Imperceptible adversarial patch generation method and application

Abstract

The invention belongs to the technical field of artificial intelligence security, and discloses a high-strength adversarial patch sample generation method and application, and the method comprises thesteps: firstly calculating an area, which greatly affects a CNNs classification decision, in an image through Grad-CAM, and using the area as a feature contribution area (CFRs) of the image; and positioning the region by using a mask mechanism so that scrambling can be completed in the determined feature contribution area. According to the method, a loss function is redefined to serve as an optimized objective function, then a stochastic gradient descent optimization algorithm is utilized, hyper-parameters are introduced to search for efficient disturbance, and then the adversarial sample based on CFRs can be obtained. According to the method, good balance between countermeasure strength and imperceptibility is realized by only scrambling in a feature contribution area and limiting a disturbance range within a micro range which is difficult to perceive by human eyes, and experimental verification is performed on CIFAR-10 and ILSVRC2012 data sets. The adversarial sample generated by the method is applied to adversarial training, and the deep learning defense capability can be effectively improved.

Description

technical field [0001] The invention belongs to the technical field of artificial intelligence security, and in particular relates to an anti-patch generation method, generation system, equipment, storage medium and application. Background technique [0002] At present, the development of deep learning technology has promoted the successful application of deep neural networks (DNNs) in various fields. Especially the convolutional neural networks (CNNs) among them have shown excellent performance in the field of image classification. However, many existing studies have shown that CNNs are vulnerable to perturbations imperceptible to humans, and such samples with added tiny perturbations are called adversarial examples. Scholars have proposed a variety of techniques for generating adversarial samples, such as L-BFGS, FGSM, I-FGSM, PGD, and C&W. The adversarial samples generated by these techniques can successfully deceive CNNs to make wrong predictions, which limits the appl...

AI Technical Summary

Problems solved by technology

[0009] The significance of solving the above problems and defects is: the purpose of a class of anti-patch methods proposed so far is to deceive the recognition system, and is rarely used to resist training and enhance the defense capabilities of the model; it also does not consider the imperceptibility of the patch. Only the location of the adversarial patch and the possible transformations are considered in , which makes the generated adversarial samples easy to detect

Images