Adversarial sample generation method and system based on general disturbance

Abstract

The invention provides an adversarial sample generation method and system based on general disturbance, and belongs to the field of machine learning, and the method comprises the steps: obtaining a training sample set; randomly initializing an initial disturbance image of which the size is the same as that of an output image of the ViT model, wherein the ViT model comprises a plurality of same units, and each unit comprises a plurality of attention operators; performing iterative optimization on the initial disturbance image according to the training sample set and each attention operator of the ViT model to obtain an optimal general disturbance image; and adding the optimal general disturbance linearity to a sample image in the to-be-trained sample set to obtain a corresponding ultimate confrontation image. On the premise of not influencing the visual effect, a normal training sample is converted into an adversarial sample, and the final adversarial sample is adopted to train the ViT model, so that the anti-interference capability and robustness of the model can be improved.

Description

technical field [0001] The present invention relates to the field of machine learning, in particular to a method and system for generating an adversarial example based on general perturbation. Background technique [0002] With the maturity of deep learning technology, models based on neural networks are widely used in various classification tasks, such as classifying images, classifying text, classifying speech, etc. Convolutional neural networks have the characteristics of local perception and weight sharing, and play an important role in computer vision. But in recent years, a large number of studies have found that they are very vulnerable to adversarial noise: embedding human-imperceptible disturbances in the input can easily mislead the model's decision-making. In practical applications, in order for the model to make correct decisions on objects that contain disturbances, the model needs to have strong anti-disturbance capabilities. Adversarial learning is currently...

AI Technical Summary

Problems solved by technology

However, recent studies have found that ViTs are still vulnerable to adversarial noise, resulting in erroneous predictions.

Since the ViTs model requires a large amount of data in the training phase, it takes a high time cost to generate corresponding adversarial samples for each training sample, so it is difficult to effectively deploy effective adversarial training.

Images