A General Adversarial Perturbation Generation Method Based on Relevance Class Activation Mapping

Abstract

The present invention discloses a general adversarial perturbation generation method based on correlation-based class activation mapping, belonging to the field of adversarial machine learning. At present, the key technical problems in this field are the enhancement of the decision interpretability of deep neural networks and the transferability of adversarial samples. The present invention generates and optimizes general adversarial perturbations by cascading inter-layer correlation propagation and class activation mapping, so as to understand the focus of deep neural networks. First, the deep neural network classifier is used to calculate the original label class of the clean sample and other incorrect label classes. Then, through the linear weight combination of the class activation mapping feature map and the correlation coefficient in the forward propagation, the contribution of the final heat map of the original label is minimized, and the contribution of the heat map of other incorrect classes is maximized. Then, the general adversarial perturbation is iteratively updated by minimizing the correlation-based class activation mapping loss function, so as to form a general adversarial perturbation with strong transferability and improve the attack success rate of adversarial samples.

Description

Technical Field

[0001] The present invention relates to a method for generating general adversarial perturbations based on correlation class activation mapping, belonging to the field of adversarial machine learning. Background Art

[0002] Machine learning technology has made significant breakthroughs in solving complex tasks. However, machine learning technology (especially artificial neural networks and data-driven artificial intelligence) is extremely vulnerable to adversarial sample attacks during training or testing, and these samples can easily subvert the original output of machine learning models. Since the AlexNet model achieved a breakthrough in the Large Scale Visual Recognition Challenge (ILSVRC), various image classification neural networks have been proposed to improve image classification technology. Deep neural networks have shown amazing high performance in solving complex computer vision problems, including image recognition, object detection, semantic segmentation, and face recognition, etc. Solutions derived from computer vision problems play a crucial role in all related fields, such as security, agriculture, industry, etc. However, adversarial samples can easily overthrow the original output of machine learning technology and make the trained model give wrong classification results with a high confidence. Therefore, it is crucial for us to understand the generation of adversarial samples, which can not only help us understand the robustness of different models but also analyze the deficiencies of training algorithms.

[0003] Currently, adversarial samples can be roughly divided into white-box attacks and black-box attacks according to the knowledge required for adversarial attacks: White-box attacks are defined as allowing attackers to control the input of the model and understand each layer of the model by modifying input data, network structure, training parameters, activation functions, etc. Black-box attacks do not understand the internal details of the model, and attackers can only control the input of the model. In the white-box environment, iterative attacks have a higher success rate than single-step attacks, but in most cases, their transferability is not ideal because they are sensitive to network parameters. In addition, it is difficult for attackers to obtain the exact knowledge of the victim model, making it difficult to use white-box attacks in practice.

[0004] The general adversarial attack generates general adversarial sample perturbations for the dataset. Adding this perturbation to any input in the dataset can cause the output result of the neural network model to be incorrect. Aiming at the disadvantages of poor generalization ability and long attack time of most adversarial attacks, the general adversarial attack omits the training process in the adversarial sample generation stage and can directly obtain samples to attack the deep learning model, reducing the attack time of adversarial samples. On the other hand, the interpretability of neural networks is also a hot topic. The class activation mapping (CAM) obtains the feature map through the visualization of the neural network model, and the layer-wise relevance propagation (LRP) obtains the contribution of each pixel point through the reverse gradient propagation, and then obtains the focus of the neural network model. Therefore, studying how to attack the focus of the neural network and generate general perturbations has important practical significance for understanding the neural network model and machine learning algorithms. Summary of the Invention

[0005] (1) Technical Problems to be Solved

[0006] In order to make the generated adversarial samples more difficult to distinguish from clean samples visually and understand the deep semantic features of the neural network, the present invention proposes a method for generating general adversarial perturbations based on relevance class activation mapping. The generated adversarial samples are not only more difficult to detect in terms of noise but also still have the ability to effectively attack the deep neural network. The method of the present invention is universal, that is, it can be combined with any existing method for generating adversarial samples to enhance the concealment of the adversarial sample attack.

[0007] (2) Technical Solutions

[0008] In order to solve the above technical problems, the technical solution adopted by the present invention is: a method for generating general adversarial perturbations based on relevance class activation mapping, which is characterized by including the following steps:

[0009] Step 1: Load data and preprocess the ImageNet_validation dataset;

[0010] Step 2: The target machine learning model uses VGG19, and its network structure and parameters are fixed and include the last three fully connected layers;

[0011] Step 3: To accelerate the training speed, set training parameters, etc.;

[0012] Step 4: Use the dataset obtained in Step 1 to train VGG19, and update the model parameters to obtain the training weights and biases;

[0013] Step 5: Generate general adversarial perturbations based on relevance class activation mapping, which includes the following sub-steps:

[0014] Step 1: Initialize the universal adversarial perturbation v, and generate the universal perturbation using the trained VGG19 convolutional neural network;

[0015] Step 2: Data preprocessing, randomly sample images from ImageNet_validation, crop the universal adversarial perturbation and the dataset to an appropriate size, overlay them, and perform preprocessing to obtain the adversarial samples as the input to the neural network;

[0016] Step 3: Input the image sample x into the set convolutional neural network, extract the activation mapping feature maps for the outputs of each channel of the last convolutional layer to obtain the activation mapping graph

[0017] Step 4: Activation mapping graph Through the forward propagation of the pre-trained model network, obtain the distribution output y of the fully connected layer. Use the reverse hierarchical relevance propagation of the output of the fully connected layer to obtain the activation mapping feature map of the i-th layer of the neural network for the target class c with respect to a certain channel k of the last convolutional layer of the correlation coefficient

[0018] Step 5: Global pooling, use the global pooling operation to reduce the dimension of the correlation propagation coefficients of each channel to obtain the weight coefficients of the activation mapping graph

[0019] Step 6: Extract the correlation-based class activation mapping graph, linearly combine the weight coefficients of the activation mapping graph with the activation mapping graphs A1 to A n to form the correlation-based class activation mapping function Use the l p norm metric and the inter-layer correlation interpreter to construct the loss function;

[0020] Step 7: Optimize the universal perturbation v, pass the image sample x through the target machine learning model f, calculate the target classification c ori and the misclassification c adv , through make the output of the machine learning model close to the misclassification, and use the momentum iteration method during gradient update. Iteratively update the universal perturbation v until f(x + v) is not equal to f(x). When the number of iterations is greater than or equal to the number of sample images or the optimization goal converges, finally obtain the universal adversarial perturbation v based on the correlation-based class activation mapping out .

[0021] Due to the above technical solutions adopted by the present invention, it has the following beneficial effects:

[0022] (1) The present invention provides a general adversarial perturbation generation method based on correlation class activation mapping. Given a target model and a dataset, when applied to any input, it can generate adversarial sample images with scale invariance, strong generalization ability, and high adversarial strength based on class activation mapping and inter-layer correlation propagation.

[0023] (2) The present invention provides a general adversarial perturbation generation method based on correlation class activation mapping. It can combine the feature map of class activation mapping and the correlation coefficient of inter-layer correlation to obtain a function, and by increasing the probability heat map of the wrong class and decreasing that of the correct class, the target neural network can be made to make incorrect decisions.

[0024] (3) Compared with traditional adversarial sample generation methods, the adversarial samples generated by the general adversarial perturbations of the present invention have lower peak signal-to-noise ratio, structural similarity, and attack success rate.

[0025] The above description is only an overview of the technical solution of the present invention. In order to be able to understand the technical means of the present invention more clearly, it can be implemented according to the content of the specification. And in order to make the above and other purposes, features, and advantages of the present invention more obvious and understandable, the specific embodiments of the present invention are specifically given below. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 It is the flow chart of the general adversarial perturbation generation method based on correlation class activation mapping of the present invention;

[0027] Figure 2 It is the attack flow chart of the adversarial sample of the present invention;

[0028] Figure 3 It is a schematic diagram of the inter-layer correlation propagation map of the present invention; DETAILED DESCRIPTION OF THE EMBODIMENTS

[0029] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0030] The object of the present invention is to provide a method for generating adversarial samples based on correlation class activation mapping general perturbation. By separately obtaining the class activation mapping graph of the sample image and the weight of the attention during backpropagation of the image, a loss function is formed according to a linear combination to optimize the perturbed image, obtaining the optimal general perturbation, and then linearly superimposing the optimal general perturbation on the sample image to obtain the final adversarial sample, thereby improving the generation efficiency of the adversarial sample and the attack success rate of the perturbation, and converting normal training samples into adversarial samples without affecting the visual effect, improving the anti-interference ability and robustness of the model.

[0031] In order to make the above objects, features, and advantages of the present invention more obvious and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0032] The overall process of the method of the present invention is as Figure 1 shown, including the following steps:

[0033] Step 1: Load data and preprocess the ImageNet_validation dataset;

[0034] Specifically, the method for preprocessing the original dataset refers to dividing the training set and the test set and setting labels for the dataset.

[0035] The method for dividing the dataset is to divide 80% of the dataset into the training set and the remaining 20% into the test set.

[0036] The method for setting labels for the dataset is to read 1000 category label files of ImageNet.

[0037] Step 2: The target machine learning model uses VGG19, whose network structure and parameters are fixed and include the last three fully connected layers;

[0038] The VGG19 convolutional neural network built in Step 2 includes 5 blocks, the pooling layer size of each block is 2×2, and the maximum pooling method is used.

[0039] Furthermore, block1 and block2 have two convolutional layers and one maximum pooling layer.

[0040] Furthermore, block3, block4, and block5 have four convolutional layers and one maximum pooling layer.

[0041] Further, build a VGG19 convolutional neural network with an input image size of 224×224×3, a receptive field of 3×3, a convolution stride of 1, a padding of 1, a pooling layer size of 2×2, three fully connected layers with 4096 neurons in each layer, using the ReLU activation function, and a Softmax classification layer with 1000 neurons in the last layer.

[0042] Step 3: To accelerate the training speed, set the training parameters: set batch_size to 32; to improve the accuracy, add batch_normalize;

[0043] Further, in the general adversarial perturbation generation method based on correlation-based class activation mapping, the SGD optimizer is used during the training process, and the parameters are set as: momentum = 0.9, decay = 0.001, and the initial learning rate is set to 0.01.

[0044] Step 4: Use the dataset obtained in Step 1 to train VGG19, and update the model parameters to obtain the training weights and biases;

[0045] Step 5: Generate general adversarial perturbations based on correlation-based class activation mapping, which includes the following sub-steps:

[0046] Step 1: Initialize the algorithm parameters, obtain the training sample set, and initial perturbation data:

[0047] Initializing the general adversarial perturbation v to 0 means generating an initial perturbation image with the same dimension as the output image size. Initialize the algorithm parameters, including the learning rate, the number of iterations, etc., and use the convolutional neural network f to generate the general perturbation, where the convolutional neural network is the model obtained after training; preferably, randomly initialize an initial perturbation image with the same size as the output image under the visual constraint condition that the l-infinity norm ≤ 0.1.

[0048] The training sample set includes multiple sample images. In this embodiment, randomly sample pictures from the ImagNet_validation training set, and then randomly select an additional 1000 pictures for the validation set during the training phase. Use the ImageNet_validation test set to evaluate the generalization performance of the perturbation image in generating adversarial samples on unknown images. There is no overlap among the pictures in the training sample set, the validation set, and the test set.

[0049] Step 2: Data preprocessing, crop the general adversarial perturbation and the dataset to an appropriate size, overlay them, and perform preprocessing to obtain the adversarial sample input to the neural network; preferably, convert it into a float32 format Numpy tensor and batch-normalize the sample images by channel color;

[0050] Specifically, the data clipping method is central clipping, and the appropriate size of the general perturbation and the dataset after clipping is 224×224×3.

[0051] Step 3: Input the image sample x into the set convolutional neural network, extract the activation mapping feature map from the outputs of each channel of the last convolutional layer, and obtain the activation mapping

[0052] Specifically, for the output feature map of the block5_conv4 layer, which is the last convolutional layer of VGG19, calculate the gradient of the input image category with respect to the block5_conv4 feature map, and then calculate the pooling gradient. Each element is the average gradient size of a specific feature map channel. For a given image sample, multiply each channel of the feature map array by the importance of a certain channel to the image category, and the obtained average value of each channel of the feature map is the heat map of class activation.

[0053] Specifically, the activation values obtained from the activation mapping come from the spatial information retained by the deep convolutional layer, and the stacked semantics of multiple convolutional layers are obtained through the last layer. The size of the activation mapping of the last layer is 16×16×512.

[0054] Furthermore, in step 3, the activation mapping is extracted from the last convolutional layer, and its number of channels is 512.

[0055] Step 4: Activation mapping Through the forward propagation of the pre-trained model network, obtain the distribution output y of the fully connected layer. Use the reverse hierarchical relevance propagation for the output of the fully connected layer to obtain the activation mapping feature map of the i-th layer of the neural network for a certain channel k of the last convolutional layer corresponding to the target class c of the correlation coefficient

[0056] Specifically, y = max{y 1 ,..., y c ,..., y N}.

[0057] Specifically, in step 4 above, the target class probability distribution output y of the fully connected layer undergoes a softmax operation, and the reverse hierarchical relevance propagation mechanism follows the z-rule rule:

[0058]

[0059] where R i , R j represent the correlation of the i-th layer and the correlation of the j-th layer, and X i represent the activation outputs of the i-th layer respectively, The part representing the weight between the $i$-th layer and the $j$-th layer.

[0060] Further, the backpropagation activation mapping feature map described in step 4 The correlation coefficient The layer - to - layer correlation propagation using the Softmax - passed layer can be expressed as:

[0061]

[0062]

[0063] Further, as Figure 3 shown is the backpropagation layer - to - layer correlation propagation method.

[0064] Further, for the activation map feature described in step 4 above $c$ represents the target class, $k$ represents the $k$-th channel of the last convolutional layer, and its value range is from 1 to $n$, where $n = 512$.

[0065] Step 5: Global pooling. Use the global pooling operation to reduce the dimension of the correlation propagation coefficients of each channel to obtain the weight coefficients of the activation mapping map The weight coefficients

[0066] Step 6: Extract the correlation - based activation mapping map. Linearly combine the weight coefficients of the activation mapping map with the activation mapping map to form the correlation - based activation mapping function Use the $l$ p norm metric and the layer - to - layer correlation interpreter to construct the loss function:

[0067]

[0068] Step 7: Optimize the universal perturbation $v$. The image sample $x$ passes through the target machine learning model $f$ to calculate the target classification $c$ ori and the misclassification $c$ adv , through make the output of the machine learning model close to the misclassification, and use the momentum iteration method during gradient update. Iteratively update the universal perturbation $v$ until $f(x + v)\neq f(x)$. When the number of iterations is greater than or equal to the number of sample images or the optimization target converges, finally obtain the universal adversarial perturbation $v$ based on the correlation - based activation mapping out .

[0069] Specifically, assume that the inter-layer correlation interpreter on the target classification neural network f is I, and the specified class label is y. Then I(x, y) represents the heatmap of the corresponding class. The inter-layer correlation interpreter I needs to be constructed on the target classification deep neural network. It takes the image x and the selected classification label c as inputs and generates the heatmap I(x, c) of the corresponding class. When adding the universal perturbation v, the heatmap of the perturbed image is defined as I(x + v, c).

[0070] Furthermore, step 7 includes the following sub-steps:

[0071] 7.1. Initialize the universal adversarial perturbation v in the form of a vector;

[0072] 7.2. Set the zeroth adversarial sample as the real sample;

[0073] 7.3. When the root mean square error between the clean sample and the adversarial sample is less than the threshold, continue to update the gradient in the way of momentum iteration;

[0074] 7.4. Iteratively update the adversarial sample according to the calculated gradient until the generated adversarial perturbation can deceive the neural network with a high fooling rate on the clean sample.

[0075] Specifically, the formula for updating the gradient by momentum iteration is:

[0076] m t ←γm t-1 +η t g t

[0077] x t ←x t-1 -m t

[0078] where m t represents the momentum at the t-th iteration, and g t represents the gradient at the t-th iteration.

[0079] Further preferably, the target RMSD threshold is set to 7.

[0080] The above are only the preferred embodiments of the present application and are not used to limit the present application. For those skilled in the art, various changes and modifications can be made to the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included within the protection scope of the present application.

[0081] The understanding research of the present invention on universal adversarial perturbations is carried out based on the VGG model, and the method of the present invention is also applicable to the research and analysis of other VGGNet convolutional neural networks. The above-mentioned examples of the present invention are only to illustrate in detail the calculation model and calculation process of the present invention, rather than a limitation on the implementation manner of the present invention. For those of ordinary skill in the art, other different forms of changes or modifications can be made based on the above description. It is impossible to list all the implementation manners here. Any obvious changes or modifications derived from the technical solution of the present invention still fall within the protection scope of the present invention.

Claims

1. A general adversarial perturbation generation method based on correlation class activation mapping, characterized in that It includes the following steps: Step 1: For the universal adversarial perturbation v, which is initialized to 0, use the trained VGG19 convolutional neural network f to generate the universal perturbation; Step 2: Data preprocessing. Use the trained VGG19 and randomly sample images from the divided ImagNet_validation training set. Superimpose the universal adversarial perturbation and the dataset after cropping them to an appropriate size and perform preprocessing to obtain the adversarial samples as the input to the neural network; Step 3: Activate the graph feature extraction. Input the image sample x into the convolutional neural network f described in Step 1, and extract the activation mapping feature map from the outputs of each channel of the last convolutional layer to obtain the activation mapping graph. where c is the target class; Step 4: Calculation of the relevance propagation coefficient, activation mapping graph The distribution output y of the fully connected layer is obtained through the forward propagation of the trained model network. The output of the fully connected layer is used for reverse inter-layer relevance propagation to obtain the activation mapping feature map of the i-th layer of the neural network for the target class c with respect to a certain channel k of the last convolutional layer Relevance coefficient Step 5: Global pooling. Use global pooling operation to reduce the dimension of the correlation propagation coefficients of each channel, and obtain the activation map A k weight coefficient Step 6: Extract the relevance class activation map, and linearly combine the weight coefficients of the activation map with the activation map to form a relevance class activation mapping function Use the l p norm metric and the inter-layer relevance interpreter to construct a loss function Step 7: Optimize the universal perturbation v. For the image sample x, calculate the target classification c through the convolutional neural network f described in Step 1 ori and the misclassification c adv , through making the output of the machine learning model close to the misclassification, and using momentum iteration during gradient update. Iteratively update the universal perturbation v until f(x + v) ≠ f(x). When the number of iterations is greater than or equal to the number of sample images or the optimization objective converges, finally obtain the universal adversarial perturbation v based on the correlation class activation mapping out .

2. The general adversarial perturbation generation method based on relevance class activation mapping according to claim 1, characterized in that: In the above Step 1, the convolutional neural network uses VGG19, whose network structure and parameters are fixed and include the last three fully connected layers.

3. The general adversarial perturbation generation method based on relevance class activation mapping according to claim 1, characterized in that: In the above Step 2, the appropriate size to which the universal perturbation and the dataset are cropped is 224×224×3.

4. A general adversarial perturbation generation method based on relevance class activation mapping according to claim 1, characterized in that: In the above Step 3, the activation map is extracted from the last convolutional layer, whose number of channels is 512.

5. The general adversarial perturbation generation method based on correlation class activation mapping according to claim 1, characterized in that: In the above Step 4, the probability distribution y of the target class output by the fully connected layer is subjected to the softmax operation, and the reverse layer-wise relevance propagation mechanism follows the z-rule: Among them R i ,R j represents the correlation of the i-th layer and the j-th layer, and X i respectively represent the activation outputs of the i-th layer, represents the part of the weight between the i-th layer and the j-th layer.

6. The general adversarial perturbation generation method based on relevance class activation mapping according to claim 1, characterized in that, The correlation coefficient of the backpropagation activation mapping feature map in step 4 is calculated using the inter-layer correlation propagation method with the Softmax function.

7. The general adversarial perturbation generation method based on relevance class activation mapping according to claim 1, wherein: The above Step 7 includes the following sub-steps: 7.

1. The universal adversarial perturbation v is initialized in the form of a vector; 7.

2. Set the zero-th sample as the real sample; 7.

3. When the root mean square error between the clean sample and the adversarial sample is less than the threshold, continue to update the gradient in the way of momentum iteration; 7.

4. Iteratively update the adversarial sample according to the calculated gradient until the generated adversarial perturbation can deceive the neural network with a high fooling rate on the clean sample.

8. The general adversarial perturbation generation method based on relevance class activation mapping according to claim 1, characterized in that The SGD optimizer is used in the process of training VGG19, and the parameter settings are: momentum = 0.9, decay = 0.001, and the initial learning rate is set to 0.01.

Images