Black box image adversarial sample generation method with visual perception concealment

Abstract

The invention relates to a black box image adversarial sample generation method with visual perception concealment, and relates to the technical field of artificial intelligence safety. According to the main technical scheme, the method comprises the following steps: 1, initializing algorithm parameters and an adversarial sample set; 2, selecting a dominant adversarial sample subset according to adversarial attack effects; 3, judging whether an attack of an optimal adversarial sample is successful, and if yes, turning to step 6; 4, if not, generating a new adversarial sample set by using intersections of the adversarial sample subset; 5, adding concealed noise according to a certain probability; and 6, outputting the adversarial sample and performing testing. According to the method, the masking effect of visual perception is utilized, so that the visual perception similarity between a generated adversarial sample and an original image is high, good concealment is achieved, and black box adversarial attacks can be started unobserved.

Description

technical field [0001] The present invention relates to the field of artificial intelligence security technology, in particular to a black-box image adversarial sample generation method with visual perception concealment. Background technique [0002] With the emergence of big data and the improvement of large-scale computing power, artificial intelligence has been widely used in all aspects of society, especially in the field of image recognition. Artificial intelligence has achieved many excellent results in image classification, target detection, image segmentation, etc. results. However, with the in-depth research and wide application of artificial intelligence, its security issues are gradually exposed. Christian Szegedy proposed the concept of adversarial samples in 2014, that is, deliberately adding subtle disturbances to the input data, causing the model to give wrong outputs with high confidence in the input. Most convolutional neural networks are vulnerable to ad...

AI Technical Summary

Problems solved by technology

However, the shortcomings of this method are: it belongs to the white-box adversarial sample generation method, and the calculation of the gradient needs to obtain the parameter information of the target model or the neural network structure

However, the disadvantage of this method is that the number of perturbed pixels cannot represent the concealment effect of visual perception, so the generated adversarial samples have low visual similarity with the original image, and the concealment is poor.

Images