Deep neural network adversarial sample scoring method

Abstract

The invention discloses a deep neural network adversarial sample scoring method, and provides a new method for evaluating an adversarial sample attack effect in a black box mode, a fuzzy comprehensive evaluation method is adopted, and the adversarial sample attack effect is evaluated and quantified by taking a name as an adversarial sample score (AES) index. The method specifically comprises the steps of calculating the mobility, the imperceptibility, the attack success rate and the label offset degree of an adversarial sample, determining a membership degree subset table, determining the evaluation weight A of each aspect and a fuzzy comprehensive evaluation matrix by using an analytic hierarchy process, and obtaining an adversarial sample scoring index. The output of the AES index is a score for measuring the attack effect of the adversarial sample, and can be used for evaluating the harmfulness of the adversarial sample to the deep neural network.

Description

technical field [0001] The invention relates to the field of deep neural networks, in particular to a deep neural network confrontation sample scoring method. Background technique [0002] More and more governments and business organizations around the world are gradually realizing the economic and strategic importance of artificial intelligence. Deep neural network is one of the core research fields of artificial intelligence. The application of deep learning has spread to various branches of artificial intelligence, such as expert systems, cognitive simulation, planning and problem solving, data mining, network information services, image recognition, fault diagnosis, natural language understanding, robotics and games. Deep neural network technology has penetrated into all areas of people's daily life, and is gradually integrated into national infrastructure construction. Therefore, the security of deep neural network models is related to people's livelihood security and ...

AI Technical Summary

Problems solved by technology

At present, there is no systematic and intuitive indicator to reflect the attack effect of adversarial samples on deep neural networks, and there is no standard system to remotely evaluate the harmfulness of adversarial samples in a black-box manner

Images