A perturbed pixel generation method for image sample attack

Abstract

The present invention relates to a disturbed pixel generation method for image sample attack, comprising: step 1: selecting an image sample and obtaining pixel points of the image sample; step 2: using binary to encode each pixel point to obtain the corresponding pixel individual code, initializing to obtain the initial probability model, and generating the initial population; step 3: calculating the fitness value of each pixel individual in the population, and sorting them from small to large to obtain the fitness value vector of the population, and judging whether the minimum fitness value meets the condition of successful disturbance; step 4: if satisfied, selecting the pixel individual corresponding to the minimum fitness value as the best disturbed pixel of the image sample; if not satisfied, selecting the first k% of the pixel individuals, and using the roulette method to update the probability model and generate a new population, and then repeating step 3. The method of the present invention can efficiently and quickly generate disturbed images to achieve the purpose of detecting security vulnerabilities of deep neural networks.

Description

Technical Field

[0001] The present invention belongs to the field of deep neural network image recognition, and in particular relates to a method for generating disturbed pixels for image sample attack. Background Art

[0002] As an important technology in the field of machine learning, deep neural networks (DNNs) are increasingly being used in fields related to information security, such as face recognition and autonomous driving. However, recent studies have shown that DNNs are vulnerable to perturbation attacks from adversarial images, which can cause DNNs to misclassify the generated adversarial images. Such attacks may have a serious impact on DNN-based security systems. Therefore, researchers have studied deceptive neural networks to help fix related vulnerabilities in DNN-based security systems.

[0003] Since Szegedy et al. first proposed using small perturbations to interfere with the prediction of deep neural network models by observing the maximum prediction error of the network, using small perturbations to attack deep neural networks has begun to attract people's attention. Pixel perturbation attack is an attack method that makes small perturbations to the original image by modifying the local vector of the image to deceive the neural network. This plays an important role in discovering and repairing security vulnerabilities in DNNs. However, at present, the pixel attack based on perturbation to generate test images generally has the disadvantages of low success rate and long time consumption. Summary of the invention

[0004] In order to solve the above problems existing in the prior art, the present invention provides a method for generating disturbed pixels for image sample attack. The technical problem to be solved by the present invention is achieved through the following technical solutions:

[0005] The present invention provides a method for generating disturbed pixels for image sample attack, comprising:

[0006] Step 1: Select an image sample and obtain pixel points of the image sample;

[0007] Step 2: Use binary to encode each pixel to obtain the corresponding individual pixel code, initialize the initial probability model according to all individual pixel codes, and use the roulette method to generate the initial population;

[0008] Step 3: Calculate the fitness value of each pixel individual in the population, sort them from small to large, obtain the fitness value vector of the population, and determine whether the minimum fitness value meets the conditions for successful perturbation;

[0009] Step 4: If satisfied, the pixel individual corresponding to the minimum fitness value is selected as the best perturbation pixel of the image sample to implement pixel perturbation attack;

[0010] If not, the first k% of pixel individuals are selected according to the fitness value vector, and the probability model is updated and a new population is generated using the roulette method according to the selected pixel individuals, and then step 3 is repeated.

[0011] In one embodiment of the present invention, in step 1, the pixel points of the image sample are represented by x, y, r, g, b parameters, wherein x represents the horizontal coordinate of the pixel point, y represents the vertical coordinate of the pixel point, r represents the red intensity of the pixel point, g represents the green intensity of the pixel point, and b represents the blue intensity of the pixel point.

[0012] In one embodiment of the present invention, step 2 comprises:

[0013] Encoding each parameter of each pixel point in binary to obtain a corresponding individual pixel code;

[0014] The initial probability model Probality=(p1,p2,...,p i ,....), where p i is the probability that the i-th binary value is 1. In this initial probability model, the probability that each binary value of each pixel is 1 is 0.5;

[0015] Using the roulette method, a random number r is selected and compared with p in the initial probability model. i Compare, generate the binary value corresponding to the bit according to the comparison result, and obtain the initial population, where r∈(0,1), if r <p i , it returns 1, otherwise it returns 0.

[0016] In one embodiment of the present invention, in step 3, calculating the fitness value of each individual in the population includes:

[0017] Taking each individual pixel in the population as a disturbance pixel in turn, generating a corresponding adversarial image, inputting the adversarial image into the trained neural network model for recognition, obtaining a classification confidence corresponding to the adversarial image, and taking the classification confidence as the fitness value of the corresponding individual pixel in the population;

[0018] The neural network model is trained using an image data set, and the image samples are selected from the image data set.

[0019] In one embodiment of the present invention, in step 4, the probability model is updated and a new population is generated using a roulette method according to the selected pixel individuals, including:

[0020] According to the selected pixel individuals, the value ratio of each bit in each selected pixel individual is calculated;

[0021] According to the value ratio, a new probability model is obtained, wherein the probability vector of the pixel individual X in the new probability model is calculated using the following formula:

[0022]

[0023] Among them, P l+1 (X) represents the probability vector of pixel individual X in the new probability model, roulette(P l (X)) represents the probability vector of the pixel individual X after being processed by the roulette method according to the value ratio, D represents the preset minimum probability threshold, U represents the preset maximum probability threshold, P l,i (X) represents the probability of the ith position in the probability vector of the pixel individual X after processing by the roulette method, and τ represents the probability perturbation factor;

[0024] Based on the new probability model obtained by calculation, a new population is generated using the roulette method.

[0025] Compared with the prior art, the present invention has the following beneficial effects:

[0026] The perturbed pixel generation method for image sample attack of the present invention adopts binary encoding for individual pixels to reduce the problem dimension in the problem modeling of pixel perturbation attack, and realizes rapid evaluation of individual perturbation effect to reduce the time cost of searching for the optimal sample. The proposed probability update model based on roulette method can better maintain the diversity of population evolution search, which is conducive to finding the optimal perturbation scheme to improve the success rate of perturbation attack, so as to realize efficient and rapid generation of perturbation images to achieve the purpose of detecting security vulnerabilities of deep neural networks.

[0027] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the following specifically cites a preferred embodiment and describes it in detail with the accompanying drawings as follows. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 is a schematic diagram of a method for generating disturbed pixels for image sample attack provided by an embodiment of the present invention;

[0029] Figure 2 is a flow chart of an R-PBIL algorithm provided by an embodiment of the present invention;

[0030] Figure 3 It is a population and probability model iteration process diagram provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0031] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined purpose of the invention, a method for generating disturbed pixels for image sample attack proposed in accordance with the present invention is described in detail below in combination with the accompanying drawings and specific implementation methods.

[0032] The above and other technical contents, features and effects of the present invention are clearly presented in the following detailed description of the specific implementation modes in conjunction with the accompanying drawings. Through the description of the specific implementation modes, the technical means and effects adopted by the present invention to achieve the predetermined purpose can be more deeply and specifically understood. However, the attached drawings are only for reference and explanation purposes and are not used to limit the technical solutions of the present invention.

[0033] Embodiment 1

[0034] The main goal of pixel attack is to generate adversarial images. This problem can be transformed into a constrained optimization problem. The image input to the neural network is represented by a vector, and each sub-vector inside it can be represented as a pixel. The perturbed pixel is the core of generating adversarial images, which is a perturbation factor formed according to the image and the target class of the attack. The perturbation factor is added to a random position of the original image, and a new image is obtained by updating the position. The image is then submitted to the neural network for recognition. If the classifier marks the perturbed image as inconsistent with the original image category, it means that the attack has successfully deceived the deep neural network.

[0035] This embodiment provides a method for generating disturbed pixels for image sample attacks, specifically, an algorithm based on a distribution estimation algorithm (PBIL) and a roulette update probability model (R-PBIL) is provided to solve the problem of pixel attacks. As a proportional selection method, the roulette method itself affects the selection result through probability, so the use of the roulette method for initialization and updating the probability model of the population can make good use of the advantages of the distribution estimation algorithm.

[0036] Please refer to Figure 1 and Figure 2 , Figure 1 is a schematic diagram of a method for generating disturbed pixels for image sample attack provided by an embodiment of the present invention, Figure 2 : is a flow chart of an R-PBIL algorithm provided by an embodiment of the present invention. As shown in the figure, the method includes:

[0037] Step 1: Select an image sample and obtain the pixel points of the image sample;

[0038] Specifically, the image samples are matrixed to obtain pixel points of the image samples. In this embodiment, the pixel points of the image samples are represented by x, y, r, g, and b parameters, where x represents the horizontal coordinate of the pixel point, y represents the vertical coordinate of the pixel point, r represents the red intensity of the pixel point, g represents the green intensity of the pixel point, and b represents the blue intensity of the pixel point.

[0039] Step 2: Use binary to encode each pixel to obtain the corresponding individual pixel code, initialize the initial probability model according to all individual pixel codes, and use the roulette method to generate the initial population;

[0040] Specifically, step 2 includes:

[0041] Step 2.1: Encode each parameter of each pixel point in binary to obtain the corresponding individual pixel code;

[0042] Based on the distribution estimation idea of ​​PBIL, the core elements of R-PBIL in pixel attack are individual encoding and problem modeling. In this embodiment, binary encoding is used to encode individual pixels, the use of probability pool is abolished, and the solution to 0-1 knapsack problems is combined to reduce the dimension of the problem.

[0043] Among them, the individual pixel code can be expressed as:

[0044] X=(0,1,0,0,1,1,0,....) (1);

[0045] In this embodiment, the pixel X is composed of a 34-bit binary code. The parameters of the pixel points of the image sample include x, y, r, g, b. Since x, y are pixel coordinates and x, y∈(0, 31), the binary representation range is between 00000-11111, so x, y are represented by 5-bit binary; and r, g, b are pixel colors and r, g, b∈(0, 255), with values ​​of 0-255, the binary representation range is between 00000000-11111111, so 8-bit binary is used for representation, so the coding bits of the pixel X have a total of 5+5+8+8+8=34-bit binary numbers.

[0046] Step 2.2: Initialize the initial probability model Probality = (p1, p2, ..., p i ,....), where p i is the probability that the i-th binary value is 1. In this initial probability model, the probability that each binary value of each pixel is 1 is 0.5;

[0047] In this embodiment, since each bit of the individual pixel can only be 0 or 1, the initial value of the probability model is 0.5, indicating that the probability of the bit being 1 is 0.5, that is:

[0048] Probability=(0.5,0.5,0.5,...) (2);

[0049] Step 2.3: Using the roulette method, select a random number r and compare it with p in the initial probability model i Compare, generate the binary value corresponding to the bit according to the comparison result, and get the initial population, where r∈(0,1), if r <p i , it returns 1, otherwise it returns 0.

[0050] The roulette wheel method is also known as the roulette wheel selection method, also known as the proportional selection method. Its basic idea is that the probability of each individual being selected is proportional to its fitness. The process of evolving the best perturbation pixel using the distribution estimation algorithm requires this feature, that is, retaining the best possible x, y, r, g, b values ​​(i.e., pixel individuals). Since binary coding is used, a roulette wheel is used to select whether the 34-bit code of the pixel point is 0 or 1.

[0051] Step 3: Calculate the fitness value of each pixel individual in the population, sort them from small to large, obtain the fitness value vector of the population, and determine whether the minimum fitness value meets the conditions for successful perturbation;

[0052] Specifically, the fitness value of each individual in the population is calculated, including:

[0053] Each pixel in the population is used as a perturbation pixel in turn to generate a corresponding adversarial image. The adversarial image is input into the trained neural network model for recognition to obtain the classification confidence corresponding to the adversarial image. The classification confidence is used as the fitness value of the corresponding pixel in the population.

[0054] The neural network model is trained using an image data set, and image samples are selected from the image data set.

[0055] It should be noted that, in this embodiment, the function for calculating the fitness of individual pixels is the confidence of classifying images using the trained neural network model, which is an external fitness function to evaluate the correctness of each network predicting the original image. The significance of this function is to reduce the probability label of the true class as much as possible. In non-target attacks, the higher the confidence of the neural network model in classifying a disturbed image, the lower the probability of misclassification by the neural network, that is, the fitness value of the individual disturbed pixel is low. In targeted attacks, the neural network model needs to perform a specific classification on a disturbed image. Only when the confidence of the target class recognition is low, it means that the individual fitness value of the disturbed pixel is high.

[0056] In this embodiment, if the minimum fitness value (ie, the confidence value) is less than 0.5, it is determined that the minimum fitness value meets the condition for successful disturbance; otherwise, the condition for successful disturbance is not met.

[0057] Step 4: If satisfied, select the pixel individual corresponding to the minimum fitness value as the best perturbation pixel of the image sample to implement pixel perturbation attack;

[0058] If not, the first k% of pixel individuals are selected according to the fitness value vector, and the probability model is updated and a new population is generated using the roulette method based on the selected pixel individuals, and then step 3 is repeated.

[0059] Specifically, in step 4, the probability model is updated and a new population is generated using the roulette method according to the selected pixel individuals, including:

[0060] (1) According to the selected pixel individuals, the value ratio of each bit in each selected pixel individual is calculated;

[0061] Specifically, for example, select the first 10 pixel individuals, each pixel individual has 34 bits, and count the number of times each bit is 0 and 1. For example, the first bit of the first pixel individual is 1, and the first bits of 8 out of the 10 pixel individuals are 1, then the value ratio of this bit in this pixel individual is 80%.

[0062] (2) According to the value ratio, a new probability model is obtained, wherein the probability vector of the pixel individual X in the new probability model is calculated using the following formula:

[0063]

[0064] Among them, P l+1 (X) represents the probability vector of pixel individual X in the new probability model, roulette(P l (X)) represents the probability vector of the pixel individual X after being processed by the roulette method according to the value ratio, D represents the preset minimum probability threshold, U represents the preset maximum probability threshold, Pl,i (X) represents the probability of the i-th bit in the probability vector of the pixel individual X processed by the roulette method, and τ represents the probability perturbation factor;

[0065] Specifically, in step (1), the number of the i-th bits of the first k% pixel individuals taking 1 is n i , and the total number of the first k% pixel individuals is N, then the probability that the value of this bit is 1 should be

[0066]

[0067] roulette(P l (X)) is specifically operated as follows:

[0068] (1) Generate a uniformly distributed pseudo-random number r in the interval [0, 1];

[0069] (2) Let t = 1 - P l-1 (X), where P l-1 (X) represents the probability vector of the pixel individual X in the previous generation probability model. If r < t, then return (P l-1 (X) + P l (X)) / 2, otherwise return P l (X).

[0070] It should be noted that after calculating the proportion of each bit value of the pixel individual, the probability of the 34-bit parameter taking 1 in the probability model will be updated. As the population generation number increases continuously, when too many local pixel points are collected, the probability that a certain binary bit takes 1 may be 0 or 1, which may cause the algorithm to fall into a local optimum, resulting in the stagnation of the update of the probability model. Therefore, to solve this problem, in this embodiment, a probability perturbation factor τ is added to avoid the probability being too large or too small. When the probability value returned to the probability model is less than the lowest threshold D, this probability is added with τ as the probability that the individual takes 1 in this bit; and when the probability value returned to the probability model is greater than the threshold U, this probability is subtracted by τ as the probability that the individual takes 1 in this bit. This can avoid the algorithm falling into a local optimum to a certain extent and maintain the diversity of the population.

[0071] (3) According to the calculated new probability model, use the roulette method to generate a new population.

[0072] Specifically, the generation method of the new population is similar to the generation method of the initial population, that is, using the roulette method, select a random number r and compare it with p in the new probability model i , and according to the comparison result, generate the corresponding binary value of this bit to obtain a new population, where r ∈ (0, 1). If r < p i , then return 1, otherwise return 0.

[0073] For further information, see Figure 3 , Figure 3 is a population and probability model iteration process diagram provided by an embodiment of the present invention, Figure 3 The evolution process of the population and probability model of each generation is shown. It is worth noting that in addition to the probability perturbation factor τ, the whole process also involves the adjustment of two other parameters: the population size popsize and the ratio of selecting excellent individuals k. Different combinations of these three parameters will affect the performance of the distribution estimation algorithm. If the population size is set too small, there will be almost no individuals in the initial population that develop towards high-quality solutions, resulting in a large number of low-quality solutions in the final result, and it is very likely that the global optimal solution will not be found; if the population size is set too large, it will lead to a sudden increase in the complexity of probability model construction, sampling and evaluation of the population, and other population-related operations, so choosing an appropriate popsize is particularly important.

[0074] The perturbed pixel generation method for image sample attack of this embodiment adopts binary encoding for individual pixels to reduce the problem dimension in the problem modeling of pixel perturbation attack, and realizes rapid evaluation of individual perturbation effect to reduce the time cost of searching for the optimal sample. The proposed probability update model based on roulette method can better maintain the diversity of population evolution search, which is conducive to finding the optimal perturbation scheme to improve the success rate of perturbation attack, so as to realize efficient and rapid generation of perturbation images to achieve the purpose of detecting security vulnerabilities of deep neural networks.

[0075] Embodiment 2

[0076] This embodiment illustrates the effect of the disturbance pixel generation method for image sample attack in Embodiment 1 through experimental comparison.

[0077] This example uses Python 3.7 based on numpy, pandas, scipy, keras and other libraries to conduct experiments. The data set comes from the Kaggle platform, and the operating environment uses Jupyter Notebook. The device information used in the experiment is as follows: 16GB RAM; 900G hard disk; 2.60GHz 64-bit processor; Windows 10 operating system.

[0078] The image data of the pixel attack experiment comes from the cifar-10 test dataset (not the original dataset) on the Kaggle platform. CIFAR-10 and CIFAR-100 are labeled subsets of the 80 million tiny image datasets. They were collected by Alex Krizhevsky, Vinod Nair, and Geoffrey Hinton. The Cifar10 dataset includes 60,000 32×32 color images in 10 categories, 6,000 images in each category. These datasets can be used for neural network model training. After the network model for image classification is trained, some labeled datasets are selected from the dataset, and the images are matrixed to obtain the five-tuple x, y, r, g, b of each pixel. Cifar-10 is a color image dataset that is closer to universal objects. CIFAR-10 is a small dataset for identifying universal objects compiled by Hinton's students Alex Krizhevsky and Ilya Sutskever. It contains 10 categories of RGB color images: airplane, automobile, bird, cat, deer, dog, frog, horse, ship and truck. The dataset contains 30,000 images. Each attack randomly selects 500 test images from the cifar-10 dataset to perform pixel attacks on three networks. The three networks used as image classifiers are Allconvolution net-work, Network in Network and VGG16 network. This embodiment uses 6 neural network models, lenet, resnet, pure_cnn, net_in_net and densenet, as classifiers for test images.

[0079] In order to obtain the optimal parameter combination of R-PBIL, it is necessary to experiment with the optimal values ​​of the population size popsize, the perturbation probability factor τ, and the percentage k of excellent individuals. First, consider that the population size popsize should be as large as possible, so that there can be as many excellent individuals as possible in the first generation of excellent populations, so as to accelerate the evolution of the population and make it easier to find the best pixel perturbation individuals. However, it should not be too large. Too large a value will easily lead to excessive space overhead and prolong the search time. Therefore, in this embodiment, popsize is taken as 400, 800, and 1000 respectively. Secondly, for the perturbation factor τ, its role is to balance the problem of too high or too low values ​​in the probability model, thereby avoiding falling into the local optimum. If the value is too low, it cannot play a role in affecting the probability. If it is too high, it will destroy the evolution process of the probability model. Therefore, τ is taken as 0.3, 0.4, and 0.5 for experiments. Finally, k is the number of excellent individuals that affects the probability. If the value is too high, it will easily lead to the probability model evolving too slowly. If the value is too low, it will easily lead to the probability model evolving too quickly and falling into the local optimum. Therefore, k is also set to 0.3, 0.4, and 0.5 for the experiment.

[0080] Table 1 shows the experimental results obtained by averaging 10 single-pixel perturbations in a single frog image using different combinations of the above τ and k parameters when popsize is set to 400, 800, and 1000, where the maximum number of iterations is set to 20.

[0081] Table 1 Experimental results of popsize=400 in frog test images

[0082]

[0083] According to the above experimental results, it can be seen that the algorithm performance is best when popsize = 400, τ = 0.3, k = 0.4. When popsize = 800, τ = 0.3, k = 0.4, it also has advantages in perturbation success rate and time. When popsize = 1000, τ = 0.3, k = 0.4, due to the increase in the number of populations, the time taken is longer than popsize = 800, but the success rate and number of iterations at this time are both optimal, and the number of iterations counted in the table shows that the maximum number of iterations required by R-PBIL is about 15 times to obtain the optimal solution. Therefore, after analyzing the experimental results, the three parameter combinations are popsize = 1000, τ = 0.3, k = 0.4, and the maximum number of iterations maxiter is set to 15, which can effectively reduce the time wasted by invalid iterations.

[0084] This embodiment also conducts a comparative experiment between the R-PBIL algorithm of the present invention and the algorithm DE. In this experiment, the cifar-10 data set is used, and the experimental parameter settings are shown in Table 2.

[0085] Table 2 Experimental parameters of R-PBIL and DE

[0086]

[0087] First, the six network models mentioned above are trained, and then the images after non-target attacks are passed to the six network models for recognition. For targeted attacks, only LeNet and ResNet are passed to the experiment, and then the statistics related to targeted and non-target attacks are collected. These statistics include the success rate of the model attacking the image and the percentage of the image affected by the number of pixels. The purpose of image classification is achieved by traversing the six models and performing perturbations of 1, 3, and 5 pixels.

[0088] In order to illustrate the success of the method proposed in this embodiment in attacking with different numbers of pixels, 1, 3, and 5 pixel non-target attacks were performed on six networks respectively.

[0089] Tables 3, 4, and 5 list the statistics of the six network models being successfully deceived under non-targeted attacks, where accuracy represents the accuracy of the neural network model in recognizing images after training, that is, the success rate of successfully classifying natural images. attack_success_rate represents the actual success rate obtained from the experiment. number of iterations represents the average number of times the optimal solution is found. time represents the average time spent on a single run.

[0090] Table 3. Success of single pixel non-target attack on network model

[0091]

[0092]

[0093] Table 4 Network model 3 pixel non-target attack success

[0094]

[0095] Table 5 Network model 5 pixel non-target attack success

[0096]

[0097] It can be seen from the experimental data that the method proposed in this embodiment is the best when applied to single-pixel attacks, and the attack success rates under the six network models are better than DE. In the case of 3-pixel attacks, the effects of pure_cnn and net_in_net are slightly worse than the original DE, and in the case of 5-pixel attacks, only the effect of the network pure_cnn is worse than the original DE. Among them, since the network model lenet itself has a low accuracy rate for image classification and recognition, both the original DE and R-PBIL generally have a high success rate in 1, 3, and 5 pixel attacks. Therefore, according to the attack success statistics in Tables 3, 4, and 5, it can be concluded that the method of this embodiment is effective when applied to the pixel attack problem.

[0098] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants are intended to cover non-exclusive inclusion, so that an article or device including a series of elements includes not only those elements, but also other elements that are not explicitly listed. In the absence of more restrictions, the elements defined by the statement "including one..." do not exclude the existence of other identical elements in the article or device including the elements.

[0099] The above contents are further detailed descriptions of the present invention in combination with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, which should be regarded as falling within the protection scope of the present invention.

Claims

1. A method for generating disturbed pixels for image sample attack, characterized in that: include: Step 1: Select an image sample and obtain pixel points of the image sample; Step 2: Use binary to encode each pixel to obtain the corresponding individual pixel code, initialize the initial probability model according to all individual pixel codes, and use the roulette method to generate the initial population; Step 3: Calculate the fitness value of each pixel individual in the population, sort them from small to large, obtain the fitness value vector of the population, and determine whether the minimum fitness value meets the conditions for successful perturbation; Step 4: If satisfied, the pixel individual corresponding to the minimum fitness value is selected as the best perturbation pixel of the image sample to implement pixel perturbation attack; If not, the first k% of pixel individuals are selected according to the fitness value vector, and the probability model is updated and a new population is generated using the roulette method according to the selected pixel individuals, and then step 3 is repeated; The step 2 comprises: Encoding each parameter of each pixel point in binary to obtain a corresponding individual pixel code; The initial probability model Probality=(p1,p2,...,p i ,....), where p i is the probability that the i-th binary value is 1. In this initial probability model, the probability that each binary value of each pixel is 1 is 0.5; Using the roulette method, a random number r is selected and compared with p in the initial probability model. i Compare, generate the binary value corresponding to the bit according to the comparison result, and obtain the initial population, where r∈(0,1), if r <p i , then return 1, otherwise, return 0; In step 4, the probability model is updated and a new population is generated using the roulette method according to the selected pixel individuals, including: According to the selected pixel individuals, the value ratio of each bit in each selected pixel individual is calculated; According to the value ratio, a new probability model is obtained, wherein the probability vector of the pixel individual X in the new probability model is calculated using the following formula: Among them, P l+1 (X) represents the probability vector of pixel individual X in the new probability model, roulette(P l (X)) represents the probability vector of the pixel individual X after being processed by the roulette method according to the value ratio, D represents the preset minimum probability threshold, U represents the preset maximum probability threshold, P l,i (X) represents the probability of the ith position in the probability vector of the pixel individual X after processing by the roulette method, and τ represents the probability perturbation factor; Based on the new probability model obtained by calculation, a new population is generated using the roulette method.

2. The method for generating disturbed pixels for image sample attack according to claim 1, characterized in that: In step 1, the pixel points of the image sample are represented by x, y, r, g, and b parameters, where x represents the horizontal coordinate of the pixel point, y represents the vertical coordinate of the pixel point, r represents the red intensity of the pixel point, g represents the green intensity of the pixel point, and b represents the blue intensity of the pixel point.

3. The method for generating disturbed pixels for image sample attack according to claim 1, characterized in that: In step 3, the fitness value of each individual in the population is calculated, including: Taking each individual pixel in the population as a disturbance pixel in turn, generating a corresponding adversarial image, inputting the adversarial image into the trained neural network model for recognition, obtaining a classification confidence corresponding to the adversarial image, and taking the classification confidence as the fitness value of the corresponding individual pixel in the population; The neural network model is trained using an image data set, and the image samples are selected from the image data set.

Images