Adversarial sample generation method and system based on image brightness random transformation

Abstract

The invention belongs to the technical field of computer visual image recognition, and particularly relates to an adversarial sample generation method and system based on image brightness random transformation, and the method comprises the steps of collecting sample data used for visual image classification recognition, including an input image and label data corresponding to the input image; constructing a deep neural network model for generating an adversarial sample; performing data enhancement through random transformation of sample data input image brightness, solving a network model by using a momentum iteration FGSM image confrontation algorithm, searching confrontation disturbance in an input gradient direction of a target loss function, performing infinite norm limitation on the confrontation disturbance, and forming adversarial samples by maximizing a target loss function of the sample data on the network model. According to the invention, the image brightness random transformation is introduced into the adversarial attack, so that the overfitting in the adversarial sample generation process is effectively eliminated, the success rate and mobility of the adversarial sample attack are improved, and a good foundation is laid for constructing a more robust image classification and recognition system.

Description

technical field [0001] The invention belongs to the technical field of computer vision image recognition, in particular to a method and system for generating an adversarial sample based on random transformation of image brightness. Background technique [0002] In the field of image recognition, the experimental results on some standard test sets show that the recognition ability of deep neural network can reach the level beyond that of human beings. However, while deep learning brings great convenience to people, it also has some security problems. For an abnormal input, whether the deep neural network can still get satisfactory results, and the hidden security issues have gradually attracted people's attention. Deep neural networks have been shown to be vulnerable to adversarial examples, which are generated by adding additional perturbations imperceptible to humans to the original input image to cause the model to misclassify. Usually, adversarial examples have a certai...

AI Technical Summary

Problems solved by technology

In the white box attack scenario, these methods show strong attack capabilities, but in the black box setting, the attack success rate of these methods is relatively low, which can be considered as "overfitting" of the adversarial samples, that is, the same adversarial samples Attack capabilities under white-box and black-box settings are similar to the difference in performance of the same neural network on the training set and the test set

Images