Adversarial example generation methods, target recognition model training methods, and related devices

Abstract

This invention discloses an adversarial example generation method, a target recognition model training method, and related apparatus. The adversarial example generation method includes: acquiring a data sample set containing multiple data samples; inputting the data sample set into a generator in a generative adversarial network (GAN), the generator comprising a network structure of a cascaded encoder and decoder; processing the data samples using the generator to generate one or more noise matrices; and fusing each data sample with its corresponding noise matrix to obtain a first candidate adversarial example set, the first candidate adversarial example set containing one or more first candidate adversarial examples obtained through training on the same data sample. Through the above method, this invention can improve the quality of the obtained adversarial examples.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to an adversarial example generation method, a target recognition model training method, and related apparatus. Background Technology

[0002] Deep learning has matured significantly in the field of computer vision. Visual tasks such as image classification, image segmentation, and object detection all rely on deep learning models. Its excellent performance has promoted the intelligent development of various industries, but its security has also become a key consideration for researchers.

[0003] As neural network models continue to develop, more and more deep learning training frameworks and open-source tools are being developed. Adding tiny perturbations to samples can cause deep learning models to misclassify. Therefore, in order to improve the recognition accuracy of deep learning models, the quality requirements for the adversarial examples used are higher. Summary of the Invention

[0004] The main technical problem solved by this invention is to provide an adversarial example generation method, a target recognition model training method, and related apparatus, which can improve the quality of the obtained adversarial examples.

[0005] To address the aforementioned technical problems, one technical solution adopted by this invention is: providing an adversarial example generation method, which includes: acquiring a data sample set containing multiple data samples; inputting the data sample set into a generator in a generative adversarial network, the generator including a network structure of a cascaded encoder and decoder; processing the data samples using the generator to generate one or more noise matrices; and fusing each data sample with its corresponding noise matrix to obtain a first candidate adversarial example set, the first candidate adversarial example set containing one or more first candidate adversarial examples obtained through training corresponding to the same data sample.

[0006] The encoder's network structure consists of N convolutional layers, each with a 3×3 convolutional kernel. The decoder's network structure consists of N deconvolutional layers, each including (N-1) deconvolutional layers with 3×3 kernels and one deconvolutional layer with a 6×6 kernel, where N is an integer greater than 1. The generator processes each data sample to generate one or more noise matrices, including: encoding the data samples using N convolutional layers; and decoding the encoded data using N deconvolutional layers to generate one or more noise matrices.

[0007] The encoder and decoder are connected by multiple residual network layers. Before decoding the data obtained from the encoding process using the N deconvolution layers, the method further includes: using the residual network layers to perform residual processing on the data obtained from the encoder; and decoding the data obtained from the encoding process using the N deconvolution layers, which includes: using the N deconvolution layers to decode the data obtained from the residual processing.

[0008] The adversarial example generation method further includes: using the loss between the first candidate adversarial example and the corresponding data sample to update the network parameters of the generator until the loss meets the cutoff condition; and using the generator that meets the cutoff condition to process each data sample to generate one or more noise matrices.

[0009] The adversarial example generation method further includes: inputting the data sample set into a fast gradient sign network, and using the fast gradient sign network to process each data sample to obtain a second candidate adversarial example set; the second candidate adversarial example set contains one or more second candidate adversarial examples obtained by training corresponding to the same data sample.

[0010] The process of inputting the data sample set into the Fast Gradient Symbolic Network includes: training the Fast Gradient Symbolic Network with and without targeted attacks, such that when there is a targeted attack, the Fast Gradient Symbolic Network's class identification result for the sample approaches the attack target class, and when there is no targeted attack, the class identification result for the sample deviates from the actual target class. The attack target class is the class of the selected target in the targeted attack, and the actual target class is the correct class of the sample to be identified. The trained Fast Gradient Symbolic Network is then used to process each data sample to generate one or more second candidate adversarial samples.

[0011] The process involves obtaining a candidate adversarial sample set, which contains one or more candidate adversarial samples, including the first candidate adversarial sample from the first candidate adversarial sample set; and using an evaluation model to filter the one or more candidate adversarial samples to obtain a target adversarial sample set, which contains multiple target adversarial samples, with each target adversarial sample corresponding to a data sample.

[0012] The process involves obtaining a candidate adversarial sample set, which contains one or more candidate adversarial samples. The candidate adversarial samples include second candidate adversarial samples from a second candidate adversarial sample set, which is obtained by training the data sample set using a fast gradient symbolic network. Alternatively, the candidate adversarial sample set may include first candidate adversarial samples from a first candidate adversarial sample set and second candidate adversarial samples from a second candidate adversarial sample set. The evaluation model is then used to filter the one or more candidate adversarial samples to obtain a target adversarial sample set, which contains multiple target adversarial samples, each of which corresponds to a data sample.

[0013] The process of using an evaluation model to screen candidate adversarial samples in the candidate adversarial sample set to obtain the target adversarial sample set includes: optimizing and screening the candidate adversarial samples in the candidate adversarial sample set to obtain multiple preferred adversarial sample sets, each of which includes multiple preferred adversarial samples, and each preferred adversarial sample corresponds to a data sample; inputting the multiple preferred adversarial sample sets into at least two evaluation models respectively, and selecting one from the multiple preferred adversarial samples corresponding to the same data sample as the target adversarial sample, wherein the target adversarial sample is the preferred adversarial sample that minimizes the noise and causes the evaluation model to make an error; and combining the multiple target adversarial samples to obtain the target adversarial sample set.

[0014] Among them, the candidate adversarial samples in the candidate adversarial sample set are optimized and screened to obtain multiple preferred adversarial sample sets, including: using a grid search strategy based on hyperparameters to screen the candidate adversarial samples in the first adversarial sample set and the second adversarial sample set to obtain preferred adversarial samples, and then obtaining multiple sets of preferred adversarial sample sets.

[0015] To solve the above-mentioned technical problems, another technical solution adopted by the present invention is: to provide a training method for a target recognition model, the training method for the target recognition model includes: generating candidate adversarial samples using the above-mentioned adversarial sample generation method, generating training samples based on data samples and candidate adversarial samples, and training the target recognition model using the training samples.

[0016] To solve the above-mentioned technical problems, another technical solution adopted by the present invention is to provide a data device, which includes a processor for executing the above-mentioned adversarial example generation method and target recognition model training method.

[0017] To solve the above-mentioned technical problems, another technical solution adopted by the present invention is to provide a computer-readable storage medium for storing instruction / program data, which can be executed to implement the above-mentioned adversarial example generation method and target recognition model training method.

[0018] The beneficial effects of this invention are as follows: Unlike existing technologies, this invention proposes a method for generating adversarial examples for adversarial attacks. In this method, a generator with a network structure including a cascaded encoder and decoder is designed within a generative adversarial network (GAN). This generator processes each data sample to generate a noise matrix, which is then fused into the corresponding data sample to obtain the adversarial example. By selecting a generator with a cascaded encoder and decoder network structure, the generalization ability of the resulting noise matrix is ​​improved, thereby increasing the attack transfer rate of the adversarial example. Furthermore, the noise level of the noise matrix can be controlled to prevent it from becoming excessive, ensuring that the adversarial example retains the semantic information of the source image and improving the image quality of the adversarial example. The adversarial example obtained using this method exhibits high attack transfer rate and image quality, thus improving the model's recognition rate when used together with the data sample to train a target recognition model. Attached Figure Description

[0019] Figure 1 This is a flowchart illustrating an adversarial sample generation method in an embodiment of this application;

[0020] Figure 2 This is a flowchart illustrating another adversarial sample generation method in the embodiments of this application;

[0021] Figure 3 This is a flowchart illustrating the method for generating the first candidate adversarial sample set in the embodiments of this application;

[0022] Figure 4 This is a structural diagram of the generator of the generative adversarial network in the embodiments of this application;

[0023] Figure 5 This is a structural diagram of the residual module of the generator in the embodiment of this application;

[0024] Figure 6 This is a flowchart illustrating another adversarial sample generation method in the embodiments of this application;

[0025] Figure 7 This is a schematic diagram of the algorithm flow of another adversarial sample generation method in the embodiments of this application;

[0026] Figure 8 This is a flowchart illustrating a training method for a target recognition model in an embodiment of this application.

[0027] Figure 9 This is a schematic diagram of the adversarial sample generation device in the embodiments of this application;

[0028] Figure 10 This is a schematic diagram of the structure of the training device for the target recognition model in the embodiments of this application;

[0029] Figure 11 This is a schematic diagram of the structure of the data device in the embodiments of this application;

[0030] Figure 12 This is a schematic diagram of the structure of a computer-readable storage medium in an embodiment of this application. Detailed Implementation

[0031] To make the objectives, technical solutions, and effects of the present invention clearer and more explicit, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0032] This application provides a method for generating adversarial examples. The method is illustrated using image samples as an example, but is not limited to image samples. Adversarial examples are data samples generated by adding small perturbations to images, causing deep learning models to produce misclassification outputs. These changes render the deep learning model ineffective, and are generally imperceptible to the human eye. This application improves generative adversarial networks by designing a cascaded encoder-decoder network structure at the generator end. This generator processes each data sample separately to generate a noise matrix, which is then fused into the corresponding data sample to obtain the adversarial example. By selecting a generator with a cascaded encoder-decoder network structure, the generalization ability of the resulting noise matrix is ​​improved, thereby increasing the attack transfer rate of the adversarial example. Furthermore, the noise in the noise matrix can be controlled to prevent it from becoming excessive, ensuring that the adversarial example retains the semantic information of the source image and improving its image quality. The adversarial examples obtained using this method have high attack transfer rate and image quality, thus improving the model's recognition rate when trained together with the data samples.

[0033] Please see Figure 1 , Figure 1 This is a flowchart illustrating an adversarial example generation method according to an embodiment of this application. It should be noted that if substantially the same result is obtained, this embodiment does not necessarily use it as the basis for the method. Figure 7 The illustrated process sequence is limited. For example... Figure 1 As shown, this embodiment includes:

[0034] S110: Obtain the data sample set.

[0035] Obtain a data sample set from a local or cloud server. The data sample set contains multiple data samples.

[0036] S130: Input the data sample set into the generator in the generative adversarial network.

[0037] Generative Adversarial Networks (GANs) are deep learning models that consist of at least two modules: a generative model and an adversarial model. These two models learn from each other through a game, generating outputs. In this implementation, a data sample set is input into the GAN. Each data sample in the set is processed to produce one or more first-candidate adversarial samples, which are then output as a first-candidate adversarial sample set. Each first-candidate adversarial sample set contains one or more first-candidate adversarial samples trained on the same data sample. The generator comprises a network structure with a cascaded encoder and decoder.

[0038] S150: The generator is used to process each data sample to generate one or more noise matrices.

[0039] The encoder and decoder network structure generates a noise matrix by encoding and decoding data samples. Each data sample may generate one or more noise matrices. These noise matrices are generated using a generative adversarial network (GAN) to interfere with the original data sample set. Applied to the adversarial model, they cause the model to misclassify the sample data, thus engaging in mutual generative adversarial optimization learning. When multiple noise matrices are generated for each data sample, different noise matrices can cause different interferences to the original data sample. This noise matrix, as a small perturbation, when added to the data sample, can generate data samples that can cause the deep learning model to fail and misclassify, but whose image changes are generally imperceptible to the human eye. These generated data samples serve as adversarial examples.

[0040] S170: Fuse each data sample with the corresponding noise matrix to obtain the first candidate adversarial sample set.

[0041] The corresponding noise matrix is ​​superimposed on the data sample to make the data sample a sample with noise perturbation, thus obtaining the first candidate adversarial sample. The first candidate adversarial sample set contains one or more first candidate adversarial samples of the same data sample. A noise matrix is ​​superimposed on a corresponding data sample. When the same data sample generates multiple noise matrices, they are fused with each noise matrix respectively to generate the same number of first candidate adversarial samples as the noise matrices. Each first candidate adversarial sample corresponds to a noise matrix.

[0042] In this embodiment, the present invention proposes an adversarial example generation method for adversarial attacks. The method involves designing a generator within a generative adversarial network (GAN) that includes a cascaded encoder and decoder. This generator processes each data sample to generate a noise matrix, which is then fused into the corresponding data sample to obtain the adversarial example. By selecting a generator with a cascaded encoder and decoder, the generalization ability of the resulting noise matrix is ​​improved, thereby increasing the attack transfer rate of the adversarial example. Furthermore, the noise level of the noise matrix can be controlled to prevent it from becoming excessive, ensuring that the adversarial example retains the semantic information of the source image and improving its image quality. The adversarial example obtained using this method exhibits high attack transfer rate and image quality, thus improving the model's recognition rate when trained using the adversarial example along with the data sample.

[0043] Please see Figure 2 , Figure 2 This is a flowchart illustrating another adversarial example generation method in this application. It should be noted that if substantially the same result is obtained, this embodiment does not necessarily use it. Figure 2 The illustrated process sequence is limited. For example... Figure 2 As shown, this embodiment includes:

[0044] S210: Obtain the data sample set.

[0045] Obtain a data sample set from a local or cloud server. The data sample set contains multiple data samples.

[0046] S230: Input the data sample set into the generative adversarial network for training to obtain the first candidate adversarial sample set.

[0047] S250: Input the data sample set into the Fast Gradient Sign Method network for training to obtain the second candidate adversarial sample set.

[0048] The core of the Fast Gradient Sign Method (FGSM) is to add perturbations along the opposite direction of the gradient, thereby increasing the distance between adversarial examples and the original examples. In this implementation, the data sample set is input into the Fast Gradient Sign Method network, and each data sample in the data sample set is processed to obtain one or more second candidate adversarial examples, which are then output to form a second candidate adversarial example set. Each second candidate adversarial example set contains one or more second candidate adversarial examples obtained by training on the same data sample.

[0049] The order of steps S230 and S250 is not limited. In another embodiment, step S250 may be performed before step S230, or the generative adversarial network training and the fast gradient symbolic network training may be performed simultaneously and in parallel.

[0050] S270: Use the evaluation model to filter the candidate adversarial samples in the candidate adversarial sample set to obtain the target adversarial sample set.

[0051] The candidate adversarial sample set contains one or more candidate adversarial samples. The evaluation model is a model capable of identifying data; the specific evaluation model used is not limited here. The first and second candidate adversarial sample sets are considered as a whole. The candidate adversarial samples are input into the evaluation model, which performs identification. Candidate adversarial samples that the evaluation model fails to identify are selected as target adversarial samples. The target adversarial sample set contains multiple target adversarial samples, and the candidate adversarial sample set includes the first candidate adversarial samples from the first candidate adversarial sample set and / or the second candidate adversarial samples from the second candidate adversarial sample set.

[0052] In this embodiment, the present invention proposes an adversarial sample generation method for adversarial attacks. The adversarial samples are generated by combining generative adversarial networks (GANs) and fast gradient symbolic networks (FRLs). While using GANs to ensure high attack mobility of the generated adversarial samples, FRLs are used to ensure the quality of the generated adversarial samples. The adversarial samples are then screened. This method combines the advantages of GANs and FRLs, enabling the selection of high-quality adversarial samples.

[0053] Generative Adversarial Networks (GANs) consist of a generative model and an adversarial model. The generative model contains a generator, and in this implementation, an encoder-decoder network structure is designed within the generator. See also... Figure 3 , Figure 4 and Figure 5 , Figure 3 This is a flowchart illustrating the method for generating the first candidate adversarial sample set in the embodiments of this application. Figure 4 This is a structural diagram of the generator of the generative adversarial network in the embodiments of this application. Figure 5 This is a structural diagram of the residual module of the generator in the embodiment of this application. It should be noted that if substantially the same result is obtained, this embodiment does not necessarily use it. Figure 3 The illustrated process sequence is limited. For example... Figure 3 As shown, this embodiment includes:

[0054] S310: Use the data sample set to train the generator of the generative adversarial network to perform adversarial generation.

[0055] In this embodiment, an encoder and decoder network structure is designed in the generative model. The encoder network structure consists of N convolutional layers, each with a 3×3 convolutional kernel. The decoder network structure consists of N deconvolutional layers, including (N-1) deconvolutional layers with 3×3 kernels and one deconvolutional layer with a 6×6 kernel. The N convolutional layers are used to encode the data samples. A residual network layer is used to process the residual data obtained from the encoder. The N deconvolutional layers are used to decode the residual data, generating one or more noise matrices. Here, N is an integer greater than 1. In one embodiment, N is 2; in another embodiment, N is 3. Please refer to [link to relevant documentation]. Figure 4 The encoder and decoder network structures consist of three convolutional layers, four residual network layers, and three deconvolutional layers, arranged from front to back. The encoder network structure is composed of three cascaded convolutional layers. The Basicblock is a convolutional layer that takes data samples as input to the first convolutional layer, its output as input to the second convolutional layer, and its output as input to the third convolutional layer. The structure of the three convolutional layers is as follows: Figure 4 As shown on the right, the convolutional layer has a 3×3 convolutional kernel, and the encoder is used to encode the data samples. The residual network layer's structure consists of four convolutional layers. ResNetBlock is the residual network layer. The output of the encoder layer is input into the first residual network layer, the output of the first residual network layer is input into the second residual network layer, the output of the second residual network layer is input into the third residual network layer, and the output of the third residual network layer is input into the fourth residual network layer. The structure of the four residual networks is as follows: Figure 4 As shown, the residual network has two convolutional layers with 3×3 kernels, which perform residual processing on the data obtained from the encoder. The decoder's network structure consists of three deconvolutional layers in series: two with 3×3 kernels and one with a 6×6 kernel. The N-Basic block is the deconvolutional layer, which inputs the output of the residual network layer into the first deconvolutional layer, the output of the first deconvolutional layer into the second deconvolutional layer, and the output of the second deconvolutional layer into the 6×6 kernel deconvolutional layer. The deconvolutional layer with 3×3 kernels is shown below. Figure 4 As shown on the left, the decoder is used to decode the data obtained from the encoding process to obtain the noise matrix.

[0056] S330: Generate a noise matrix using the trained generator.

[0057] S350: Add the noise matrix to the corresponding data sample to obtain the first candidate adversarial sample set.

[0058] A noise matrix is ​​superimposed on the data samples to make them noisy, thus obtaining first candidate adversarial samples. Each first candidate adversarial sample set contains one or more first candidate adversarial samples trained on the same data sample. In this implementation, the noise matrix is ​​optimized using a loss function, specifically the bulldozer distance loss function. The loss between the first candidate adversarial sample and its corresponding data sample is calculated, i.e., the target cost is obtained. The target cost is the cost required to transform the distribution of the data sample into the distribution of the first candidate adversarial sample. Based on the loss, the network parameters of the generator are iteratively updated until the loss meets the cutoff condition. The trained generator is used to process each data sample to generate one or more noise matrices. The formula for the bulldozer distance is shown below:

[0059] L=E x～p [D(x)]-E x～g [D(x)]

[0060] Where L represents the bulldozer distance loss function, p represents the data sample distribution, and g represents the distribution of the first candidate adversarial examples output by the generator. The bulldozer distance is used to stabilize noise generation and noise optimization during training.

[0061] In this embodiment, this application proposes an end-to-end generative adversarial network (GAN), designs an encoder-decoder network structure as the generator of the GAN, and uses bulldozer distance as the loss function of the GAN to increase the stability of the GAN training and the generalization and attack transferability of the generated adversarial samples.

[0062] In the embodiments of this application, a generative adversarial network (GAN) is used to train the data samples, while a fast gradient signified network (SGL) is also used. The existing SGL is optimized by performing both targeted and untargeted attacks on multiple data samples in the data sample set, generating noisy samples. The targeted attack aims to induce the recognition model to identify the noisy sample as the incorrect target category, while the untargeted attack aims to induce the recognition model to identify the noisy sample as the incorrect category, and the category is not unique. Specifically, when performing a targeted attack on the data samples, a pre-defined incorrect target category is used to induce the recognition model to identify the generated noisy sample as the target category during the data sample training process. Conversely, when performing an untargeted attack, no specific target category is set; the recognition model is only required to be induced to identify the generated noisy sample as the incorrect category during the data sample training process. The correct category is the true category of the data sample.

[0063] Using a Fast Gradient Signed Network (FCLN), data samples are subjected to both targeted and untargeted attacks. After multiple iterations, a second adversarial sample is output. The FCLN is trained for both targeted and untargeted attacks, ensuring that in targeted attacks, its class identification of the sample closely approximates the target class, while in untargeted attacks, its class identification deviates significantly from the actual target class. The target class is the class of the selected target in the targeted attack, and the actual target class is the correct class of the sample to be identified. The second candidate adversarial sample set contains one or more second candidate adversarial samples obtained from the same data sample after training. The second adversarial sample set is optimized using a loss function, which is the loss from targeted attacks minus the loss from untargeted attacks. The specific formula is shown below:

[0064] L = y target log(softmax(l(x;θ)))-y true log(softmax(l(x;θ)))

[0065] Where L represents the loss function, l represents the gradient, y represents the class, target represents the target class, and true represents the correct class, i.e., y target log(softmax(l(x;θ))) is used to calculate the targeted attack loss. Iterative training is performed to minimize the targeted attack loss. true log(softmax(l(x;θ))) is used to calculate the loss for untargeted attacks. Iterative training is performed to identify the maximum loss for untargeted attacks, and finally the minimum loss function L is obtained.

[0066] In this embodiment, this application proposes an optimized fast gradient symbolic network algorithm that uses loss functions for both targeted and untargeted attacks. This enhances the attack transferability of the generated adversarial examples, allowing for a high probability of untargeted attacks even when targeted attacks fail. This improved attack transferability of adversarial examples addresses the problem of noise homogenization and enables the generation of adversarial examples with high image quality.

[0067] Please see Figure 6 and Figure 7 , Figure 6 This is a flowchart illustrating another adversarial example generation method in the embodiments of this application. Figure 7 This is a schematic diagram of the algorithm flow for another adversarial example generation method in the embodiments of this application. It should be noted that if substantially the same result is obtained, this embodiment does not necessarily use it as the basis for the method. Figure 6 The illustrated process sequence is limited. For example... Figure 6 As shown, this embodiment includes:

[0068] S610: Obtain the data sample set.

[0069] Obtain a data sample set from a local or cloud server. The data sample set contains multiple data samples.

[0070] S630: Input the data sample set into the generative adversarial network for training to obtain the first candidate adversarial sample set. Input the data sample set into the fast gradient symbolic network for training to obtain the second candidate adversarial sample set.

[0071] S650: Optimize and screen the candidate adversarial samples in the candidate adversarial sample set to obtain multiple preferred adversarial sample sets.

[0072] In one embodiment, the generative adversarial network is trained only on the data sample set, and the candidate adversarial sample set includes one or more candidate adversarial samples from the first candidate adversarial sample set; in another embodiment, the fast gradient sign network is trained only on the data sample set, and the candidate adversarial sample set includes one or more second candidate adversarial samples from the second candidate adversarial sample set; in yet another embodiment, the generative adversarial network and the fast gradient sign network are trained on the data sample set separately, and the candidate adversarial sample set includes first candidate adversarial samples from the first candidate adversarial sample set and second candidate adversarial samples from the second candidate adversarial sample set.

[0073] Based on hyperparameters, a grid search strategy is used to filter first candidate adversarial samples in the first adversarial sample set and second candidate adversarial samples in the second adversarial sample set. The grid search strategy is an exhaustive search method with specified parameter values. The optimal learning algorithm is obtained by optimizing the parameters of the estimated function through cross-validation. The possible values ​​of each parameter are permuted and combined, and all possible combinations are listed to generate a "grid". Then, each combination is used for support vector machine training, and cross-validation is used to evaluate the performance. After trying all parameter combinations for the fitted function, a suitable classifier is returned, automatically adjusted to the optimal parameter combination. In this embodiment, the preferred hyperparameters are used to filter one or more candidate adversarial samples to obtain preferred adversarial samples, and each generated preferred adversarial sample is saved to obtain multiple sets of preferred adversarial samples. In one specific embodiment, 10 sets of preferred adversarial samples are finally obtained, with each set of preferred adversarial samples corresponding to one data sample. The number of samples in each set of preferred adversarial samples is the same as the number of data samples.

[0074] S670: Input multiple preferred adversarial sample sets into at least two evaluation models respectively, and select one as the target adversarial sample from multiple preferred adversarial samples corresponding to the same data sample.

[0075] First, an evaluation model is selected to identify the data samples. At least two evaluation models are used. In this embodiment, the data samples are images, and the evaluation models that can be used include two or more of ResNet152, VGG19, and DenseNet201. The preferred adversarial sample sets are input into at least two evaluation models respectively. From the multiple preferred adversarial samples corresponding to the same data sample in the multiple sets of preferred adversarial samples, one is selected as the target adversarial sample. Multiple target adversarial samples are combined to obtain the target adversarial sample set. In one specific embodiment, the above three evaluation models are used for evaluation and selection. Each preferred adversarial sample in each set of preferred adversarial samples is simultaneously input into the three evaluation models. The three evaluation models evaluate the three preferred adversarial samples corresponding to the same data sample in each set of preferred adversarial samples, selecting the preferred adversarial sample that causes the model to make an error and has the least noise disturbance as the target adversarial sample. After screening, multiple target adversarial samples are combined to obtain the target adversarial sample set. Each target adversarial sample in the target adversarial sample set corresponds to one data sample. The candidate adversarial sample set includes the first candidate adversarial sample of the first candidate adversarial sample set and / or the second candidate adversarial sample of the second candidate adversarial sample set. The target adversarial sample set contains the same number of samples as the data sample set.

[0076] In this embodiment, the present invention proposes an adversarial example generation method for adversarial attacks. This method combines a Generative Adversarial Network (GAN) and a Fast Gradient Signed Algorithm (FGA) network to generate adversarial examples. An end-to-end GAN is proposed, and an encoder-decoder network structure is designed as the generator for the GAN. Bulldozer distance is used as the loss function for the GAN to increase the stability of GAN training and the generalization and attack transferability of the generated adversarial examples. An optimized FGA algorithm is proposed to enhance the attack transferability of adversarial examples and solve the problem of noise homogenization, enabling the generation of adversarial examples with high image quality. Simultaneously, a fusion filtering rule is designed to effectively combine the advantages of both the GAN and FGA algorithms, efficiently generating adversarial examples with strong attack transferability and high image quality.

[0077] Please see Figure 8 , Figure 8 This is a flowchart illustrating a training method for a target recognition model in one embodiment of this application. It should be noted that if substantially the same result is obtained, this embodiment does not necessarily use it. Figure 8 The illustrated process sequence is limited. For example... Figure 8 As shown, this embodiment includes:

[0078] S810: Provides training samples.

[0079] Training samples include data samples and adversarial samples. The data samples are trained using the aforementioned adversarial sample generation method, with noise perturbations added to obtain adversarial samples. The ratio of data samples to adversarial samples is not limited. If the number of adversarial samples generated using the aforementioned adversarial sample generation method is the same as the number of data samples, all data samples and adversarial samples can be used as training samples in a 1:1 ratio, or a subset of adversarial samples and data samples can be selected as training samples.

[0080] S830: Train the target recognition model using training samples.

[0081] The training samples are input into the target recognition model to train the target recognition model so that it can accurately identify the sample type under noise interference.

[0082] In this embodiment, the adversarial example generation method of this application is used to generate adversarial examples with strong attack transferability and high image quality. This improves the robustness and security of the target recognition model trained using these adversarial examples.

[0083] Please see Figure 9 , Figure 9 This is a schematic diagram of the adversarial example generation device according to an embodiment of this application. In this embodiment, the data device includes an acquisition module 91, a training module 92, a generation module 93, and a fusion module 94.

[0084] The device comprises the following components: an acquisition module 91 acquires a data sample set containing multiple data samples; a training module 92 inputs the data sample set into a generator within the generative adversarial network (GAN); a generation module 93 uses the generator to process each data sample to generate one or more noise matrices; and a fusion module 94 fuses each data sample with its corresponding noise matrix to obtain a first candidate adversarial sample set, which contains one or more first candidate adversarial samples trained on the same data sample. This adversarial sample generation apparatus is used to design a generator within the GAN, comprising a network structure of a cascaded encoder and decoder, to obtain a noise matrix. The noise matrix is ​​then fused into a data sample set to obtain adversarial samples. This method can be used to filter out high-quality adversarial samples.

[0085] Please see Figure 10 , Figure 10 This is a schematic diagram of the structure of the training device for the target recognition model in an embodiment of this application. In this embodiment, the data device includes a second acquisition module 101 and a second training module 102.

[0086] The second acquisition module 101 provides training samples, including data samples and adversarial samples. The second training module 102 trains the target recognition model using the training samples. The training device for this target recognition model utilizes the adversarial sample generation method of this application to generate adversarial samples with strong attack transferability and high image quality. This improves the robustness and security of the target recognition model trained using these adversarial samples.

[0087] Please see Figure 11 , Figure 11 This is a schematic diagram of the structure of a data device according to an embodiment of this application. In this embodiment, the data device 11 includes a processor 12.

[0088] Processor 12 can also be referred to as a CPU (Central Processing Unit). Processor 12 may be an integrated circuit chip with signal processing capabilities. Processor 12 can also be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. A general-purpose processor can be a microprocessor, or processor 12 can be any conventional processor.

[0089] The data device 11 may further include a memory (not shown) for storing instructions and data required for the processor 12 to run.

[0090] The processor 12 is used to execute instructions to implement the methods provided by any embodiment and any non-conflicting combination of the adversarial sample generation method and target recognition model training method of this application.

[0091] Please see Figure 12 , Figure 12This is a schematic diagram of the structure of a computer-readable storage medium in an embodiment of this application. The computer-readable storage medium 21 in this embodiment stores instruction / program data 22. When executed, this instruction / program data 22 implements any embodiment of the adversarial example generation method and the target recognition model training method, as well as any non-conflicting combination thereof, provided in this application. The instruction / program data 22 can be formed into a program file and stored in the storage medium 21 in the form of a software product, so that a computer device (which may be a personal computer, server, or network device, etc.) or processor can execute all or part of the steps of the methods in various embodiments of this application. The aforementioned storage medium 21 includes various media capable of storing program code, such as a USB flash drive, portable hard drive, read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk, or terminal devices such as computers, servers, mobile phones, and tablets.

[0092] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, or indirect coupling or communication connection between apparatuses or units, and may be electrical, mechanical, or other forms.

[0093] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0094] The above description is merely an embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent structural or procedural transformations made based on the content of the present invention specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A method for generating adversarial examples, characterized in that, The method includes: Obtain a data sample set, which contains multiple data samples, wherein the data samples are images; The data sample set is input into the generator in the generative adversarial network, which includes a network structure of encoder and decoder connected in series; wherein, bulldozer distance is used as the loss function of the generative adversarial network; The generator is used to process each of the data samples to generate multiple noise matrices; Each data sample is fused with the corresponding noise matrix to obtain a first candidate adversarial sample set, which contains multiple first candidate adversarial samples corresponding to the same data sample. Obtain a candidate adversarial sample set, which contains multiple candidate adversarial samples, including the first candidate adversarial sample from the first candidate adversarial sample set. Based on hyperparameters, a grid search strategy is used to filter candidate adversarial samples to obtain preferred adversarial samples, and then multiple sets of preferred adversarial samples are obtained. Each set of preferred adversarial samples includes multiple preferred adversarial samples, and each preferred adversarial sample corresponds to one data sample. Each of the plurality of preferred adversarial sample sets is input into at least two evaluation models. One of the plurality of preferred adversarial samples corresponding to the same data sample is selected as the target adversarial sample. The target adversarial sample is the preferred adversarial sample that causes the evaluation model to make an error and has the least noise. The target adversarial sample set is obtained by combining multiple target adversarial samples.

2. The adversarial example generation method according to claim 1, characterized in that, The encoder's network structure is encapsulated by N convolutional layers, each convolutional layer having a 3×3 convolutional kernel. The decoder's network structure is encapsulated by N deconvolutional layers, each deconvolutional layer including (N-1) deconvolutional layers with 3×3 convolutional kernels and one deconvolutional layer with a 6×6 convolutional kernel, where N is an integer greater than 1. The step of using the generator to process each data sample to generate multiple noise matrices includes: The data samples are encoded using the N convolutional layers; The data obtained from the encoding process is decoded using the N deconvolution layers to generate the multiple noise matrices.

3. The adversarial example generation method according to claim 2, characterized in that, The encoder and the decoder are connected by multiple residual network layers; Before decoding the encoded data using the N deconvolution layers, the process further includes: The residual network layer is used to perform residual processing on the data obtained from the encoder. The decoding process using the N deconvolution layers to process the encoded data includes: The data obtained from the residual processing is decoded using the N deconvolution layers.

4. The adversarial example generation method according to claim 1, characterized in that, The method further includes: The network parameters of the generator are updated using the loss between the first candidate adversarial sample and the corresponding data sample until the loss meets the cutoff condition. Using the generator whose loss satisfies the cutoff condition, each data sample is processed to generate multiple noise matrices.

5. The adversarial example generation method according to claim 1, characterized in that, The method further includes: Each of the data samples is processed to obtain a second candidate adversarial sample set; the second candidate adversarial sample set contains multiple second candidate adversarial samples corresponding to the same data sample.

6. The adversarial example generation method according to claim 5, characterized in that, Obtain a candidate adversarial sample set, which contains multiple candidate adversarial samples, including a second candidate adversarial sample from the second candidate adversarial sample set, or the candidate adversarial sample set includes a first candidate adversarial sample from the first candidate adversarial sample set and a second candidate adversarial sample from the second candidate adversarial sample set; The multiple candidate adversarial samples are screened using an evaluation model to obtain a target adversarial sample set, which contains multiple target adversarial samples, each of which corresponds to a data sample.

7. A method for training a target recognition model, characterized in that, The method includes: The adversarial sample generation method according to any one of claims 1-6 is used to generate a target adversarial sample; Training samples are generated based on the data samples and the target adversarial samples; The target recognition model is trained using the training samples.

8. A data device, characterized in that, Includes a processor for executing instructions to implement the adversarial example generation method as described in any one of claims 1-6 and the target recognition model training method as described in claim 7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store instruction / program data that can be executed to implement the adversarial example generation method as described in any one of claims 1-6 and the target recognition model training method as described in claim 7.

Images