A dual decomposition approach to sparse adversarial attack problems in image classification

Abstract

The present invention discloses a dual decomposition method for the sparse adversarial attack problem of image classification. First, the sparse adversarial attack problem of image classification is modeled as a large-scale multi-objective optimization problem, with each pixel of the image as a decision variable, and then a dual decomposition strategy is executed. The outer decomposition uses a sliding window to divide the large-scale decision variables into overlapping subsets of small-scale decision variables. Each time the sliding window slides, a small-scale multi-objective optimization problem is generated. Once the small-scale multi-objective optimization problem is generated, the inner decomposition immediately creates a set of global direction vectors and converts them into a set of single-objective optimization problems. Finally, a block coordinate descent strategy is used to optimize all single-objective problems, thereby enhancing the integrity and optimality of the solution during the optimization process. Experiments show that the proposed method has better results than other algorithms in solving large-scale multi-objective problems, and can find the best perturbation compared to other algorithms in sparse adversarial attack problems.

Description

Technical Field

[0001] The present invention relates to the field of sparse adversarial attacks for image classification. The problem of sparse adversarial attacks for image classification is modeled as a large-scale multi-objective optimization problem, and a dual decomposition method for the sparse adversarial attack problem for image classification is designed. Background Art

[0002] The goal of the sparse adversarial attack problem for image classification is to find the smallest perturbation that can degrade the classifier performance. The study of sparse adversarial attacks is of great significance to autonomous driving safety, authentication, interpretability of deep learning, and the geometry of deep neural networks.

[0003] The sparse adversarial attack problem for image classification can be formulated as a multi-objective optimization problem with two objectives: the L1 and L2 norms of the added perturbation. The L0 norm is used. Therefore, the sparse adversarial attack problem for image classification is modeled as a multi-objective optimization problem.

[0004] Multi-objective optimization problems involve more than one conflicting objective and are widely used in industry and scientific research. The goal of multi-objective optimization problems is to find a set of Pareto optimal solutions (PS) that can approximate the Pareto optimal frontier (PF).

[0005] Evolutionary computation is considered a suitable method for solving multi-objective optimization problems. In the past decade, a large number of multi-objective optimization algorithms have been proposed, such as NSGA-II, SPEA2, MOPSO, and MOEA / D. These methods only consider the case of a small number of decision variables, but do not consider the case of a large number of decision variables.

[0006] With the development of technologies such as big data, cloud computing, and the Internet of Things, many large-scale optimization problems have emerged, and the number of their decision variables often exceeds 100. Such problems are called large-scale multi-objective optimization problems.

[0007] In recent years, several large-scale multi-objective optimization algorithms have been proposed, and initial attempts have been made to address these problems. However, research on these problems is still in its infancy. Existing algorithms need improvement in both solution quality and computational efficiency.

[0008] Sliding windows are a typical method for reducing the difficulty of vector-related problems. Sliding windows perform specific operators on subvectors of a specific size rather than the entire vector. Grouping decision variables using sliding windows helps reduce the overall difficulty of solving large-scale optimization problems. This is one of the reasons why the present invention uses sliding windows to divide decision variables.

[0009] The block coordinate descent algorithm is a non-gradient optimization algorithm for solving single-objective optimization problems. The idea of ​​the block coordinate descent algorithm ensures the integrity of a single solution, thus helping the algorithm to fall into local Pareto optimality. This invention also introduces the block coordinate descent algorithm into large-scale multi-objective optimization problems. Summary of the Invention

[0010] The purpose of this invention is to provide a new method for solving the sparse adversarial attack problem in image classification. The key to solving the sparse adversarial attack problem in image classification is that the algorithm needs to ensure both the quality and efficiency of the solution during the evolution process.

[0011] To achieve the above objectives, the present invention proposes a dual decomposition strategy for the sparse adversarial attack problem in image classification, comprising the following steps:

[0012] 1) Set the image population size N, double decomposition iterations It, start mark s_t, sliding window step s, sliding window size w, embedding algorithm A, and evolution maximum function evaluation times FEs;

[0013] 2) Randomly generate the initial image population P = {x1, x2, ..., x i ,…,x N}, where x i are different image individuals that have been initialized.

[0014] 3) Use algorithm A to optimize the image population P until the number of function evaluations is greater than or equal to s_t;

[0015] 4) Start the external decomposition operation on the image population: initialize the sliding window and obtain the decision variable component X covered by the sliding window partial ;

[0016] 5) Start the internal decomposition operation on the image population: transform the large-scale multi-objective problem to be solved into a problem about X partial A small-scale multi-objective optimization problem is to calculate a set of global reference points Z = {Z1, Z2, ..., Z l ,…,Z M}, where Z l , is the optimal value of the lth target among the N individual image solutions so far, M is the number of targets, and its definition is shown in formula (1).

[0017] Min(Z i -f l (x i )),i=1,2,…,N (1)

[0018] Among them, f l (x i ) is about the i-th image x iThen, a set of uniformly distributed global pixel reference vectors {V i}, i=1,2,…,N. Among them, V i ={v i1 ,v i2 ,…,v ij ,…,v iM},v ij For the i-th image x i The reference point corresponding to the j-th target, and for any j = 1, 2, ..., M, satisfies formula (2).

[0019]

[0020] Then, for the global pixel reference point Z and each global pixel reference vector {V i} perform global projection to obtain the corresponding small-scale MOP local pixel reference point vector Z* and a set of local pixel reference vectors {λ i Finally, the Chebyshev method is used to decompose the small-scale MOP into N single-objective problems as shown in formula (3);

[0021] Ming(x|λ i ,Z * )=Max{λ i |f l (x i )-Z * |} (3)

[0022] 6) Use the differential evolution algorithm shown in formulas (4), (5), and (6) to optimize X partial ;

[0023]

[0024]

[0025]

[0026] in represents the n dimensions of a solution, r1, r2, r3, r4, r5∈{1, 2, ..., N} represent five different indices that are not equal to i, F1 and F2 represent two scaling factors in differential evolution, L=(L 1 ,L 1 ,…,L q ,…L n ) and U=(U 1 ,U 1 ,…,U q ,…U n) represent the n-dimensional upper boundary vector and lower boundary vector of the search space respectively;

[0027] 7) Update the image population P according to the idea of ​​block coordinate descent: replace the image population P with X partial The corresponding components. Complete one double decomposition iteration;

[0028] 8) Determine whether the double decomposition termination condition is met, that is, the number of double decompositions reaches It. If so, go to 9), otherwise go to 4);

[0029] 9) Use algorithm A to optimize the image population P;

[0030] 10) Determine whether the algorithm termination condition is met, that is, the current function evaluation times reaches FEs. If so, output the image population, otherwise go to 9).

[0031] Compared with the existing methods, the present invention has the following obvious advantages and innovations:

[0032] The present invention proposes a dual decomposition strategy for the sparse adversarial attack problem of image classification. The method has the following characteristics: 1) The present invention proposes a dual decomposition strategy for the sparse adversarial attack problem of image classification, which can be embedded in existing multi-objective optimization algorithms to reduce the difficulty of solving and improve its solving performance. 2) Through a variable grouping strategy based on a sliding window and a global direction vector, each large-scale multi-objective optimization problem is converted into a set of small-scale single-objective optimization problems, and the small-scale single-objective optimization is optimized using a differential evolution algorithm and block coordinate descent. 3) Systematic experiments were carried out on a set of benchmark problems and a sparse adversarial attack problem of actual image classification, verifying the superior performance of the proposed dual decomposition strategy in solving the sparse adversarial attack problem of image classification. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 : Schematic diagram of double decomposition.

[0034] Figure 2 : Schematic diagram of the test problem results of sparse adversarial attack. DETAILED DESCRIPTION

[0035] In order to further explain the technical solution of the present invention, the present invention is described in detail below through specific embodiments.

[0036] First, the sparse adversarial attack problem of image classification is modeled as a multi-objective optimization problem. Figure 1As shown, when initialized, the sliding window will first cover x1 and x2 to generate the corresponding two-dimensional subspace. Then, through internal decomposition, the multi-objective optimization problem is converted into multiple single-objective optimization problems, and the DE algorithm is used for optimization. And the BCD concept is used to create a new population. When the sliding window slides forward, it will cover x2 and x3, generating a new subspace. As with the first external decomposition, after the internal decomposition, the DE algorithm is used to optimize the population and the BCD concept is used to update it. The second external decomposition is completed. The sliding window continues to slide forward to generate a subspace, and the internal decomposition, DE algorithm and population update are performed in sequence. When the last external decomposition is performed, the sliding window slides across the entire decision vector, completing one iteration of the dual decomposition strategy. The final output is the optimized population.

[0037] The performance of the proposed DDS was tested using nine LSMOP test functions and compared with seven representative algorithms, including WOF, LMOCSO, MOEA / DVA, LMOEA-DS, LSMOF, FDV, and DVCOEA. Each test function was independently run 10 times, and the average and standard deviation were recorded.

[0038] This paper addresses the sparse adversarial attack problem in image classification, as described below:

[0039] 1) Set the image population size N, double decomposition iterations It, start mark s_t, sliding window step s, sliding window size w, embedding algorithm A, and evolution maximum function evaluation times FEs;

[0040] 2) Randomly generate the initial image population P = {x1, x2, ..., x i ,…,x N}, where x i are different image individuals that have been initialized.

[0041] 3) Use algorithm A to optimize the image population P until the number of function evaluations is greater than or equal to s_t;

[0042] 4) Start the external decomposition operation on the image population: initialize the sliding window and obtain the decision variable component X covered by the sliding window partial ;

[0043] 5) Start the internal decomposition operation on the image population: transform the large-scale multi-objective problem to be solved into a problem about X partial A small-scale multi-objective optimization problem is to calculate a set of global reference points Z = {Z1, Z2, ..., Z l ,…,Z M}, where Z l , is the optimal value of the lth target among the N individual image solutions so far, M is the number of targets, and its definition is shown in formula (1).

[0044] Min(Z i -f l (x i )),i=1,2,…,N (1)

[0045] Among them, f l (x i ) is about the i-th image x i Then, a set of uniformly distributed global pixel reference vectors {V i}, i=1,2,…,N. Among them, V i ={v i1 ,v i2 ,…,v ij ,…,v iM},v ij For the i-th image x i The reference point corresponding to the j-th target, and for any j = 1, 2, ..., M, satisfies formula (2).

[0046]

[0047] Then, for the global pixel reference point Z and each global pixel reference vector {V i} perform global projection to obtain the corresponding small-scale MOP local pixel reference point vector Z* and a set of local pixel reference vectors {λ i Finally, the Chebyshev method is used to decompose the small-scale MOP into N single-objective problems as shown in formula (3);

[0048] Ming(x|λ i ,Z * )=Max{λ i |f l (x i )-Z * |} (3)

[0049] 6) Use the differential evolution algorithm shown in formulas (4), (5), and (6) to optimize X partial ;

[0050]

[0051]

[0052]

[0053] in represents the n dimensions of a solution, r1, r2, r3, r4, r5∈{1, 2, ..., N} represent five different indices that are not equal to i, F1 and F2 represent two scaling factors in differential evolution, L=(L 1 ,L 1 ,…,L q ,…L n ) and U=(U 1 ,U 1 ,…,U q ,…U n ) represent the n-dimensional upper boundary vector and lower boundary vector of the search space respectively;

[0054] 7) Update the image population P according to the idea of ​​block coordinate descent: replace the image population P with X partial The corresponding components. Complete one double decomposition iteration;

[0055] 8) Determine whether the double decomposition termination condition is met, that is, the number of double decompositions reaches It. If so, go to 9), otherwise go to 4);

[0056] 9) Use algorithm A to optimize the image population P;

[0057] 10) Determine whether the algorithm termination condition is met, that is, the current function evaluation times reaches FEs. If so, output the image population, otherwise go to 9).

[0058] Table 1 Performance comparison of the proposed method compared with other algorithms

[0059]

[0060]

[0061] Table 1 shows the performance comparison of the proposed algorithm with seven other algorithms on the LSMOP test function. It can be seen that DDS outperforms all the algorithms overall.

[0062] In addition, the present invention uses the CIFAR-10 image classification dataset. Since the size of each image is [3, 32, 32], the number of decision variables reaches 3×32×32=3072, so this problem is also a large-scale target optimization problem. The test results are as follows Figure 2 As shown, it can be seen that the present invention can find the shortest distance points with more even distribution and has the best effect.

Claims

1. A dual decomposition method for sparse adversarial attack problem in image classification, characterized by: The following steps are involved: 1) Set the image population size N, double decomposition iterations It, start mark s_t, sliding window step s, sliding window size w, embedding algorithm A, and evolution maximum function evaluation times FEs; 2) Randomly generate an initial image population P = {x1, x2, ..., x i ,...,x N }, where x i are different image individuals that have been initialized; 3) Use algorithm A to optimize the image population P until the number of function evaluations is greater than or equal to s_t; 4) Start the external decomposition operation on the image population: initialize the sliding window and obtain the decision variable component X covered by the sliding window partial ; 5) Start the internal decomposition operation on the image population: calculate a set of global reference points Z = {Z1, Z2, ..., Z l ,...,Z M }, where Z l , is the best value of the lth target among the N individual image solutions so far, M is the number of targets, and its definition is shown in formula (1); Min(Z i -f l (x i )),i=1,2,...,N (1) Among them, f l (x i ) is about the i-th image x i Then, a set of uniformly distributed global pixel reference vectors {V i }, i = 1, 2, ..., N. Where V i ={v i1 , v i2 ,...,v ij ,...,v iM }, v ij For the i-th image x i The reference point corresponding to the j-th target, and for any j = 1, 2, ..., M, satisfies formula (2); Then, for the global pixel reference point Z and each global pixel reference vector {V i } perform global projection to obtain the corresponding small-scale MOP local pixel reference point vector Z* and a set of local pixel reference vectors {λ i Finally, the Chebyshev method is used to decompose the small-scale MOP into N single-objective problems as shown in formula (3); Min g(x|λ i ,WITH * )=Max{λ i |f l (x i )-WITH * |} (3) 6) Use the differential evolution algorithm shown in formulas (4), (5), and (6) to optimize X partial ; in represents the n dimensions of a solution, r1, r2, r3, r4, r5∈{1, 2, ..., N} represent five different indices that are not equal to i, F1 and F2 represent two scaling factors in differential evolution, L=(L 1 , L 1 ,...,L q ,...L n ) and U=(U 1 , U 1 ,...,U q ,...U n ) represent the n-dimensional upper boundary vector and lower boundary vector of the search space respectively; 7) Update the image population P according to the idea of ​​block coordinate descent: replace the image population P with X partial corresponding components; complete one double decomposition iteration; 8) Determine whether the double decomposition termination condition is met, that is, the number of double decompositions reaches It. If so, go to 9), otherwise go to 4); 9) Use algorithm A to optimize the image population P; 10) Determine whether the algorithm termination condition is met, that is, the current function evaluation times reaches FEs. If so, output the image population, otherwise go to 9).

Images