Adam algorithm-based adversarial sample generation method and system

Abstract

The invention belongs to the technical field of computer vision image recognition, and particularly relates to an adversarial sample generation method and system based on an Adam algorithm. Sample data used for vision image classification recognition are collected, and the sample data comprise an input image and label data corresponding to the input image; a neural network model used for adversarial sample generation is constructed; and, for sample data, adversarial disturbance between an input image in the sample data and a generated adversarial sample is limited by using an infinite norm, a neural network model loss function is optimized, an optimization model is iteratively solved by using an Adam algorithm, and the adversarial samples are generated by maximizing the target loss function of the model using the attenuation step size in the iterative solution of the adversarial samples. The migration of the adversarial samples between the models is increased by using the attenuation step length, so that the adversarial samples with relatively high quality are obtained, the robustness of the deep learning classification model is improved, and the quality and efficiency of visual image classification and recognition can be effectively guaranteed.

Description

technical field [0001] The invention belongs to the technical field of computer vision image recognition, in particular to a method and system for generating an adversarial sample based on an Adam algorithm. Background technique [0002] In the field of image recognition, convolutional neural networks are able to classify images with human accuracy, however, researchers have found that neural networks are vulnerable to attack. In existing research, by adding a small amount of perturbation, the neural network model can give a wrong output with high confidence, and the perturbed image is an adversarial example. Usually, the adversarial perturbation is invisible to the naked eye, that is, there is no obvious difference between the adversarial sample and the original sample in the perception of the human eye. According to the degree of understanding of the model, adversarial attacks can be divided into white-box attacks and black-box attacks. Given the model structure and para...

AI Technical Summary

Problems solved by technology

The first two black-box attack methods require a large number of queries to the model, which is impractical for large-scale datasets like ImageNet

Images