversarial patch is an adversarial example used to attack a deep learning model in the physical world and make the model output wrong results. The anti-patch with a large area has a significant attack effect, but the anti-patch with a large area is easy to be identified, and it is difficult to break through the defense method based on feature detection. Therefore, reducing the area and reducing the recognition degree have become the development trend of anti-patch. However, shrinking the area of ​​the adversarial patch will sharply reduce the attack success rate. [0003] At this stage, methods to improve the effect of anti-patch attacks can be found in some work on attacking deep learning models in the physical world based on anti-patch. These works include the phy...

AI Technical Summary

Problems solved by technology

However, the existing anti-patch attack performance improvement methods do not focus on solving the performance loss caused by the smaller feature difference.

Images