Model anti-attack robustness evaluation method and system in black box scene

Abstract

The invention discloses a model anti-attack robustness evaluation method and system in a black box scene, and belongs to the field of anti-attack and artificial intelligence intellectual property protection analysis. Comprising the steps of obtaining an access permission of a target model in a black box scene, and defining a substitution model having the same function as the target model; obtaining a label-free original image sample consistent with target model data distribution, and taking the label-free original image sample as an initialized confrontation sample; optimizing the adversarial sample by using the substitution model; and inputting the original image sample and the final adversarial sample after iteration into the target model, and calculating a robustness evaluation score and a security level of the target model. According to the method for generating the adversarial sample, the intermediate feature of the substitution model is used as an optimization target, the adversarial sample is optimized to generate a more robust adversarial feature so as to enhance the adversarial mobility of the adversarial sample, and the method does not need to obtain a model label of the sample. Quantitative evaluation of the model anti-attack robustness is realized on the basis of taking the anti-attack feature robustness as a model security evaluation index.

Description

Technical Field

[0001] The present invention relates to the fields of adversarial attacks and artificial intelligence intellectual property protection analysis, and particularly relates to a method and system for evaluating the robustness of model adversarial attacks in a black-box scenario. Background Art

[0002] In the field of deep learning, the security and robustness of a model are key factors in evaluating its practical application value. In recent years, deep neural networks (DNNs) have developed rapidly and achieved remarkable results in many fields such as image classification, object recognition, speech translation, and image-text matching. More and more application programs and systems are supported by deep learning. For example, the face recognition system, as a biometric authentication method, is widely deployed in smartphones, online banking, and access control security systems. In an autonomous driving system, image recognition and object detection are the basis for a series of driving decisions.

[0003] Although deep learning has excellent performance in practical applications, the potential security risk of the vulnerability of deep neural networks to adversarial examples (AEs) greatly affects the deployment and use of models in fields such as autonomous driving, finance, and healthcare. Adversarial examples are generated by introducing carefully designed tiny perturbations into normal input data. Although these perturbations are difficult to be perceived by humans, they cause the model to make incorrect predictions. These perturbations can be pixel value changes in images, noises in speech, and character modifications in text. The existence of adversarial samples indicates that there are vulnerabilities in the model architecture and training process, and the features extracted by the neural network are different from human discriminative features. And this characteristic may bring serious security threats. By printing the adversarial perturbation into a pair of "glasses", the person wearing them can impersonate an insider to pass through the face recognition access control.

[0004] Since the discovery of the vulnerability of neural networks to adversarial examples, extensive research has been conducted on this security issue in both the academic and industrial communities. According to the different attack purposes of the attacker, adversarial attacks are divided into two types: untargeted attacks and targeted attacks. The former only requires the model to give a wrong answer, while the latter requires the model to give an answer preset by the attacker. According to the different attack scenarios and attack capabilities of the attacker, the methods of launching attacks through adversarial examples are generally divided into two types: white-box attacks and black-box attacks. The initiator of a white-box attack knows the model structure and model parameters and can directly generate adversarial examples by iterating the gradient of the input sample; while the attacker of a black-box attack can only access the model service, that is, obtain the output confidence distribution of the model through the input, without knowing more information about the model. In a black-box environment where it is almost impossible to obtain any information related to the target model, the attacker uses adversarial examples generated by a surrogate model to attack the target model. The mainstream transferable adversarial attacks can be divided into four categories according to the specific stage at which the attacker focuses on the generation of adversarial perturbations: (1) Methods based on input transformation, where input transformation can help the model obtain the intrinsic key features of the object and further improve the transferability of adversarial examples. (2) Gradient-based methods, which design the direction of gradient descent according to additional gradient information and gradient integration. (3) Methods based on optimization objectives, generally designing better optimization objectives instead of greedily perturbing clean images along the gradient of the cross-entropy loss. (4) Methods based on model ensembles, where most use a model ensemble obtained from random dropout to replace a single source model. Among them, methods based on input changes usually have difficulty achieving a good success rate of transferable attacks; gradient-based methods have a large computational cost during the calculation process, and due to the inaccuracy of the first-order and second-order gradient approximations, the transferability of adversarial examples cannot reach the theoretically optimal value; methods based on objective optimization usually still utilize the information of the output classification layer or a specific intermediate layer, without being able to well combine the multiple intermediate features of the model; methods based on model ensembles are difficult to train, and the attack effect is strongly related to the integrated models.

[0005] In addition, existing methods usually require additional data and generally face difficulties in obtaining auxiliary data in practical applications. Moreover, the labels of input samples in the target model usually cannot be accurately obtained, and the situation under unknown sample labels is not considered. The transferability of adversarial examples generated by existing black-box attack methods is not high, which will lead to insufficient evaluation of model vulnerability. Summary of the Invention

[0006] In view of the lack of an analysis method for the robustness evaluation of existing model adversarial security risks in an unsupervised black-box scenario, the present invention proposes a method and system for evaluating the robustness of model adversarial attacks in a black-box scenario. By means of an adversarial sample generation method based on input sample enhancement and alignment opposition of intermediate model features, the robustness of adversarial features is enhanced, thereby improving the transferability of adversarial samples, and without the need for input sample labels. Further, the generated adversarial samples can be used to evaluate the ability of the model to defend against adversarial attacks.

[0007] The technical solution proposed by the present invention is as follows:

[0008] In a first aspect, the present invention proposes a method for evaluating the robustness of model adversarial attacks without labels in a black-box scenario, where the model is used in the field of image recognition; the method includes:

[0009] (1) Obtain access to the target model in a black-box scenario, and define a surrogate model with the same function as the target model;

[0010] (2) Obtain unlabeled original image samples with the same data distribution as the target model, and at the same time use them as initialized adversarial samples;

[0011] (3) Optimize the adversarial samples using the surrogate model, and iteratively execute:

[0012] Randomly sample a number of samples in the neighborhood of the current-round adversarial samples, divide the sampled samples into subgraphs, apply input enhancement transformation operations to each subgraph and then splice and restore them to obtain a series of enhanced adversarial samples;

[0013] Obtain the intermediate layer output features of the original image samples and their corresponding series of enhanced adversarial samples in the surrogate model, calculate the feature similarity loss, optimize and update the current-round adversarial samples, traverse all adversarial samples and iterate multiple times;

[0014] (4) Use the original image samples and the final adversarial samples after the iteration ends to input into the target model, and calculate the robustness evaluation score and security level of the target model.

[0015] Further, the surrogate model is a model based on convolutional network layers, and the output of all or part of the convolutional network layers is used as the intermediate layer output features.

[0016] Further, the division of the sampled samples into subgraphs includes:

[0017] Randomly generate the same number of horizontal segmentation coordinates and vertical segmentation coordinates within the width dimension and height dimension ranges of the sampled samples, sort them, and the segmentation coordinates in the width dimension and height dimension correspond one by one, and divide them into subgraphs according to the segmentation coordinates.

[0018] Furthermore, the input enhancement change operation includes vertical scrolling shift and horizontal scrolling shift with random step sizes, and horizontal flipping operation with random probabilities.

[0019] Furthermore, calculating the feature similarity loss and optimizing and updating the adversarial samples in the current round includes:

[0020] Normalize the output features of the intermediate layers of the original image samples and their corresponding series of enhanced adversarial samples in the surrogate model;

[0021] For each intermediate layer feature, randomly select γ proportion of sub-features in the channel dimension to calculate the feature similarity loss, and use the weighted value of the similarity losses of a series of enhanced adversarial samples as the total loss;

[0022] Calculate the gradient of the adversarial samples in the current round based on the total loss, optimize and update the adversarial samples in the current round, and obtain the next round of adversarial samples.

[0023] Furthermore, randomly selecting γ proportion of sub-features in the channel dimension to calculate the feature similarity loss, the calculation formula is as follows:

[0024]

[0025] where loss i represents the loss between the i-th enhanced adversarial sample and the original image sample, n represents the number of intermediate layers selected for the surrogate model, respectively represent the k-th intermediate layer output features of the original image sample and the enhanced adversarial sample, γ represents the extraction ratio in the channel dimension, represents the cosine similarity of the intermediate layer output feature B represents the number of enhanced adversarial samples, C represents the number of channels, and ||.|| represents the norm.

[0026] Furthermore, traverse all the adversarial samples and iterate multiple times to optimize the adversarial samples, and each original image sample corresponds to a final adversarial sample after the iteration ends.

[0027] Furthermore, step (4) includes:

[0028] Input the original image sample and the adversarial sample into the target model to obtain the model outputs respectively;

[0029] Calculate the model accuracy according to the model outputs:

[0030]

[0031] where f θ (.) represents the target model, respectively represent the set of original image samples and the set of adversarial samples, is an indicator function (takes 1 when the equality condition is satisfied, otherwise takes 0). represents the number of samples in the set, and i represents the i-th sample in the sample set. represents the accuracy rate;

[0032] Take the model accuracy rate as the robustness evaluation score. The higher the score, the higher the robustness of the model against adversarial attacks and the safer the model is.

[0033] In a second aspect, the present invention provides a system for evaluating the robustness of a model against adversarial attacks without labels in a black-box scenario, which is used to implement the method for evaluating the robustness of a model against adversarial attacks without labels in the above-mentioned black-box scenario.

[0034] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0035] (1) In a more realistic black-box scenario with a larger attack surface, that is, when the attacker cannot directly obtain the structure, parameters, and optimizers of the target model, and at the same time cannot obtain the correct labels of the input samples, the present invention generates adversarial samples with strong transferability based on the input enhancement changes and the misalignment of the intermediate features of the model, without relying on additional data labels. This method saves the time and resources required for obtaining and processing additional data, and improves the efficiency and practicality of generating adversarial samples, making the security test of the model against adversarial sample attacks more convenient and economical;

[0036] (2) The present invention constructs a robustness score index for adversarial risks based on whether the outputs of the original image samples and the adversarial samples are consistent in the target model, providing a quantitative measurement method for the adversarial robustness of the model, which can be used to evaluate the security of different models or the effectiveness of different defense strategies. Description of the Drawings

[0037] Figure 1 is a flowchart of the method for evaluating the robustness of a model against adversarial security risks;

[0038] Figure 2 is an architecture diagram of the method for generating adversarial samples based on input enhancement changes and the misalignment of the intermediate features of the model;

[0039] Figure 3 is a flowchart of the method for generating adversarial samples based on input enhancement changes and the misalignment of the intermediate features of the model;

[0040] Figure 4 is a flowchart of calculating the model robustness evaluation index based on the accuracy rate of the target model and the similarity of adversarial features. Detailed Embodiments

[0041] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be noted that the following embodiments are intended to facilitate the understanding of the present invention, but do not limit it in any way.

[0042] In an embodiment provided by the present invention, as Figure 1 shown is the flowchart of the method for evaluating the robustness of the model against security risks of the present invention, which aims to evaluate the robustness of the deep learning model against adversarial attacks in the black-box scenario without sample labels. It is mainly divided into two parts: an adversarial sample generation method based on input augmentation variation and misalignment of intermediate features of the model, and a flowchart for calculating the model robustness evaluation index based on the accuracy of the target model and the similarity of adversarial features. Figure 2 and Figure 3 are respectively the flowcharts of the corresponding two sub-processes. Next, the entire robustness evaluation method will be introduced by separately introducing the two sub-processes:

[0043] 1. Adversarial sample generation method based on input augmentation variation and misalignment of intermediate features of the model

[0044] The main purpose of this method is to generate transferable adversarial samples for evaluating the robustness of the model for model security evaluation. Its method architecture diagram is as Figure 2 shown, and the main process is as Figure 3 shown. For image classification tasks, in an unsupervised black-box scenario where the target model is unknown and the classification labels of image samples are unknown, by optimizing the adversarial perturbation, the intermediate features extracted by the model can be maximally separated from the intermediate features extracted by the benign image samples, which can induce the model to misclassify on the adversarial samples. At the same time, since the decision boundaries of different models for the same task are similar and the high-dimensional features on which the decision depends are similar, the adversarial samples generated by the induction method based on feature misalignment have transferability. For the input image samples, block-wise input augmentation is an operation that simulates the block processing of images by the transformer structure model. This operation enables the surrogate model to optimize the common gradient descent direction using multiple samples, and at the same time, the input variation can make the model focus on more robust features, and such adversarial features are more transferable.

[0045] An optional implementation manner of this method includes the following steps:

[0046] (1) Initialize the first-round adversarial sample as the original sample; in this embodiment, the unlabeled original image sample obtained with the same data distribution as the target model is used as the initialized first-round adversarial sample.

[0047] (2) Randomly sample M times within the ζ neighborhood of the current-round adversarial sample to obtain M samples The ζ neighborhood is a hypersphere centered at the adversarial sample x of the current round with a radius of ζ in the sample parameter space. In this embodiment, ζ = 3∈, where ∈ = 16.0 / 255 and M = 5.

[0048] (3) For each sampled sample of size [C, W, H] According to the horizontal and vertical splitting coordinates, it is divided into c×c sub - graphs. In this embodiment, the sample size is [3, 224, 224] and c = 3. The calculation method of the horizontal and vertical splitting coordinates is as follows:

[0049]

[0050] where x axis , y axis represent the set of splitting coordinate points obtained by random sampling. represents sampling from a Gaussian distribution within the range from a to b, and ∪ represents taking the union between sets. W and H are the width and height of the randomly sampled sample.

[0051] According to the split coordinate points, the sub - graph τ i,j is calculated as follows:

[0052] τ i,j = x[:, x axis [i]:x axis [i + 1], y axis [j]:y axis [j + 1]]

[0053] where τ i,j represents the sub - graph corresponding to the i - th horizontal division and the j - th vertical division. x axis [i] represents the i - th number in the set x axis , and y axis [j] represents the j - th number in the set y axis . [:] represents taking a tensor slice according to the coordinate values.

[0054] (4) For each sub - graph τ i,j , apply a vertical rolling shift with a random step size s h , and apply a horizontal rolling shift with a random step size s w . s h and s w are random numbers in the value ranges [0, H] and [0, W] respectively. The calculation method of the shift transformation operation is as follows:

[0055] τ i,j ← roll(τ i,j , s h , H)

[0056] τ i,j ← roll(τi,j , s w , W)

[0057] Among them, roll(.) represents a rolling shift operation, and s h and s w are the vertical rolling shift step size and the horizontal rolling shift step size respectively, dim represents the dimension, and H, W represent the dimensions of the rolling shift.

[0058] (5) For each sub-graph τ i,j , apply a horizontal flipping operation with a probability of κ. In this embodiment, κ = 0.5:

[0059] τ i,j ← rot(τ i,j )

[0060] Among them, rot(.) represents a horizontal flipping operation.

[0061] (6) Repeat steps (4)-(5), traverse the c×c block sub-graphs segmented by each sampling sample, splice and restore all the sub-graphs after the input enhancement changes, and obtain the enhanced adversarial samples corresponding to the sampling samples, denoted as:

[0062]

[0063] (7) Repeat steps 2) to 6), traverse each sampling sample A total of M enhanced adversarial samples are obtained.

[0064] (8) Input the original image sample x into the surrogate model f, and obtain the intermediate layer output features H0 =

[0065] [h1, h2,..., h n . Input the enhanced adversarial sample x m ′ into the surrogate model f, and obtain the intermediate layer output features H m ’ = [h1′, h2′,..., h n ′]. In this embodiment, the intermediate layer of the network takes the outputs of all convolutional network layers in the surrogate model, and the output of each convolutional network layer is defined as the intermediate layer output feature. n represents the number of intermediate layer output features of the surrogate model.

[0066] (9) Perform max-min normalization on the intermediate layer output features H0 and H m ′ layer by layer:

[0067]

[0068] Obtain and

[0069] (10) For each intermediate layer feature, randomly select γ proportion of sub-features to calculate the feature similarity loss. In this embodiment, γ = 0.1:

[0070]

[0071] Among them, is the cosine similarity of the feature, where only the channels with a proportion of γ are randomly selected, and loss m represents the loss of the m-th enhanced adversarial sample. (11) For each enhanced adversarial sample, repeat steps (8)-(10) to obtain the feature similarity loss of each enhanced adversarial sample, and integrate and calculate to obtain the final objective loss:

[0072]

[0073] Among them, ω m is the loss weighting coefficient of the m-th enhanced adversarial sample. In this embodiment, ω k = 1.0; M represents the number of enhanced adversarial samples corresponding to an adversarial sample in the current round.

[0074] (12) Calculate the gradient of the adversarial sample in the current round according to the loss:

[0075]

[0076] Among them, is the gradient operator, and θ is the weight parameter of the surrogate model.

[0077] (13) Calculate the updated gradient of the adversarial sample in the current round according to the momentum method:

[0078]

[0079] Among them, g t-1 is the final adversarial sample gradient after the previous round of iterative update, g0 = 0, and μ is the gradient decay coefficient. In this embodiment, the gradient decay coefficient μ = 1.0.

[0080] (14) Update the adversarial sample:

[0081]

[0082] Among them, is the ∈ neighborhood of the sample x parameter space, 3∈ = ζ, represents the product, x ′ t is the adversarial sample after the previous round of iterative update, and sign(.) is the sign function.

[0083] (15) The updated adversarial samples repeatedly execute the above steps (2) to (14) for T rounds to obtain the final adversarial samples at the end of the iteration. Here, the number of the final adversarial samples is the same as the number of the unlabeled original image samples.

[0084] 2. Calculation method of model robustness evaluation index based on target model accuracy and adversarial feature similarity

[0085] Using the original image sample set and the adversarial sample set generated by the above method can further calculate the model robustness evaluation index, and its main process is as Figure 4 shown. By calculating the classification task accuracy of the adversarial sample set in the target model as the robustness evaluation score of the model Specifically, an optional implementation manner includes the following steps:

[0086] (1) Calculate on the adversarial sample set the model accuracy as:

[0087]

[0088] where f θ (.) represents the target model, respectively represent the original image sample set and the adversarial sample set, is the indicator function (taking 1 when the equality condition is satisfied, otherwise taking 0), represents the number of samples in the set, i represents the i-th sample in the sample set, represents the accuracy;

[0089] (2) Calculate the robustness evaluation score of the model as:

[0090]

[0091] (3) Evaluate the adversarial security robustness of the target model based on the robustness evaluation score specifically including four levels: secure relatively secure at risk at serious risk

[0092] To verify the implementation effect of the present invention, the above measures are implemented on the ImageNet dataset, and experiments are carried out on models based on convolutional neural network (CNN) such as ResNet-50, DenseNet-121, and Inception-v3, and models based on transformer (Transformer) such as ViT-B / 16, ViT-B / 32, and LeViT.

[0093] In a first aspect, the results in Table 1 show the classification accuracy (%) of the target model for 1000 adversarial sample images generated on the surrogate models respectively, with the models ResNet-50 and Inception-v3 based on convolutional architectures as the surrogate models and six models based on two model architectures as the target models. According to the results in Table 1, the adversarial sample generation method proposed in the present invention not only has strong transferability among models with similar network structures, but also can achieve a good attack success rate in the scenario of heterogeneous network structures, causing the target model to misclassify the adversarial samples. This shows that there is still a risk of transferable adversarial sample attacks for neural network models in the black-box scenario, and the security of the models was overestimated in previous experiments.

[0094] Table 1

[0095]

[0096]

[0097] In a second aspect, based on the classification accuracy of the adversarial samples and the feature similarity with the benign samples, the robustness evaluation value of the model can be calculated, and then the robustness level of the target model can be given, as shown in Table 2. According to the results in the table, the robustness of the model is insufficient in all scenarios, which also shows that the method in the present invention can better evaluate the vulnerability of the model in terms of adversarial attacks.

[0098] Table 2

[0099]

[0100] Based on the same inventive concept, in this embodiment, a system for evaluating the robustness of model adversarial attacks without labels in a black-box scenario is further provided. This system is used to implement the above embodiment. Terms such as "module" and "unit" used hereinafter can be a combination of software and / or hardware that can achieve a predetermined function. Although the system described in the following embodiments is preferably implemented in software, implementation in hardware, or a combination of software and hardware is also possible.

[0101] In this embodiment, a system for evaluating the robustness of model adversarial attacks without labels in a black-box scenario includes:

[0102] A preprocessing module, which is used to obtain access to the target model in a black-box scenario and define a surrogate model with the same function as the target model;

[0103] A data acquisition module, which is used to acquire unlabeled raw image samples with the same data distribution as the target model and use them as the initialized adversarial samples;

[0104] The adversarial sample generation module is used to optimize adversarial samples using alternative models and iteratively executes:

[0105] Randomly sample several samples in the neighborhood of the current round of adversarial samples, divide the sampled samples into sub-graphs, apply input enhancement change operations to each sub-graph, and then splice and restore them to obtain a series of enhanced adversarial samples;

[0106] Obtain the intermediate layer output features of the original image sample and its corresponding series of enhanced adversarial samples in the substitution model, calculate the feature similarity loss, optimize and update the current round of adversarial samples, traverse all adversarial samples and iterate multiple times;

[0107] The robustness evaluation module is used to use the original image samples and the final adversarial samples at the end of the iteration to input the target model, and calculate the robustness evaluation score and security level of the target model.

[0108] For the system embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment, and the implementation methods of the remaining modules will not be repeated here. The system embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of the present invention. Ordinary technicians in this field can understand and implement it without paying creative work.

[0109] The embodiments of the system of the present invention can be applied to any device with data processing capabilities, and the device with data processing capabilities can be a device or apparatus such as a computer. The system embodiments can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, the corresponding computer program instructions in the non-volatile memory are read into the memory by the processor of any device with data processing capabilities and run.

[0110] The above examples are only specific embodiments of the present invention. Obviously, the present invention is not limited to the above examples, and many variations are possible. All variations that can be directly derived or associated with the contents disclosed by a person skilled in the art should be considered as the protection scope of the present invention.

Claims

1. A method for evaluating the robustness of a model against attacks without labels in a black box scenario, wherein the model is used in the field of image recognition; characterized in that: include: (1) Obtain access rights to the target model in a black box scenario and define an alternative model with the same functions as the target model; (2) Obtain unlabeled original image samples that are consistent with the target model data distribution and serve as initialization adversarial samples; (3) Use the alternative model to optimize the adversarial sample and iterate: Randomly sample several samples in the neighborhood of the current round of adversarial samples, divide the sampled samples into sub-graphs, apply input enhancement change operations to each sub-graph, and then splice and restore them to obtain a series of enhanced adversarial samples; Obtain the intermediate layer output features of the original image sample and its corresponding series of enhanced adversarial samples in the substitution model, calculate the feature similarity loss, optimize and update the current round of adversarial samples, traverse all adversarial samples and iterate multiple times; (4) Use the original image samples and the final adversarial samples at the end of the iteration to input the target model and calculate the robustness evaluation score and security level of the target model.

2. The method for evaluating the robustness of a model against attacks without labels in a black box scenario according to claim 1 is characterized in that: The alternative model is a model based on convolutional network layers, which uses the output of all or part of the convolutional network layers as intermediate layer output features.

3. The method for evaluating the robustness of a model against attacks without labels in a black box scenario according to claim 1, characterized in that: The step of dividing the sampled samples into sub-graphs comprises: The same number of horizontal and vertical cutting coordinates are randomly generated within the width and height dimensions of the sample. After sorting, the cutting coordinates of the width and height dimensions correspond to each other one by one, and the sub-graphs are divided according to the cutting coordinates.

4. The method for evaluating the robustness of a model against attacks without labels in a black box scenario according to claim 1, characterized in that: The input enhancement change operation includes vertical scrolling shift and horizontal scrolling shift with random steps, and horizontal flipping operation with random probability.

5. The method for evaluating robustness of a model against attacks without labels in a black box scenario according to claim 2, characterized in that: The above-mentioned calculation of feature similarity loss optimizes and updates the current round of adversarial samples, including: Normalize the intermediate layer output features of the original image sample and its corresponding series of enhanced adversarial samples in the substitution model; For each intermediate layer feature, a sub-feature with a ratio of γ is randomly selected in the channel dimension to calculate the feature similarity loss, and the weighted value of the similarity loss of a series of enhanced adversarial samples is used as the total loss; The gradient of the current round of adversarial samples is calculated based on the total loss, and the current round of adversarial samples is optimized and updated to obtain the next round of adversarial samples.

6. The method for evaluating robustness of a model against attacks without labels in a black box scenario according to claim 5, characterized in that: The feature similarity loss is calculated by randomly selecting sub-features of γ proportion in the channel dimension, and the calculation formula is as follows: Among them, loss i represents the loss between the i-th enhanced adversarial sample and the original image sample, n represents the number of intermediate layers of the selected replacement model, They represent the kth intermediate layer output features of the original image sample and the enhanced adversarial sample, respectively, and γ represents the ratio of channel dimension extraction. Represents the output features of the intermediate layer loss, B represents the number of enhanced adversarial samples, C represents the number of channels, and ||.|| represents the norm.

7. The method for evaluating the robustness of a model against attacks without labels in a black box scenario according to claim 1, characterized in that: Traverse all adversarial samples and iterate multiple times to optimize the adversarial samples. Each original image sample corresponds to a final adversarial sample at the end of the iteration.

8. The method for evaluating robustness of a model against attacks without labels in a black box scenario according to claim 1, characterized in that: Step (4) comprises: Input the target model with the original image sample and the adversarial sample, and obtain the model output respectively; Calculate the model accuracy based on the model output: Among them, f θ (.) indicates the target model, Represent the original image sample set and the adversarial sample set respectively, is an indicator function, which takes 1 when the equality condition is met, otherwise it takes 0; represents the number of samples in the set, i represents the i-th sample in the sample set, Indicates accuracy; The model accuracy is used as the robustness evaluation score. The higher the score, the more robust the model is against attacks and the more secure the model is.

9. A model adversarial attack robustness assessment system without labels in a black box scenario, used to implement the method described in claim 1; characterized in that: The system comprises: The preprocessing module is used to obtain access rights to the target model in a black box scenario and define a substitute model with the same functions as the target model; The data acquisition module is used to obtain unlabeled original image samples that are consistent with the target model data distribution and serve as the initialization adversarial samples; The adversarial sample generation module is used to optimize adversarial samples using alternative models and iteratively executes: Randomly sample several samples in the neighborhood of the current round of adversarial samples, divide the sampled samples into sub-graphs, apply input enhancement change operations to each sub-graph, and then splice and restore them to obtain a series of enhanced adversarial samples; Obtain the intermediate layer output features of the original image sample and its corresponding series of enhanced adversarial samples in the substitution model, calculate the feature similarity loss, optimize and update the current round of adversarial samples, traverse all adversarial samples and iterate multiple times; The robustness evaluation module is used to use the original image samples and the final adversarial samples at the end of the iteration to input the target model, and calculate the robustness evaluation score and security level of the target model.

Images