Confrontation sample generation method based on belief attack and salient region disturbance limitation

Abstract

The invention provides an adversarial sample generation method based on belief attack and salient region disturbance limitation, and relates to the technical field of deep neural networks and the field of computer vision, and the method comprises the following steps: providing an original image and a white box target model, and using a data set containing the original image as a data set, generating a salient region binary mask about an original image by using a class activation mapping technology, and generating global adversarial disturbance by using a belief-based attack method and fusing an iterative fast gradient method; fusing the generated global confrontation disturbance and the salient region binary mask to generate salient region confrontation disturbance; and adding the salient region adversarial disturbance to the input image, iteratively updating until a preset termination condition is reached, and outputting an image adversarial sample of the last iteration as a generated adversarial sample. The adversarial sample generated by the method has low disturbance and high mobility.

Description

technical field [0001] The invention relates to the technical field of deep neural network and the field of computer vision, in particular to an adversarial sample generation method based on belief attack and significant region perturbation limitation. Background technique [0002] The widespread application of deep neural networks has resulted in huge performance improvements in many computer vision tasks, such as image classification, object detection, image segmentation, etc. However, recent studies have found that deep neural networks (Deep Neural Network, DNN) are easily deceived by artificially designed adversarial examples. In 2014, Szegedy et al. first discovered the existence of adversarial examples in the field of image classification, that is, adding small perturbations to the original image will cause the DNN model to misjudge. What's more, these tiny perturbations are also very subtle and imperceptible to the human visual system. This discovery reveals that th...

AI Technical Summary

Problems solved by technology

[0006] The technical problem to be solved by the present invention is to provide an adversarial sample generation method based on belief attack and significant area disturbance limitation, which can effectively solve the problems of perceptible disturbance and low migration existing in existing adversarial sample generation methods, and facilitate the detection of DNN models Vulnerabilities, as an evaluation index of DNN model security, thereby improving the robustness and security of the DNN model, the generated adversarial samples have low disturbance and high migration

Images