Semantic adversarial sample generation method based on GAN

Abstract

The present invention relates to a method for generating semantic adversarial samples based on GAN, comprising: S102. Pre-training a WGAN_GP neural network model using a local training set to obtain a generator and a discriminator; S104. Initializing noise data in a low-dimensional submanifold space; S106. Obtaining a generated image adversarial sample through the generator mapping; S108. Using the image adversarial sample to perform an adversarial attack on a target classifier including an attack term and a semantic term; S110. Determining whether the image classification output by the target classifier is the original classification category; if not, outputting a semantic adversarial sample, and if so, increasing the weight parameter of the attack term, and updating the initial value of the noise data, and iteratively repeating steps S106 to S110. The present invention searches for data in a low-dimensional submanifold space and performs semantic constraints in the image space by utilizing the approximation capability of GAN to data distribution, thereby ensuring the naturalness of the adversarial sample and generating an adversarial sample with high attack capability and retaining semantic information.

Description

Technical Field

[0001] The present invention relates to the field of deep learning technology, and in particular to a GAN-based semantic adversarial sample generation method. Background Art

[0002] Deep learning technology has achieved remarkable results in many challenging tasks, but it is very vulnerable to adversarial attacks. Adversarial attacks refer to adding perturbations that are imperceptible to the human eye to the image, causing the deep learning model to output incorrect results. In the process of generating adversarial samples, there are different considerations for constraining the perturbations. Among them, the most intuitive method is to limit the amplitude of the perturbation. However, in this way, if the threshold is set too small, the attack capability of the adversarial sample will be greatly reduced, while if the threshold is set too large, the perturbation will be unreliable, that is, it is difficult for the deep learning model to see such images in the real world.

[0003] In order to solve the above problems, we can seek help from GAN. On the one hand, GAN has made great breakthroughs in image generation and can ensure the naturalness of adversarial samples; on the other hand, converting the search space from image space to low-dimensional submanifold space can improve search efficiency. Combining GAN with traditional attack methods can meet the needs of sample aggressiveness and naturalness. However, existing research lacks consideration of the preservation of sample semantic information. Some are due to the insufficient capabilities of various conditional GANs, and the samples generated under conditional constraints cannot guarantee their semantic information. Others consider constrained samples in low-dimensional submanifold space, and it is difficult to ensure that the true labels of the finally generated adversarial samples are consistent with the original samples.

[0004] In addition, Chinese patent CN111477247A discloses a method for generating speech adversarial samples based on GAN, which studies the generation of speech adversarial samples by directly training GAN. This is completely different from the research direction of generating adversarial samples of images while retaining their semantic information, and no corresponding solution is proposed for the above problem.

[0005] In summary, the research on generating adversarial samples with the help of GAN lacks consideration of the semantic information of the image, and it is difficult to meet the application requirements of deep learning security, that is, adversarial samples need to ensure attack capabilities and be difficult to be detected by humans. Summary of the invention

[0006] The purpose of the present invention is to provide a GAN-based semantic adversarial sample generation method to generate adversarial samples with high attack capability and retain semantic information.

[0007] In order to achieve the above-mentioned object of the invention, the technical solution of the present invention is:

[0008] The present invention provides a method for generating semantic adversarial samples based on GAN, comprising:

[0009] S102. Pre-train the WGAN_GP neural network model using the local training set to obtain a generator and a discriminator;

[0010] S104. Initialize noise data of the low-dimensional submanifold space;

[0011] S106. Obtaining a generated image adversarial sample through the generator mapping;

[0012] S108. Using the image adversarial sample to perform an adversarial attack on a target classifier including an attack term and a semantic term;

[0013] S110. Determine whether the image classification output by the target classifier is the original classification category. If not, output a semantic adversarial sample; if yes, increase the weight parameter of the attack item, and update the initial value of the noise data, and iteratively repeat steps S106 to S110.

[0014] Further, or including:

[0015] S110. Determine whether the image classification output by the target classifier is the original classification category. If not, reduce the weight parameter of the attack item, update the initial value of the noise data, iteratively repeat steps S106 to S110, output the semantic adversarial sample, and perform the following steps; if yes, increase the weight parameter of the attack item, update the initial value of the noise data, and iteratively repeat steps S106 to S110;

[0016] S112. During the iteration process, a semantic adversarial sample is selected that has the smallest semantic loss while classifying the image output by the target classifier as a non-original classification category.

[0017] Furthermore, the loss function of the pre-trained WGAN_GP neural network model in step S102 is:

[0018]

[0019] Among them, g θ represents the generator, d φ represents the discriminator, z represents the random noise data distributed in the low-dimensional submanifold space, represents the low-dimensional submanifold space distribution, x represents the original image sample in the local training set, represents the image spatial distribution, g θ (z) represents the image sample generated by the generator, represents the distribution obtained by uniformly sampling along a straight line between the original image sample and the generated image sample pair, express distributed data, λ represents the weight of the gradient penalty term, Represents the gradient.

[0020] Furthermore, the step S102 includes:

[0021] S202. Randomly initialize the generator and the discriminator;

[0022] S204. Keep the model parameters of the generator unchanged, and cyclically update the model parameters of the discriminator. The objective function of the discriminator is:

[0023]

[0024] S206. Fix the model parameters of the discriminator unchanged, update the model parameters of the generator once, and the objective function of the generator is:

[0025]

[0026] S208. Repeat S204 to S206 to train the generator and the discriminator in an alternating iterative updating manner.

[0027] Furthermore, the step S202 includes: inputting random noise data into the generator and generating corresponding image samples, and then using the image samples and the original image samples as inputs of the discriminator.

[0028] Furthermore, the step S104 traverses the original image samples in the local training set, and obtains the initial value of the low-dimensional sub-manifold spatial noise data by optimizing the loss function, and the loss function is:

[0029] min z ‖g θ (z)-x‖.

[0030] Furthermore, the objective function of the anti-attack in step S108 is:

[0031] L=c*L att +L sem

[0032] Among them, L att represents the attack term, L sem represents a semantic item, and c represents a weight parameter.

[0033] Furthermore, the loss function of the attack term is:

[0034]

[0035] Among them, the parameter k>0 is used to encourage the image generated by the generator to be adversarial to the sample g θ (z) is not classified into the original classification category t with a relatively high confidence, i represents the output classification category, and Z represents the target classifier logical output value without weighted average; the loss function of the semantic item is:

[0036]

[0037] Among them, the image adversarial sample g obtained by mapping the random noise data z θ (z) is quite different from the original image sample x, so g is used in the optimization process θ (z init ) instead of x.

[0038] Furthermore, the initial value of the low-dimensional submanifold space noise data is updated according to the loss function of the attack term and the semantic term.

[0039] Furthermore, the weight parameter is determined and adjusted using a dichotomy method.

[0040] Beneficial effects:

[0041] The GAN-based semantic adversarial sample generation method of the present invention first pre-trains the WGAN_GP neural network model to obtain the trained generator and discriminator. Among them, the generator can map the low-dimensional sub-manifold space data to the image space well. Secondly, the low-dimensional sub-manifold space data is initialized so that the generated image adversarial sample is as similar as possible to the original image sample, retaining accurate semantic information, that is, the semantics, rationality or naturalness of the adversarial sample is first considered. Then the aggressiveness of the adversarial sample is considered, and the image adversarial sample is used to attack the target classifier. The weight parameters of the aggressiveness and semantics are continuously adjusted through the dichotomy, and the initial value of the low-dimensional sub-manifold space data is continuously iterated and updated according to the attack loss and the semantic loss under arbitrary parameters, and finally the adversarial sample with the best semantic information retention under the condition of high attack capability is generated.

[0042] Through the conception of the present invention, the naturalness of adversarial samples is ensured by using the approximation ability of GAN to data distribution, and the attack capability of adversarial samples is ensured by combining the effectiveness of traditional adversarial sample generation methods. At the same time, data is searched in the low-dimensional submanifold space, and semantic constraints are performed in the image space to ensure the naturalness of adversarial samples, so that the generated adversarial samples have high attack capabilities and retain accurate semantic information, and the generated adversarial perturbations are not easily detected. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 A flowchart schematically showing a method for generating semantic adversarial samples based on GAN according to an embodiment of the present invention;

[0044] Figure 2 A schematic diagram showing a principle block diagram of a WGAN_GP neural network model pre-training process in a GAN-based semantic adversarial sample generation method according to an embodiment of the present invention;

[0045] Figure 3 A schematic diagram showing a principle block diagram of performing semantic attacks on a target classification model in a GAN-based semantic adversarial sample generation method according to an embodiment of the present invention;

[0046] Figure 4 A schematic diagram showing the effect of adversarial samples generated by a GAN-based semantic adversarial sample generation method and a z-value constraint attack method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0047] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0048] The present invention will be described in detail below in conjunction with the accompanying drawings and specific embodiments. The embodiments cannot be described one by one here, but the embodiments of the present invention are not therefore limited to the following embodiments.

[0049] The GAN-based semantic adversarial sample generation method provided in this embodiment combines GAN with the traditional adversarial sample generation method. On the one hand, this method uses GAN's ability to approximate sample distribution to ensure the naturalness of adversarial samples; on the other hand, this method uses the effectiveness of traditional adversarial sample generation methods to make adversarial samples have high attack capabilities while retaining accurate semantic information.

[0050] Figure 1 The flowchart schematically shows the method for generating semantic adversarial samples based on GAN according to the present embodiment, which reflects the whole process of generating semantic adversarial samples based on GAN. Figure 1 As shown, after the present embodiment starts to execute the method flow, in step S102, the WGAN_GP neural network model is pre-trained using the data in the local training set to obtain a generator and a discriminator. The function of the generator is to map the low-dimensional submanifold space to the image space, and to generate corresponding image samples according to the input random noise data z. The function of the discriminator is to distinguish the image samples generated by the generator from the original image samples. The loss function of the pre-trained WGAN_GP neural network model is:

[0051]

[0052] Among them, g θ represents the generator, d φ represents the discriminator, z represents the random noise data distributed in the low-dimensional submanifold space, represents the low-dimensional submanifold space distribution, x represents the original image sample in the local training set, represents the image spatial distribution, g θ (z) represents the image sample generated by the generator, represents the distribution obtained by uniformly sampling along a straight line between the original image sample and the generated image sample pair, express distributed data, λ represents the weight of the gradient penalty term, Represents the gradient.

[0053] Here, there are many types of local training sets that can be selected, such as training sets containing different types of picture data such as handwritten numbers, Chinese characters, and animals. In this embodiment, the local training set uses the handwritten number training set MNIST, which contains 10 categories. And the handwritten number training set MNIST is used as the data for training the WGAN_GP neural network model. The generator uses a neural network model with a network structure of two fully connected layers and two deconvolution layers, and the discriminator uses a neural network model with a network structure of two convolution layers and two fully connected layers.

[0054] Figure 2 The schematic diagram shows the principle block diagram of the WGAN_GP neural network model pre-training process in the GAN-based semantic adversarial sample generation method according to an embodiment of the present invention, which mainly reflects the whole process of pre-training the WGAN_GP neural network model in step S102 of the method. Figure 2 As shown, in the process of pre-training the WGAN_GP neural network model, this embodiment alternately updates the generator and the discriminator. The specific process is: first initialize the generator and the discriminator. Given a random noise data z, and input it into the generator, the corresponding image sample is generated. After that, the generated image sample and the original image sample are used as the input of the discriminator, which is used for the discriminator to distinguish and identify true and false image samples. Secondly, keep the model parameters of the generator unchanged, cyclically update the model parameters of the discriminator, and improve the discriminator's ability to judge true and false through training. The objective function of updating the discriminator is:

[0055]

[0056] Next, the model parameters of the discriminator are fixed and the model parameters of the generator are updated once, and the generator's forging ability is improved through training. The objective function of updating the generator is:

[0057]

[0058] Finally, the generator and discriminator are repeatedly trained in the iterative update method described above until a generator that can generate highly aggressive image adversarial samples and a discriminator that has good judgment and ability to identify true and false are finally obtained.

[0059] In steps S104 and S106, this embodiment initializes the noise data z in the low-dimensional submanifold space and sets the initial value z of the noise data to init Input the generator and generate image adversarial samples through mapping. Traverse the original image sample x in the local handwritten digit training set MNIST and optimize the following loss function:

[0060]

[0061] Initialize the noise data z in the low-dimensional submanifold space init , by continuously optimizing the above loss function and continuously updating the initial value z of the noise data init , and save it. The purpose of the initialization operation is to find suitable noise data z so that the image adversarial sample generated by the noise data after being mapped by the generator is as close or consistent as possible with the original image sample, that is, to make the generated image adversarial sample have semantic attributes. In the optimization process, an immediate termination strategy is adopted, that is, after each update for a certain number of times, the decline of the loss function is judged. If the loss function does not decrease or remains basically unchanged, the optimization process is terminated.

[0062] Figure 3 The schematic diagram shows the principle block diagram of the semantic attack on the target classifier in the semantic adversarial sample generation method based on GAN in this embodiment. In step S108, this embodiment obtains the trained generator and the initialized noise data z init Then, the image adversarial sample generated in step S106 is used to perform semantic adversarial attacks on the target classifier. This embodiment uses the Lenet neural network model trained on the local handwritten digit training set MNIST as the target classifier, where the Lenet neural network model includes two convolutional layers and three fully connected layers. The attack includes the attack term L att and the semantic term L sem , and weighted by the weight parameter c, the objective function of the anti-attack is obtained:

[0063] L=c*L att +L sem

[0064] Among them, the attack term L attThe purpose of the attack term L is to mislead the target classifier to make an incorrect judgment, that is, to make the target classifier output not the correct classification category corresponding to the original image sample, but the wrong classification category specified by the attacker. att The loss function is:

[0065]

[0066] Among them, the parameter k>0 is used to encourage the image generated by the generator to be adversarial to the sample g θ (z) is not classified into the original classification category t with a relatively high confidence, i represents the output classification category, and Z represents the target classifier logical output value without weighted average. Semantic term L sem The purpose is to use hard constraints to search for noise data z in the low-dimensional submanifold space so that the image adversarial sample mapped by the generator is close to the original image sample x. sem The loss function is:

[0067]

[0068] Among them, the image adversarial sample g obtained by mapping the random noise data z θ (z) is quite different from the original image sample x, so g is used in the optimization process θ (z init ) instead of x.

[0069] In step S110, it is determined whether the image classification result output by the target classifier in the process of the counterattack in step S108 is the original classification category. If the output image classification result is not the original classification category, that is, the target classifier identifies the image adversarial sample as the wrong classification category and considers the attack successful, then the semantic adversarial sample at this time is output. If the output image classification result is the original classification category, that is, the target classifier identifies the image adversarial sample as the correct classification category and considers the attack failed, then the weight parameter c of the attack item is increased based on the dichotomy method to increase the proportion of the attack item, thereby improving the attack attribute of the adversarial sample, and updating the initial value z of the noise data init , repeat steps S106 to S110 iteratively until the output image adversarial sample attacks the target classifier and is considered to have successfully attacked. After the iterative attack, this embodiment first selects a smaller weight parameter, such as c = 10 -3 , and use the dichotomy method to determine and adjust the above weight parameter c, and confirm the overall iterative attack steps based on the dichotomy method. At the same time, under the condition of any weight parameter after each increase, the initial value z of the noise data in the low-dimensional submanifold space is updated according to the loss function of the attack term and the semantic term of each attack init, the attack attributes and semantic attributes of the adversarial sample are always kept in a balanced state. While having high attack capabilities, the naturalness of the attack can be guaranteed and it is not easy to be noticed.

[0070] Preferably, the present embodiment can further improve the semantic properties of the semantic adversarial sample after the above attack is successful. In step S110, when the image classification result output by the target classifier is not the original classification category, that is, when the attack is successful, the present embodiment can also reduce the weight parameter c of the attack item based on the dichotomy method, reduce the proportion of the attack item, and thus reduce the attack property of the adversarial sample. At the same time, under the condition of any weight parameter after each reduction, the initial value z of the low-dimensional submanifold space noise data is updated according to the loss function of the attack item and the semantic item of each attack init , iteratively repeat steps S106 to S110, so that the adversarial sample can retain better and more accurate semantic information when the attack is successful.

[0071] This implementation method continuously adjusts the weight parameters of the attack term and the semantic term through the dichotomy method, and continuously iteratively updates the initial value of the low-dimensional submanifold space data according to the attack loss and the semantic loss under arbitrary parameters, so that the aggressiveness and semantics of the adversarial sample are optimal and balanced.

[0072] On the basis of executing the preferred step S110, next, in step S112, in the above iterative process, a semantic adversarial sample with the smallest semantic loss while the image output by the target classifier is classified as a non-original classification category is selected. That is, within the overall iteration number of the binary method, the image adversarial sample with the best rationality under the condition of successful attack is selected as the final semantic adversarial sample, and the corresponding low-dimensional sub-manifold space noise data z and the loss function of the semantic item are recorded and saved.

[0073] Figure 4 The schematic diagram shows the effect of the adversarial sample generated by the semantic adversarial sample generation method based on GAN and the z-value constraint attack method in this embodiment. Figure 4 As shown, compared with the adversarial samples generated by the z-value constraint attack method, this embodiment searches for data in the low-dimensional submanifold space and retains semantic information in the image space, which is more capable of generating semantic adversarial samples that are close to or consistent with the original image samples. Figure 4 It can be seen that the semantic adversarial samples generated by this implementation are more likely to cause misleading and can ensure the naturalness of the adversarial and are not easy to be detected.

[0074] The above is only one embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A semantic adversarial sample generation method based on GAN, comprising: S102. Pre-train the WGAN_GP neural network model using the local training set to obtain a generator and a discriminator; S104. Initialize noise data of the low-dimensional submanifold space; S106. Obtaining a generated image adversarial sample through the generator mapping; S108. Using the image adversarial sample to perform an adversarial attack on a target classifier including an attack term and a semantic term; S110. Determine whether the image classification output by the target classifier is the original classification category. If not, output the semantic adversarial sample; if yes, increase the weight parameter of the attack item, update the initial value of the noise data, and iteratively repeat steps S106 to S110; The loss function of the pre-trained WGAN_GP neural network model in step S102 is: Among them, g θ represents the generator, d φ represents the discriminator, z represents the random noise data distributed in the low-dimensional submanifold space, represents the low-dimensional submanifold space distribution, x represents the original image sample in the local training set, represents the image spatial distribution, g θ (z) represents the image sample generated by the generator, represents the distribution obtained by uniformly sampling along a straight line between the original image sample and the generated image sample pair, express distributed data, λ represents the weight of the gradient penalty term, represents the gradient; The step S102 includes: S202. Randomly initialize the generator and the discriminator; S204. Keep the model parameters of the generator unchanged, and cyclically update the model parameters of the discriminator. The objective function of the discriminator is: S206. Fix the model parameters of the discriminator unchanged, update the model parameters of the generator once, and the objective function of the generator is: S208. Repeat S204 to S206 to train the generator and the discriminator in an alternating iterative updating manner; The loss function of the attack term is: Among them, the parameter k>0 is used to encourage the image generated by the generator to be adversarial to the sample g θ (z) is not classified into the original classification category t with a relatively high confidence, i represents the output classification category, and Z represents the target classifier logical output value without weighted average; the loss function of the semantic item is: Among them, the image adversarial sample g obtained by mapping the random noise data Z θ (Z) is quite different from the original image sample x, so g is used in the optimization process θ (Z init ) instead of x.

2. The method for generating semantic adversarial samples based on GAN according to claim 1, characterized in that: or include: S110. Determine whether the image classification output by the target classifier is the original classification category. If not, reduce the weight parameter of the attack item, update the initial value of the noise data, iteratively repeat steps S106 to S110, output the semantic adversarial sample, and perform the following steps; if yes, increase the weight parameter of the attack item, update the initial value of the noise data, and iteratively repeat steps S106 to S110; S112. During the iteration process, a semantic adversarial sample is selected that has the smallest semantic loss while classifying the image output by the target classifier as a non-original classification category.

3. The method for generating semantic adversarial samples based on GAN according to claim 1, characterized in that: The step S202 includes: inputting random noise data into the generator to generate corresponding image samples, and then using the image samples and the original image samples as inputs of the discriminator.

4. The method for generating semantic adversarial samples based on GAN according to claim 1, characterized in that: The step S104 traverses the original image samples in the local training set and obtains the initial value of the low-dimensional sub-manifold spatial noise data by optimizing the loss function, wherein the loss function is:

5. The method for generating semantic adversarial samples based on GAN according to claim 1, characterized in that: The objective function of the anti-attack in step S108 is: L=c*L att +L sem Among them, L att represents the attack term, L sem represents a semantic item, and c represents a weight parameter.

6. The method for generating semantic adversarial samples based on GAN according to claim 1 or 5, characterized in that: The initial value of the low-dimensional submanifold space noise data is updated according to the loss function of the attack term and the semantic term.

7. The method for generating semantic adversarial samples based on GAN according to claim 1 or 2, characterized in that: The weight parameters are determined and adjusted using a dichotomy method.

Images