Adversarial sample generation method and device

Abstract

The invention discloses an adversarial sample generation method and device. The adversarial sample generation method comprises the steps of dividing a region in an original sample into a target region and a non-target region; the target area is an area with high attention of a visual system, and the non-target area is an area with low attention of the visual system; determining gradient noise of the original sample, and dynamically distributing different step lengths for the target area and the non-target area respectively; respectively adding interference noise to the target area and the non-target area based on the step length and the gradient noise to obtain an adversarial sample corresponding to the original sample; the interference intensity of the non-target area is higher than that of the target area. According to the method, the disturbance noise amplitude and the noise information energy intensity can be increased under the condition that human eyes are not easy to perceive through small disturbance in the target area and high disturbance in the non-target area, so that the aggressiveness of the adversarial sample is improved, and the trained network model has higher robustness.

Description

Technical field [0001] The present invention relates to the field of artificial intelligence, and Background technique [0002] In the field of computer visual technology, deep neural network technology is widely used in target identification applications, with representative face recognition, automatic driving recognition, and the like. With the continuous development of target identification technology and the introduction of more and more production and life fields, the security issues of target identification technology are also gradually exposed, and it is increasingly attracted attention to the safety of deep neural network models, facing many challenges. Conflict sample attack For depth neural network defects, the antibody samples are generated by adding naked eye, making the network model to generate miscrosis, misleading target recognition system behavior, and deductive or target recognition results to misleading Effect. [0003] In the prior art, confrontation-resistant...

AI Technical Summary

Problems solved by technology

This type of anti-sample noise is essentially a small, high-frequency disturbance, which is easily defended by high-frequency filtering and other defense methods to eliminate noise, and it is easy to be detected by the naked eye by simply increasing the disturbance amplitude.

Images