Adversarial attack detection method

Abstract

The invention discloses an adversarial attack detection method, which comprises the following steps of S1, generating an adversarial sample for a target deep neural network through multiple adversarial attack algorithms, and mixing the adversarial sample with a natural input sample to serve as an input sample; S2, inputting the input sample into a target deep neural network to extract global features and hidden layer features; S3, performing feature fusion on the global feature and the hidden layer feature of the input sample to obtain a final feature representation of the input sample; S4, training a classifier by using the final feature representation of the input sample to obtain an adversarial sample detection model; and S5, detecting whether input data contains an adversarial sample or not by using the adversarial sample detection model obtained in the step 4. According to the method, different weights can be dynamically allocated to different hidden layers of an attacked target system, the adversarial samples in a single attack mode can be found, and the adversarial samples generated by each attack method can be detected without being influenced by a mixed attack mode.

Description

technical field [0001] The invention belongs to the fields of anti-attack, artificial intelligence technology application, and artificial intelligence system security, and specifically relates to an anti-attack detection method. Background technique [0002] As a technology to realize machine learning, deep learning has powerful feature extraction and representation capabilities, data fitting capabilities, and complex problem-solving capabilities. It is widely used in image classification, speech recognition, target detection, machine translation, recommendation systems, etc. Various fields have brought great convenience to people's lives. However, some security problems in deep learning itself limit its application in safety-critical tasks, especially deep learning models are extremely vulnerable to adversarial samples. Deliberately adding small perturbations that cannot be recognized by the human eye in ordinary samples may lead to changes in the decision-making mechanism...

AI Technical Summary

Problems solved by technology

[0005] The above methods have achieved good results, but most studies have not considered that different attack methods and different original sample inputs may have different sensitive layers in the target deep neural network, and that each hidden layer contributes differently to the discovery of different adversarial samples, so The above research methods have different resistance effects in the environment of different adversarial sample attacks, and they do not perform well when multiple attack methods are mixed.

Images