An improved symbolic optimization adversarial attack method

Abstract

The application discloses an improved symbol optimization attack method, which comprises the steps of initializing a search direction, estimating a target function gradient and updating the search direction, for non-directional attack, randomly sampling N perturbations to obtain an initial search direction; and finding the best search direction by using a backtracking linear search method, in each iteration of the linear search, only one single query is used to determine whether the new search direction is correct, and if the direction is incorrect, a binary search method will not be used to calculate the boundary adversarial sample. The improved symbol optimization attack method reduces a large number of query times, does not randomly walk on the decision boundary, has a guide direction for guidance, has a fast distortion convergence speed of the adversarial sample, and does not need to expose the confidence score of the target model, but only needs the top-1 final decision of the model to be realized, does not need to additionally construct a data set and train a substitute model, and is simple and easy to operate.

Description

Technical Field

[0001] This invention relates to the field of adversarial sample technology, specifically to an improved symbol optimization adversarial attack method. Background Technology

[0002] With the continuous advancement of artificial intelligence technology, the security of deep neural networks is receiving increasing attention. In real-world applications, such as autonomous driving, deep neural networks often require high levels of security and robustness. Numerous studies have shown that deep neural networks are vulnerable to adversarial examples, making adversarial examples a hot topic in AI security research. An adversarial example consists of a tiny perturbation superimposed on the original image. Since this tiny perturbation is imperceptible to the human eye, the classification model will make an incorrect judgment on the sample. The process of generating adversarial examples is called an adversarial attack. Based on whether the attacker can obtain the specific structure and parameter settings of the target model, adversarial attacks are divided into white-box attacks and black-box attacks. A white-box attack means the target model is completely exposed to the attacker, who knows the model's structure and parameter settings; a black-box attack means the attacker has no knowledge of the target model's internal information. Black-box attacks are further divided into two categories: transfer-based black-box attacks and query-based black-box attacks. Transfer-based black-box attacks require the attacker to obtain the target model's training data and train a local alternative model using this data. The attacker then performs a white-box attack on the original image using this alternative model to obtain an adversarial example. Depending on the model's transferability, this adversarial example has a certain probability of also being adversarial on the target model. Query-based black-box attacks involve the attacker utilizing the model's returned information. Depending on the target model's returned information, query-based black-box attacks are further divided into score-based attacks and hard-label-based attacks. Score-based black-box attacks involve the attacker using the target model's output confidence scores to generate adversarial examples; hard-label-based black-box attacks involve the attacker using the target model's top-1 decisions (hard labels) to generate adversarial examples. In real-world scenarios, hard-label black-box attacks are the most practical of these attacks. Among hard-label black-box attacks, the Sign-OPT Attack has received widespread attention due to its superior performance.

[0003] However, we found that the backtracking linear search process of the Sign-OPT Attack consumes a large number of queries. Our invention, instead of using binary search in each round of linear search, directly determines whether the candidate sample along the new search direction falls inside or outside the decision boundary. This determination only requires a single query to obtain the optimal search direction and significantly reduces the overall number of queries. Extensive experiments were conducted on MNIST, CIFAR-10, and ImageNet datasets to verify the feasibility of the proposed solution. Summary of the Invention

[0004] (a) Technical problems to be solved

[0005] To address the shortcomings of existing technologies, this invention provides an improved symbolic optimization adversarial attack method that significantly reduces the number of queries and increases the attack success rate. It possesses advantages such as fast convergence speed and distortion reduction of adversarial examples, and solves the problem of the high operational difficulty associated with constructing additional datasets and training alternative models.

[0006] (II) Technical Solution

[0007] To achieve the above objectives, the present invention provides the following technical solution: an improved symbol optimization adversarial attack method, comprising the following steps:

[0008] S1: Initialize the search direction;

[0009] S2: Estimate the gradient of the objective function;

[0010] S3: Update the search direction.

[0011] Preferably, in S1, for non-targeted attacks, N random samples are taken that obey... The perturbations are identified by calling the model to find the adversarial perturbations.

[0012] Preferably, in S1, the boundary adversarial samples along each adversarial perturbation direction are calculated using a binary search method.

[0013] Preferably, in step S3, a backtracking linear search method is used to find the optimal search direction. In the linear search process of symbolic optimization attack, a binary search method is used in each iteration to calculate the boundary adversarial sample along each search direction.

[0014] Preferably, in step S3, when a candidate sample falls outside the decision boundary, the boundary adversarial sample along the new search direction has less distortion than the past boundary adversarial sample; when a candidate sample falls inside the decision boundary, the boundary adversarial sample along the new search direction has greater distortion than the past boundary adversarial sample.

[0015] Preferably, in S3, the step size of updating the search direction is gradually increased in each iteration until the candidate sample falls within the decision boundary. If the judgment result of a single query is that the candidate sample falls within the decision boundary, the iteration will end.

[0016] (III) Beneficial Effects

[0017] Compared with existing technologies, this invention provides an improved symbol optimization adversarial attack method, which has the following beneficial effects:

[0018] 1. The improved symbolic optimization adversarial attack method does not randomly walk on the decision boundary, but is guided by a direction, and the distortion convergence speed of the adversarial examples is fast.

[0019] 2. This improved symbolic optimization adversarial attack method does not require the target model to expose its confidence score; it only requires the model's top-1 final decision.

[0020] 3. This improved symbolic optimization adversarial attack method does not require building an additional dataset and training an alternative model, making it simple and easy to operate. Attached Figure Description

[0021] Figure 1 This is a flowchart of the symbol optimization adversarial attack method of the present invention;

[0022] Figure 2 This is a visual attack flowchart of the present invention;

[0023] Figure 3 This is a graph showing the gradually increasing step size of the binary search in this invention;

[0024] Figure 4 This is a graph showing the gradually decreasing step size of the binary search in this invention;

[0025] Figure 5 This is the t-th round linear search graph of the present invention;

[0026] Figure 6 This is a graph showing the attack success rate of the present invention.

[0027] Figure 7 This is the average l2 norm distortion diagram of the present invention. Detailed Implementation

[0028] The technical solutions of the present invention will be clearly and completely described below with reference to the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0029] This invention provides an improved method for countering symbol optimization attacks, comprising the following steps:

[0030] S1: Initialize the search direction;

[0031] S2: Estimate the gradient of the objective function;

[0032] S3: Update the search direction.

[0033] Vectors and scalars are represented by bold lowercase letters and italic lowercase letters, respectively. For better illustration, the basic symbols and descriptions used in this scheme are shown in the table below.

[0034]

[0035]

[0036] Given an original image x0, its corresponding ground truth label y0, and a hard-labeled black-box classifier (model) f, this scheme uses the objective function g(θ) proposed in the symbolic attack method regarding the search direction θ, and finds the minimum distortion adversarial sample by solving the following optimization problem:

[0037]

[0038] Therefore, the globally optimal adversarial example can be expressed by the following formula:

[0039]

[0040] in, Representing the minimum perturbation, a visualization of the entire attack process is attached. Figure 2 As shown. This invention uses the gradient descent method to solve the above optimization problem.

[0041] For non-targeted attacks, this invention first randomly samples N numbers that obey... The perturbations are identified by calling the model to find the adversarial perturbations. Next, a binary search method is used to calculate the boundary adversarial samples along each adversarial perturbation direction. By comparison, the boundary adversarial sample with the minimum distortion is found, and its corresponding perturbation is the initial search direction θ0, where g0 = g(θ0).

[0042] In targeted attacks, this scheme randomly selects M images from the target category, and the difference between the original image and the target category image is the adversarial perturbation. Aside from calling the model, the subsequent initialization process is the same as for non-targeted attacks.

[0043] This scheme estimates the gradient of the objective function g0 using the following formula:

[0044]

[0045] Among them, a random sample follows The direction of distribution u k δ is the adjustment factor, sgn(·) is the sign operation, and δu k The aim is to rotate the search direction θ. According to equation 3, if the original image is along the rotated direction θ+δu... k If the distance to the decision boundary is greater than the distance from the original image along direction θ to the decision boundary, then the rotation direction u... k It will be retained; otherwise, the rotation direction u k The directions will be reversed. According to probability theory, the ratio of the retained directions to the reversed directions is approximately 1:1. Ultimately, the summation direction of these k rotations (i.e., the gradient estimate of g(θ)) will always point in the direction that makes g(θ) larger.

[0046] This scheme uses a backtracking linear search method to find the optimal search direction. In the linear search process of the symbolic optimization attack, each iteration uses a binary search method to calculate the boundary adversarial samples along each search direction. That is, in each iteration of the linear search process, the boundary adversarial samples must be calculated using binary search. Then, by comparing the large relationship between the two distortions of the boundary adversarial samples in the current iteration and the previous iteration, the boundary adversarial samples with smaller distortions are saved. We found that the binary search used in each iteration consumes a large number of queries. In fact, it is not always necessary to use binary search to find the boundary adversarial samples in each iteration. We can use a single query to determine whether a candidate sample falls inside or outside the decision boundary, thereby appropriately reducing the use of binary search.

[0047] Scenario 1: The candidate sample falls outside the decision boundary, indicating that the boundary adversarial sample along the new search direction definitely has less distortion than the past boundary adversarial sample. This suggests that the new search direction is useful. In this case, the next steps are the same as in the symbolic optimization attack; this scheme uses binary search to compute the boundary adversarial sample along the new search direction, as shown in the attached diagram. Figure 3 As shown, we gradually increase the step size of the update search direction in each iteration until the candidate sample falls within the decision boundary. Once the judgment result of a single query is that the candidate sample falls within the decision boundary, the iteration will end, and the boundary adversarial sample obtained in the previous iteration will be used as the output of the linear search in the t-th round. This means that in the last iteration, binary search will not be used to find the boundary adversarial sample, thus saving some query times.

[0048] Scenario 2: The candidate sample falls within the decision boundary, indicating that the boundary adversarial sample along the new search direction definitely has greater distortion than the past boundary adversarial sample, suggesting that the new search direction is incorrect. Unlike symbolic optimization, since computing a boundary adversarial sample along the wrong direction is unnecessary, this scheme does not use binary search, as shown in the attached diagram. Figure 4 As shown, this invention gradually reduces the step size of the update search direction in each iteration until the candidate sample falls outside the decision boundary. In each iteration, this scheme completes the judgment using only one query instead of binary search, ultimately saving a significant number of queries. Only in the final iteration is binary search used to calculate the new boundary adversarial sample for the next round of linear search update. The detailed update process of this scheme is shown in the appendix. Figure 5 As shown.

[0049] This method underwent extensive experiments on three datasets: MNIST, CIFAR-10, and ImageNet. The attack results under the l2 norm are shown in the table below. As can be seen from the table, under the same maximum number of queries and distortion threshold (∈), compared to other methods, this invention achieves a higher attack success rate and lower l2 norm distortion. Specifically, for the attack success rate metric, this invention improves the baseline method (Sign-OPT+) by up to 15.38%. Regarding l2 norm distortion, on all datasets, this invention achieves lower distortion compared to other methods. To further verify the effectiveness of this invention, experiments were also conducted under different query counts, and the results are attached. Figure 6 Appendix Figure 7 As shown, this scheme still performs well in terms of attack success rate and distortion metrics compared to the benchmark method (Sign-OPT+). When the distortion is controlled to a small value, the human eye can hardly distinguish adversarial examples. Moreover, compared to the benchmark method, this scheme saves about 15% of the number of queries.

[0050]

[0051] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. An improved symbolic optimization adversarial attack method, characterized in that, Includes the following steps: S1: Initialize the search direction; S2: Estimate the gradient of the objective function; S3: Update search direction; The symbol attack method specifically includes the following steps: Regarding the search direction objective function And by solving the following optimization problem, the minimum distortion adversarial sample is found: ； Therefore, the globally optimal adversarial example can be expressed by the following formula: ； in, Represents the original image; express The true label; This represents a hard-labeled black-box classifier; Indicates the search direction; Indicates the direction of the search. The objective function; This represents the globally best adversarial example; Indicates the minimum perturbation; The gradient descent method is used to solve the optimization problem. For non-targeted attacks, random sampling is first performed. Obedience The perturbation distribution is analyzed, and adversarial perturbations are identified by calling the model. Next, a binary search is used to calculate the boundary adversarial samples along each perturbation direction. When updating the search direction using gradient descent, a single query is used to determine if the current step size is correct, deciding whether to use binary search to update the adversarial samples. The boundary adversarial sample with the smallest distortion is identified through comparison, and its corresponding perturbation is used as the initial search direction. ,and ; In targeted attacks, targets are randomly selected from different categories. The difference between the original image and the image of the target category is the adversarial perturbation; apart from calling the model, the subsequent initialization process is the same as that for non-targeted attacks. The objective function is estimated using the following formula. gradient: Among them, a random sample follows Distribution direction , As a regulating factor, For symbolic operations, Used to rotate the search direction According to the gradient estimation formula above, if the original image is along the rotated direction... The distance to the decision boundary is greater than the distance of the original image along the direction. The distance to the decision boundary, then the direction of rotation. The direction that will be retained will be retained; otherwise, the rotation direction uk will be reversed. According to probability theory, the ratio of retained to reversed directions is approximately 1:

1. Ultimately, this... The direction of summation of the rotations is... The gradient estimator always points to the point that makes The direction of increasing; The optimal search direction is found using a backtracking linear search method. In the linear search process of symbolic optimization attacks, each iteration uses a binary search method to calculate the boundary adversarial samples along each search direction. That is, in each iteration of the linear search process, the boundary adversarial samples must be calculated using the binary search method. Then, by comparing the large relationship between the two distortions of the boundary adversarial samples in the current iteration and the previous iteration, the boundary adversarial samples with smaller distortions will be saved. We found that the binary search used in each iteration consumes a large number of queries. In fact, it is not always necessary to use binary search to find the boundary adversarial samples in each iteration. We can use a single query to determine whether the candidate sample falls inside or outside the decision boundary, thereby appropriately reducing the use of binary search.

2. The improved symbolic optimization adversarial attack method according to claim 1, characterized in that, In S1, for non-targeted attacks, random sampling is performed. Obedience The perturbations are identified by calling the model to find the adversarial perturbations.

3. The improved symbolic optimization adversarial attack method according to claim 1, characterized in that, In S1, the boundary adversarial samples along each adversarial perturbation direction are calculated using a binary search method.

4. The improved symbolic optimization adversarial attack method according to claim 1, characterized in that, In S3, a backtracking linear search method is used to find the optimal search direction. In the linear search process of symbolic optimization attack, a binary search method is used in each iteration to calculate the boundary adversarial sample along each search direction.

5. An improved symbolic optimization adversarial attack method according to claim 1, characterized in that, In step S3, a single query is used to determine which side of the decision boundary a candidate sample falls on to determine whether the current search direction is correct; if it is incorrect, the binary search method is not used to calculate the boundary adversarial sample along this incorrect direction, thus saving the number of queries.

Images