Adversarial sample generation method for limiting disturbance noise by using mask

Abstract

The invention discloses an adversarial sample generation method for limiting disturbance noise by using a mask, and relates to the field of adversarial machine learning. According to the method, the noise in the confrontation image background is removed, the noise is limited in the image saliency target area, and the obtained confrontation sample can still effectively attack the depth model. An image saliency map obtained by a saliency target detection technology is converted into a binary mask to obtain a saliency target or region of the image, a region in a boundary of the binary mask is a saliency target region, and a region outside the boundary is an image background. And the binary mask is multiplied by the adversarial disturbance noise so as to limit the added disturbance noise in the saliency target area. According to the method, the noise is limited in the salient target area, the generated adversarial sample not only is more difficult to perceive, but also has the capability of effectively attacking the deep neural network, and has universality, that is, the method can be combined with any existing adversarial sample generation method, and the attack concealment of the adversarial sample is enhanced.

Description

technical field [0001] The invention relates to the field of adversarial machine learning, and studies a method for limiting the noise of image adversarial samples, so that the noise is less likely to be detected by human eyes while maintaining the adversarial attack, and the concealment of the adversarial sample attack is enhanced. Background technique [0002] Studies have shown that deep neural networks are easily misled by adversarial samples to obtain wrong prediction results. Adversarial samples refer to samples that add imperceptible adversarial noise to input samples, which can make the deep neural network model misjudge. The adversarial samples generated by existing methods usually add perturbation noise to the whole image of clean samples. These noises are usually not noticeable, but people will still notice the perturbation noise on the image, especially for images with simple backgrounds or in order to implement stronger Attacking the adversarial image that requi...

AI Technical Summary

Problems solved by technology

The adversarial examples generated by existing methods usually add perturbation noise to the full image of clean samples. These noises are usually not noticeable, but people will still notice the perturbation noise on the image, especially for images with simple backgrounds or in order to implement stronger The attack requires a large amount of disturbance against the image, the noise is more obvious, and it is easy to find the abnormality of the input image

Images