An adversarial sample generation method based on double-path self-supervision and random block mask

Abstract

The application belongs to the technical field of artificial intelligence, and discloses an adversarial sample generation method based on a double-path self-supervised learning and a random block mask strategy. A double-branch self-supervised collaborative optimization mechanism is constructed in the discriminator aspect, two parallel semantic representation paths of rotation prediction and contrast learning are introduced, multi-level feature interaction of self-supervised signals and traditional adversarial discrimination tasks is realized, and the cross-model migration and semantic robustness of adversarial samples are improved. A dynamic random block mask mechanism is introduced in the generator aspect, structured masks are applied, intermediate layer feature gradients are aggregated, the disturbance contribution of the semantic key area is highlighted, and the pertinence and concealment of the attack are enhanced. The application provides a new idea with attack effectiveness and visual concealment for the field of adversarial sample generation and the field of black box migration, and has important application value in many safety-critical fields such as automatic driving visual safety testing and medical image diagnosis system robustness evaluation.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence technology, specifically involving deep neural networks in the field of deep learning, generative adversarial networks in the field of image generation, and semantic analysis in the field of semantic understanding. More specifically, it is a generative adversarial network based on dual-path self-supervision and random block masking, which generates transferable adversarial samples for different pre-trained models and different downstream tasks. Background Technology

[0002] Deep neural networks (DNNs) have demonstrated outstanding performance in computer vision tasks such as image classification, object detection, and semantic segmentation, driving the intelligentization of fields such as autonomous driving, facial recognition, and security monitoring. With the widespread application of DNNs and the deepening of their deployment scenarios, their security issues have received significant attention. Adversarial attacks, in particular, introduce minute perturbations imperceptible to the human eye, causing high-precision models to produce erroneous predictions, thus posing serious security risks in critical tasks. Based on the attacker's prior knowledge of the target model, adversarial attacks are categorized into white-box attacks (where the model structure and parameters are known) and black-box attacks (where interaction occurs only through input and output interfaces). Since models in real-world industrial environments are typically deployed as black-box services, developing efficient black-box attack methods is crucial for evaluating model robustness and advancing defense strategies.

[0003] In recent years, research on black-box attacks has mainly focused on two categories: query-based and transfer-based. The former generates adversarial examples by repeatedly querying the output of the target model to obtain optimization directions similar to gradient information, but its high time and computational costs limit its practicality. In contrast, transfer-based methods utilize the transferability of adversarial examples—adversarial examples generated by the surrogate model can be generalized to black-box models with different architectures—to achieve non-model-specific perturbation generation. A search reveals Chinese patent CN118470510A, which discloses an adversarial transfer attack method for image classification tasks. This method obtains an augmented image by padding and translating the input image, then uses the output of the classification model on the augmented image to add perturbations to the original image to generate adversarial examples. These algorithms typically utilize gradient information to maximize the non-convex loss function of the surrogate model to enhance transferability. However, the generated adversarial examples are prone to overfitting to local optima of the surrogate model, resulting in insufficient cross-model generalization ability. Furthermore, adversarial perturbations are highly sensitive to small input changes (such as lighting adjustments and random scaling), significantly reducing their robustness against defense mechanisms.

[0004] To overcome the limitations of gradient-based methods, GAN-based adversarial attack frameworks exhibit unique advantages. These methods, through adversarial training between the generator and discriminator, can directly learn transferable perturbations from the data distribution without relying on specific gradient information. After training, there is no need for continuous access to the victim model's information, solving the problem of multiple queries to the model in traditional black-box attacks to train optimal adversarial examples. A search reveals Chinese patent CN113178255B, which discloses a GAN-based adversarial attack method for medical image diagnostic models. This method superimposes high-dimensional noise into the generator to generate adversarial examples, while the discriminator employs a PatchGAN structure combining residual blocks, dilated convolution, and channel attention mechanisms to accurately locate perturbation regions. Despite progress in improving the effectiveness of adversarial attacks and strengthening the model's defense capabilities, existing image generative networks still face key challenges: (1) Discriminators are limited by low-level binary classification tasks and have difficulty capturing high-level semantic features, which may lead to discriminator forgetting and pattern collapse; (2) Global noise injection and frequency domain transformation (such as GE-AdvGAN) often ignore the intrinsic characteristics of target samples, resulting in a spatially uniform perturbation distribution and low concealment, which is easily detected or filtered by various defense mechanisms based on feature reconstruction or frequency filtering; (3) The high computational cost and huge resource requirements of GAN constitute the main bottleneck for its large-scale application and urgently need further optimization. Summary of the Invention

[0005] This invention aims to overcome the shortcomings of existing adversarial sample generation methods in terms of black-box mobility, imperceptible perturbation, and generation efficiency, and provides a generative adversarial attack method based on dual-path self-supervision and random block masking.

[0006] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0007] A method for generating adversarial examples based on dual-path self-supervision and random block masks is proposed. First, a dual-branch self-supervised collaborative optimization mechanism is constructed for the discriminator, fusing two parallel semantic representation paths: rotation prediction and contrastive learning. This mechanism interacts with traditional adversarial discrimination tasks at multiple levels to improve cross-model generalization ability and semantic robustness. Then, a dynamic random block mask gradient aggregation mechanism is introduced into the generator. By applying a random structured mask to the initial adversarial examples and aggregating intermediate feature gradients across levels, the perturbation contribution of semantically critical regions is highlighted, thereby enhancing the targeting and visual concealment of the attack. Furthermore, a multi-objective collaborative loss function is designed, jointly constraining adversarial loss, self-supervised consistency loss, and perceptual realism loss to achieve balanced optimization of the generative adversarial network in the high-dimensional feature space. Finally, cross-architecture transfer attack experiments are conducted on several mainstream image classification models and ensemble defense models in a black-box environment to verify the efficiency, strong transferability, and strong evasion capability of the generated examples. The method includes the following steps:

[0008] Step S1: Construct an optimized discriminator architecture integrating dual-path self-supervised learning. Design a dual-path self-supervised learning task that includes rotation classification and contrastive spectrum learning, and train it in conjunction with a sample real / fake discrimination task to enhance the discriminator's cross-model feature generalization ability.

[0009] Step S2: Embed the adversarial diversity learning module. Design an adversarial diversity loss function to promote the diversity of generated samples in the semantic space by reducing the feature similarity between adversarial samples of different data augmentation versions, thus avoiding the homogenization of generation patterns. Step S3: Introduce a random block mask gradient aggregation mechanism in the generator. Apply a random block mask transformation to the original image, keeping the main structure unchanged while introducing regional noise. Then, based on the masked image, extract feature maps in the intermediate layer of the discriminator and aggregate their gradient information.

[0010] Step S4: Guide generator optimization using aggregated gradients. Feed the aggregated gradients obtained in Step 3 back to the generator, guiding it to focus on perturbing semantic regions that significantly influence model decisions, thereby achieving semantically oriented generation that resists noise.

[0011] Step S5: Perform end-to-end collaborative training of the generative adversarial network. Under a unified framework, the generator and discriminator are jointly optimized, and multi-task loss coordination is used to promote the high transferability, strong imperceptibility, and generation efficiency of adversarial examples under black-box settings.

[0012] The more specific steps are as follows:

[0013] Step S1: Introduce a rotation prediction task into the first optimization path to enhance the discriminator's representation learning ability. Specifically, the discriminator shares a feature encoder containing two output heads: one for adversarial discrimination (…). Another one is used for rotation angle prediction ( All images have been rotated. In this design, the rotated ground image is used to supervise the discriminator's rotation prediction task, while the rotated generated image is used to guide the generator in feature alignment. This design allows the discriminator to learn semantically meaningful feature representations without depending on the current generator quality, and the provided feedback signals also help the generator learn more diverse and transferable adversarial perturbations. The discriminator's loss function... The update is as follows:

[0014]

[0015] in, Represents the set of rotation angles Rotation angle of random sampling. Indicates the image Rotation The result obtained after measurement This represents the discriminator's predicted distribution of the sample's rotation angle. In the second path, to avoid the computational overhead of existing contrastive learning methods that rely on large-scale negative sample sets, the discriminator's feature extractor... A spectral pooling layer is introduced to enhance the discriminator's capabilities. This layer transforms the image from the spatial domain to the frequency domain using a Fast Fourier Transform (FFT) and removes all high-frequency components, aiming to preserve the image's structural and high-level semantic information. Simultaneously, the enhancement strategy is redesigned. This reduces color- and texture-sensitive transformations (e.g., grayscale). However, weakening texture-related enhancements is not beneficial for all self-supervised tasks; the optimal combination still depends on the specific downstream task requirements and learning objectives. First, for the same original image... Applying two different random data augmentations yields a positive sample pair. Subsequently, the sample pair is input into a feature extractor with a spectral pooling layer. and through the projection head This results in four output vectors:

[0016] (2)

[0017] (3)

[0018] Maximize the cosine similarity between output vectors by updating only the feature extractor and its coupled MLP predictor. Its objective function is defined as:

[0019] (4)

[0020] in, Indicates the training batch size. This indicates gradient truncation of the eigenvectors. This asymmetric constraint encourages the predictor to... Align to Instead of directly optimizing both, we use a representation space to effectively avoid feature collapse.

[0021] Step S2: To avoid overly compact clustering in the feature space when generating adversarial examples, adversarial examples... Simultaneous application of both weak and strong enhancements. Weak enhancement sample. The discriminator is guided to learn semantically consistent feature representations, causing similar samples to cluster in local regions; while strongly enhanced samples... This allows the feature distribution to cover a wider space, thus preventing local collapse. Subsequently, the weakly and strongly enhanced samples are input into the improved discriminator to obtain the corresponding feature vectors:

[0022] (5)

[0023] Adversarial diversity learning loss is used to minimize the similarity between adversarial sample pairs under different enhancement intensities to force feature dispersion, thereby indirectly driving the generator to produce more diverse perturbations. Its objective function is defined as:

[0024] (6)

[0025] The enhanced contrastive learning framework described above enables the discriminator to learn semantically meaningful and diverse high-level feature representations without relying on negative samples. Overall, when contrastive learning is chosen as the optimization path, the discriminator... It can be represented as: (7)

[0026] in, is a hyperparameter used to balance the discriminator's real / generated discrimination task with the contrastive learning task. To maintain consistency with the overall minimization optimization objective, the contrastive loss originally used for maximization is used in equation (7) as... Introduced in the form of .

[0027] Step S3: First, generate a value similar to the input image. Masks of the same size All elements are initialized to 1. Then, Divided into sizes Regular and non-overlapping image patches. We recommend selecting... This is because smaller block sizes help eliminate redundant model-specific features while preserving the semantic content of the image. Then, using probability... from A portion of image patches are randomly sampled, and the values ​​of these selected patches are replaced with values ​​from a uniform distribution. Random values ​​obtained from sampling are then used. The generated mask is then applied to the input image to obtain an approximation. samples :

[0028] (8)

[0029] in, This represents element-wise multiplication. While preserving the overall spatial structure and texture information, this transformation distorts image details. Therefore, key features that are semantically robust to this transformation and their gradients are preserved, while model-specific features sensitive to this transformation are weakened. Since the importance of a feature is proportional to its contribution to the final decision, evaluating feature importance through gradients is the most direct method. Based on the above considerations, let... This represents the target model in a generative adversarial network. Representing an image In the Feature maps of the layer. Calculate the target model in the mask image. The gradient on. During the... After n random mask iterations, the aggregate gradient is defined as:

[0030] (9)

[0031] in, Indicates the input image The number of random masks applied. Indicates relative to the real label The output loss function, in the denominator express Norms are used to normalize gradients.

[0032] Step S4 reveals significant noise in the original gradient map and feature map, manifested as high-amplitude responses and discrete activations in non-target regions. This may stem from the deep model converging to local optima during training. In contrast, the aggregated gradient map exhibits clear semantic focusing characteristics, supporting the view that transferable features are typically encoded in semantically coherent regions, while model-specific noise is spatially disordered and discrete. By suppressing this noise, the aggregated gradient can extract more robust, cross-model consistent feature importance information, thereby improving the transfer attack performance of adversarial examples. Based on the above analysis, the aggregated gradient is introduced into the adversarial loss, defined as follows:

[0033] (10)

[0034] in, Indicate adversarial examples , Represents the aggregated gradient map In the Weights at each spatial location Indicates the first Under a sub-random mask, the perturbation input The first feature map The activation value corresponds to each spatial location. A larger gradient magnitude indicates that the region is more likely to be a key feature region related to the target class. By suppressing high-magnitude gradients and enhancing low-magnitude gradients, adversarial examples can be guided towards optimization in a more transferable direction.

[0035] Step S5: Jointly optimize the generator and discriminator to construct a collaborative training mechanism for the adversarial example generation framework. To fully verify the effectiveness of this method in attack performance, it is compared with state-of-the-art GE-AdvGAN and ANDA methods; specifically, different methods are used to generate adversarial examples on five normally trained models, including Inception-v3 and ResNet-50, covering... Cross-architecture transfer attack experiments were conducted on three adversarial training enhancement models and a wide range of target models involving various visual Transformer (ViT) structures such as CaiT-S and SwinT to evaluate their transferable attack performance. Simultaneously, defense bypass tests were performed on generated samples using various advanced defense strategies such as High-Level Guided Denoising (HGD) and Neural Representation Purifier (NRP) to quantify their robustness and evasion capabilities. Furthermore, multiple perceptual quality evaluation metrics were introduced to systematically quantify the visual concealment and structural consistency of adversarial perturbations.

[0036] Compared with existing technologies, this discovery has the following beneficial effects:

[0037] 1. This invention breaks through the traditional paradigm of treating the discriminator merely as a passive discrimination unit in GAN training. It explicitly incorporates the discriminator's representation learning ability into the optimization objective and establishes its core feedback role in adversarial training. The introduction of self-supervised auxiliary tasks enables the discriminator to learn stable and semantically consistent feature representations even under weak generation conditions, and provides the generator with more reliable and directionally consistent optimization signals, significantly enhancing model performance.

[0038] 2. When selecting self-supervised learning tasks, this invention does not blindly follow mainstream paradigms but systematically considers their structural compatibility and optimization synergy with the overall generative attack framework. Through extensive comparative experiments, it analyzes the impact of different optimization paths on discriminative representation, generative convergence, and transfer attack performance, providing reproducible and interpretable selection criteria. Both paths can be independently integrated into existing frameworks, providing flexible configurations for different attack scenarios (e.g., efficiency-first or defense-avoidance-first).

[0039] 3. This invention visualizes that features at different levels have significant differences in semantic expression and model generalization. Ultimately, the intermediate layer features are chosen as the attack target, so that the generator can achieve a more reasonable balance between transferability and imperceptibility.

[0040] 4. This invention suppresses model-specific responses with disordered spatial distribution by repeatedly perturbing and accumulating gradient information, while strengthening semantically consistent and cross-model stable feature regions. This design not only improves the robustness of feature importance estimation, but also effectively reduces the generator's search space and improves training efficiency.

[0041] 5. This invention proposes a multi-dimensional evaluation framework to comprehensively measure the performance of adversarial examples. At the model level, the framework covers Visual Transformer (ViT) and various adversarial training models to test their black-box transferability across architectures and defenses; at the perception level, it comprehensively uses PSNR, SSIM, and LPIPS metrics to quantify the imperceptibility of perturbations; and at the same time, it evaluates the generation efficiency through computational cost and time overhead.

[0042] 6. The adversarial examples generated by this invention can achieve transfer attacks across models and datasets, proposing testing requirements for model robustness and defense strategies that are more in line with real-world application scenarios. For example, in the safety evaluation of autonomous driving vision systems, it simulates visual interference that may occur in real road conditions, systematically evaluating the robustness and security of vehicle-mounted recognition models in adversarial environments, providing a basis for model hardening and system verification. In the safety evaluation of medical image-assisted diagnostic systems, the adversarial perturbations generated by this method can induce misjudgments or omissions in AI models while maintaining the clinical diagnostic usability of images, thereby profoundly revealing the potential security risks of models in clinical use and promoting the development and clinical certification of medical AI systems. Attached Figure Description

[0043] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings appearing in the embodiments will be briefly described below. The following drawings are only drawings from the embodiments of the present invention.

[0044] Figure 1 This is a flowchart of a method according to an embodiment of the present invention;

[0045] Figure 2 This is an overall framework diagram of an embodiment of the present invention;

[0046] Figure 3 This is a comparison diagram of adversarial samples and clean samples from an embodiment of the present invention;

[0047] Figure 4 This is a comparison diagram of the aggregated gradient and the original gradient in an embodiment of the present invention. Detailed Implementation

[0048] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0049] like Figure 1-2As shown, a black-box adversarial example generation method based on dual-path self-supervised learning and random block mask gradient aggregation is presented. First, two parallel self-supervised learning tasks (rotation classification vs. contrastive learning) and an adversarial real / fake discrimination task are designed to collaboratively optimize the discriminator, improving cross-model feature generalization and semantic robustness. Then, a random block mask gradient aggregation mechanism is introduced into the adversarial training of the generator, emphasizing the gradient response of semantically relevant regions to enhance the perturbation's specificity and visual concealment. Finally, a multi-objective collaborative loss function is constructed to jointly optimize the generative adversarial network. The efficiency, strong transferability, and strong evasion capability of the generated examples are verified through transfer attack tests on several mainstream classification models and ensemble defense models in a black-box environment. The method includes the following steps:

[0050] Step S1: Construct an optimized discriminator architecture integrating dual-path self-supervised learning. Design a dual-path self-supervised learning task that includes rotation classification and contrastive spectrum learning, and train it in conjunction with a sample real / fake discrimination task to enhance the discriminator's cross-model feature generalization ability;

[0051] Step S2: Embed the adversarial diversity learning module. Design an adversarial diversity loss function to promote the diversity of generated samples in the semantic space by reducing the feature similarity between adversarial samples of different data augmentation versions, thus avoiding the homogenization of generation patterns. Step S3: Introduce a random block mask gradient aggregation mechanism in the generator. Apply a random block mask transformation to the original image, keeping the main structure unchanged while introducing regional noise. Then, based on the masked image, extract feature maps in the intermediate layer of the discriminator and aggregate their gradient information.

[0052] Step S4: Guide generator optimization using aggregated gradients. Feed the aggregated gradients obtained in Step 3 back to the generator, guiding it to focus on perturbing semantic regions that significantly influence model decisions, thereby achieving semantically oriented generation that resists noise.

[0053] Further, in step S5, end-to-end collaborative training of the generative adversarial network is performed. The generator and discriminator are jointly optimized within a unified framework, and multi-task loss coordination promotes high transferability, strong imperceptibility, and generation efficiency of adversarial examples under a black-box setting.

[0054] The more specific steps are as follows:

[0055] In this embodiment, step S1 introduces a rotation prediction task into the first optimized path to enhance the discriminator's representation learning capability. Specifically, the discriminator shares a feature encoder containing two output heads: one for adversarial discrimination (…). Another one is used for rotation angle prediction ( All images have been rotated. In this design, the rotated ground image is used to supervise the discriminator's rotation prediction task, while the rotated generated image is used to guide the generator in feature alignment. This design enables the discriminator to learn semantically meaningful feature representations without depending on the current generator quality, and the provided feedback signals also help the generator learn more diverse, realistic, and transferable adversarial perturbations. The discriminator's loss function... The update is as follows:

[0056]

[0057] in, Represents the set of rotation angles Rotation angle of random sampling. Indicates the image Rotation The result obtained after measurement This represents the discriminator's predicted distribution of the sample's rotation angle. In the second path, contrastive spectrum training is incorporated into discriminator optimization. Specifically, this is first implemented in the discriminator's feature extractor... A spectral pooling layer is introduced to enhance the discriminator's capabilities. This layer transforms the image from the spatial domain to the frequency domain using a Fast Fourier Transform (FFT) and removes all high-frequency components. The aim is to preserve the image's structural and high-level semantic information while eliminating model-specific details. The spectral pooling layer is removed after training. Furthermore, a Multilayer Perceptron Projector (MLP) is introduced to reduce feature dimensionality and apply a non-linear transformation, thereby better aligning with the contrastive learning objective. Simultaneously, the enhancement strategy is redesigned. This reduces transformations that are sensitive to color and texture (e.g., grayscale). First, for the same original image... Applying two different random data augmentations yields a positive sample pair. Subsequently, the sample pair is input into a feature extractor with a spectral pooling layer. and through the projection head This results in four output vectors:

[0058] (2)

[0059] (3)

[0060] Maximize the cosine similarity between output vectors by updating only the feature extractor and its coupled MLP predictor. Its objective function is defined as:

[0061] (4)

[0062] in, Indicates the training batch size. This indicates gradient truncation of the eigenvectors. This asymmetric constraint encourages the predictor to... Align to Instead of directly optimizing both, we use a representation space to effectively avoid feature collapse.

[0063] In this embodiment, step S2, to avoid overly compact clustering in the feature space when generating adversarial examples, [the adversarial examples are then used]. Simultaneous application of both weak and strong enhancements. Weak enhancement sample. The discriminator is guided to learn semantically consistent feature representations, causing similar samples to cluster in local regions; while strongly enhanced samples... This allows the feature distribution to cover a wider space, thus preventing local collapse. Subsequently, the weakly and strongly enhanced samples are input into the improved discriminator to obtain the corresponding feature vectors:

[0064] (5)

[0065] Adversarial diversity learning loss is used to minimize the similarity between adversarial sample pairs under different enhancement intensities to force feature dispersion, thereby indirectly driving the generator to produce more diverse perturbations. Its objective function is defined as:

[0066] (6)

[0067] The enhanced contrastive learning framework described above enables the discriminator to learn semantically meaningful and diverse high-level feature representations without relying on negative samples. Overall, when contrastive learning is chosen as the optimization path, the discriminator... It can be represented as: (7)

[0068] in, is a hyperparameter used to balance the discriminator's real / generated discrimination task with the contrastive learning task. To maintain consistency with the overall minimization optimization objective, the contrastive loss originally used for maximization is used in equation (7) as... Introduced in the form of .

[0069] In the embodiment, step S3, firstly, generates a value similar to the input image. Masks of the same size All elements are initialized to 1. Then, Divided into sizes Regular and non-overlapping image patches. We recommend selecting... This is because smaller block sizes help eliminate redundant model-specific features while preserving the semantic content of the image. Then, using probability... from A portion of image patches are randomly sampled, and the values ​​of these selected patches are replaced with values ​​from a uniform distribution. Random values ​​obtained from sampling are then used. The generated mask is then applied to the input image to obtain an approximation. samples :

[0070] (8)

[0071] in, This represents element-wise multiplication. While preserving the overall spatial structure and texture information, this transformation distorts image details. Therefore, key features that are semantically robust to this transformation and their gradients are preserved, while model-specific features sensitive to this transformation are weakened. Since the importance of a feature is proportional to its contribution to the final decision, evaluating feature importance through gradients is the most direct method. Based on the above considerations, let... This represents the target model in a generative adversarial network. Representing an image In the Feature maps of layers. In this embodiment, the target model is calculated in the mask image. The gradient on. During the... After n random mask iterations, the aggregate gradient is defined as:

[0072] (9)

[0073] in, Indicates the input image The number of random masks applied. Indicates relative to the real label The output loss function, in the denominator express Norms are used to normalize gradients.

[0074] In the embodiment, significant noise exists in step S4, the original gradient map, and the feature map, manifested as high-amplitude responses and discrete activations in non-target regions. This may stem from the deep model converging to local optima during training. In contrast, the aggregated gradient map exhibits clear semantic focusing characteristics, supporting the view that transferable features are typically encoded in semantically coherent regions, while model-specific noise is spatially disordered and discrete. By suppressing this noise, the aggregated gradient can extract more robust, cross-model consistent feature importance information, thereby improving the transfer attack performance of adversarial examples. Based on the above analysis, the aggregated gradient is introduced into the adversarial loss, defined as follows:

[0075] (10)

[0076] in, Indicate adversarial examples , Represents the aggregated gradient map In the Weights at each spatial location Indicates the first Under a sub-random mask, the perturbation input The first feature map The activation value corresponds to each spatial location. A larger gradient magnitude indicates that the region is more likely to be a key feature region related to the target class. By suppressing high-magnitude gradients and enhancing low-magnitude gradients, adversarial examples can be guided towards optimization in a more transferable direction.

[0077] In this embodiment, step S5 involves jointly optimizing the generator and discriminator to construct a collaborative training mechanism for the adversarial example generation framework. To comprehensively verify the effectiveness of this method in attack performance, it is compared with state-of-the-art GE-AdvGAN and ANDA methods. Specifically, adversarial examples are generated using different methods, and cross-architecture transfer attack experiments are conducted on a wide range of target models, including five normally trained models such as Inception-v3 and ResNet-50, covering three adversarial training enhancements, and involving various visual Transformer (ViT) structures such as CaiT-S and SwinT, to evaluate its transferable attack performance. Simultaneously, multiple advanced defense strategies, such as High-Level Guided Denoising (HGD) and Neural Representation Purifier (NRP), are used to test the generated examples for defense bypass capabilities, quantifying their robustness and evasion ability. Furthermore, multiple perceptual quality evaluation metrics are introduced to systematically quantify the visual concealment and structural consistency of adversarial perturbations, and the FPS metric is used to evaluate the adversarial example generation efficiency.

[0078] In a specific embodiment of the present invention, to ensure the stable training of the generative adversarial network and obtain highly transferable adversarial examples, relevant hyperparameters were reasonably set. Specifically, the hyperparameter settings during the discriminator optimization process, and the weight coefficients of the rotation classification... Comparison of training weight coefficients The learning rate is fixed at 1 Update range set to Hyperparameter settings during generator optimization, compared with training weight coefficients. The learning rate is set to Update range set to When IncRes-v2 is used as the source model, the generator's update range and learning rate are set to... and Gradient aggregation hyperparameter settings based on random masks, sampling probability Number of times the mask is used The mask block size is selected alternately in each round. Framework joint optimization of parameter settings and training epochs Disturbance coefficient The above hyperparameter combination has been verified through multiple rounds of experiments to achieve an effective balance between generation efficiency, migration attack capability, and visual concealment. For specific needs of different task scenarios, the relevant parameters can be further optimized and adjusted to achieve even better performance.

[0079] Referring to Table 1, in black-box transfer attack tasks, our proposed method significantly outperforms existing adversarial attack methods in terms of attack success rate across multiple target models. ADA and GE-AdvGAN are typical methods currently employing generative adversarial networks (GANs) for black-box transfer attacks, VMI-FGSM and ANDA are gradient-based white-box attacks, while FIA ​​and NAA further enhance sample quality by integrating feature importance awareness techniques on top of gradient optimization strategies. Specifically, the adversarial examples generated by our method exhibit higher attack success rates on both defense enhancement models and Visual Transformer (ViT), fully demonstrating its stronger model generalization and transfer capabilities.

[0080] Table 1

[0081]

[0082] Referring to Table 2, in the perturbation concealment experiment, this embodiment of the invention first introduces two quantitative indicators: Spatial Perturbation Range (SPR) and Average Perturbation Intensity (APR), used to evaluate the spatial range and overall perturbation intensity of the perturbation, respectively. Experimental data shows that this method achieves significantly lower optimal values ​​than existing comparative methods in both indicators, proving that the generated perturbation has higher spatial concentration and lower global significance, thus demonstrating outstanding performance in terms of visual imperceptibility. At the image quality level, PSNR and SSIM are used for comprehensive evaluation. PSNR reflects pixel-level error; a value higher than 30dB indicates that the reconstructed image is nearly lossless in terms of signal fidelity compared to the original image. SSIM measures perceptual similarity from three dimensions: brightness, contrast, and structure; a score close to 1 further confirms the high consistency between the generated result and the original content at the visual structure level. These two indicators together verify that this method can effectively maintain excellent visual quality and concealment characteristics while achieving a strong attack effect.

[0083] Table 2

[0084]

[0085] See Figure 3 This invention proposes an adversarial example generation method based on dual-path self-supervision and random block masking. In a specific embodiment, adversarial examples generated by this method and other comparative methods are compared with clean examples. From an image perspective, the adversarial examples generated by this method are almost indistinguishable from the original examples in terms of visual effect, preserving the structural information and texture details of the original image well, and the perturbation is difficult for the human eye to perceive. In contrast, other methods introduce obvious visual artifacts or global noise to varying degrees. This fully demonstrates that the method of this invention can mislead and attack the target model while ensuring the imperceptibility of adversarial perturbations, reflecting its effectiveness in black-box transfer attacks.

[0086] See Figure 4 This invention proposes an adversarial example generation method based on dual-path self-supervision and random block masking, demonstrating a comparison of feature maps and gradients before and after aggregation. Both the original gradient and feature maps exhibit significant noise interference, manifested as high-intensity responses and scattered activation distributions in non-target regions. In contrast, the aggregated gradient map exhibits clear semantic focusing characteristics, indicating that transferable features are typically encoded in semantically coherent regions, while model-specific noise is spatially disordered. Aggregated gradients provide a more reliable optimization signal for the generator, helping to promote a dynamic balance between the generator and discriminator, and improving the overall framework's training stability and convergence efficiency.

[0087] In summary, this invention generates adversarial examples capable of transferable attacks based on dual-path self-supervised learning and a random block mask strategy. A dual-branch self-supervised collaborative optimization mechanism is constructed during discriminator training, fusing two parallel semantic analysis paths: rotation prediction and contrastive learning. This mechanism interacts with traditional adversarial discriminant tasks at multiple levels to enhance cross-model generalization ability and semantic robustness. A dynamic random block mask gradient aggregation mechanism is introduced into the generator. By applying random structured masks and aggregating intermediate layer feature gradients, the perturbation contribution of semantically critical regions is highlighted, thereby enhancing the targeting and visual concealment of the attack. Finally, balanced optimization of the image generative adversarial network in the high-dimensional feature space is achieved. This invention provides a new approach that combines attack effectiveness and visual concealment for the fields of adversarial example generation and black-box transfer, and has significant application value in several security-critical areas such as autonomous driving visual safety testing, robustness evaluation of medical image diagnostic systems, and anti-spoofing verification for facial recognition. It provides effective technical means for attack and defense testing and security enhancement of related systems.

[0088] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Any simple modifications, equivalent changes, and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. An adversarial example generation method based on dual-path self-supervision and random block masking, using GAN as the basic framework, is designed to meet the application needs of AI model security testing and real-world black-box adversarial attacks, characterized by: First, a dual-branch self-supervised collaborative optimization mechanism is constructed for the discriminator, integrating two parallel semantic representation paths: rotation prediction and contrastive learning. This mechanism interacts with traditional adversarial discrimination tasks at multiple levels to enhance cross-model generalization ability and semantic robustness. Next, a dynamic random block mask gradient aggregation mechanism is introduced into the generator. By applying a random structured mask to the initial adversarial samples and aggregating intermediate feature gradients across levels, the perturbation contribution of semantically critical regions is highlighted, enhancing the targeting and visual concealment of attacks. Furthermore, a multi-objective collaborative loss function is designed, combining constrained adversarial loss, self-supervised consistency loss, and perceptual realism loss to achieve balanced optimization of GAN in high-dimensional feature space. Finally, cross-architecture transfer attack experiments are conducted on multiple image classification models and ensemble defense models in a black-box environment to verify the efficiency, strong transferability, and strong evasion capability of the generated samples. The specific steps include the following: S1. Construct an optimized discriminator architecture integrating dual-path self-supervised learning: Design a dual-path self-supervised learning task that includes rotation classification and contrast spectrum learning, and train it in conjunction with the sample real / fake discrimination task to enhance the discriminator's cross-model feature generalization ability. S2. Embedded Adversarial Diversity Learning Module: Design an adversarial diversity loss function to promote the diversity of generated samples in the semantic space by reducing the feature similarity between adversarial samples of different data augmentation versions, and avoid the generation pattern becoming monotonous. S3. Introduce a random block mask gradient aggregation mechanism in the generator: Apply a random block mask transformation to the original image, keeping the main structure unchanged while introducing regional noise. Then, based on the masked image, extract feature maps in the intermediate layer of the discriminator and aggregate their gradient information. S4. Use aggregated gradients to guide generator optimization: Feed the aggregated gradients obtained in step S3 back to the generator to guide it to focus on perturbing semantic regions that have a significant impact on model decisions, thereby achieving semantically oriented generation that is adversarial to noise. S5. Perform end-to-end collaborative training of generative adversarial networks: jointly optimize the generator and discriminator under a unified framework, and promote the high transferability, strong imperceptibility and generation efficiency of adversarial examples under black-box settings through multi-task loss collaboration.

2. The adversarial example generation method based on dual-path self-supervision and random block masking as described in claim 1, characterized in that: Step S1 specifically involves introducing a rotation prediction task into the first optimization path to enhance the discriminator's representation learning ability. The discriminator shares a feature encoder, which includes adversarial discrimination (...). ) and rotation angle prediction ( Output head, all images are rotated The rotated ground image is used to supervise the discriminator's rotation prediction task, while the rotated generated image is used to guide the generator in feature alignment; the discriminator's loss function... The update is as follows: in, Represents the set of rotation angles Rotation angle of random sampling in the middle; Indicates the image Rotation The result obtained after measurement This represents the discriminator's predicted distribution of the rotation angle of the sample. In the second optimization path, the same original image is first processed. Applying two different random data augmentations yields a positive sample pair. Subsequently, the sample pair is input into a feature extractor with a spectral pooling layer. and through the projection head This results in four output vectors: （2） （3） Maximize the cosine similarity between output vectors by updating only the feature extractor and its coupled MLP predictor. Its objective function is defined as: （4） in, Indicates the training batch size. This indicates gradient truncation of the eigenvectors; this asymmetric constraint encourages the predictor to... Align to Instead of directly optimizing both, we use a representation space that effectively avoids feature collapse.

3. The adversarial example generation method based on dual-path self-supervision and random block masking as described in claim 2, characterized in that: Specifically, step S2 involves, to avoid overly compact clustering in the feature space of generated adversarial examples, directing the adversarial examples towards... Apply both weak and strong enhancements simultaneously; Weakly enhanced samples The discriminator is guided to learn semantically consistent feature representations, while strongly enhanced samples... This results in a feature distribution that covers a wider space; subsequently, the strong and weak enhanced samples are input into the discriminator to obtain the corresponding feature vectors: （5） The adversarial diversity learning loss is designed to minimize the similarity between adversarial sample pairs under different enhancement intensities to force feature dispersion, thereby indirectly driving the generator to produce more diverse perturbations. Its objective function is defined as: （6） Overall, when contrastive learning is chosen as the optimization path, the discriminator... It can be represented as: （7） in, The hyperparameters used to balance the discriminator's real / generative discrimination task and the contrastive learning task; to maintain consistency with the overall minimization optimization objective, the contrastive loss originally used for maximization is used in Equation (7) as Introduced in the form of .

4. The adversarial example generation method based on dual-path self-supervision and random block masking as described in claim 3, characterized in that: Specifically, step S3 involves generating a representation of the input image. Masks of the same size All elements are initialized to 1; subsequently, Divided into sizes Regular and non-overlapping image patches, with probability from A portion of image patches are randomly sampled, and the values ​​of these selected patches are replaced with values ​​from a uniform distribution. Random values ​​obtained from sampling are used; finally, the generated mask is applied to the input image to obtain an approximation. samples : （8） Based on the above considerations, let This represents the target model in a generative adversarial network. Representing an image In the Feature map of the layer; Calculate the target model in the mask image The gradient on; in the process After n random mask iterations, the aggregated gradient is defined as: （9） in, Indicates the input image The number of random masks applied. Indicates relative to the real label The output loss function, in the denominator express Norms are used to normalize gradients.

5. The adversarial example generation method based on dual-path self-supervision and random block masking as described in claim 4, characterized in that: Specifically, step S4 involves the aggregated gradient map exhibiting clear semantic focusing characteristics. This phenomenon supports the view that transferable features are typically encoded in semantically coherent regions, while model-specific noise is spatially disordered and discrete. Based on the above analysis, the masked image is input into the source model to obtain the aggregated gradient of the intermediate feature map, which constitutes the adversarial training loss of the generator, defined as follows: （10） in, Indicate adversarial examples , Represents aggregate gradient map In the Weights at each spatial location Indicates the first Under a sub-random mask, the perturbation input The first feature map The activation value corresponding to each spatial location.

6. The adversarial example generation method based on dual-path self-supervision and random block masking as described in claim 5, characterized in that: In step S5, to fully verify the effectiveness and advancement of this method, it is compared with existing methods such as GE-AdvGAN and ANDA. A multi-dimensional evaluation matrix is ​​formed, and the generated adversarial samples are systematically tested for migration attacks using various target models and defense strategies to verify its strong cross-model transferability and high attack success rate. At the same time, quantitative indicators such as SSIM, PSNR and perceptual loss are used to comprehensively evaluate the visual concealment and image realism of the adversarial perturbation. Finally, the overall generation efficiency is evaluated in combination with the generation time cost.

Images