A black-box adversarial sample generation method based on Transformer model

Abstract

In order to solve the problem that the security of artificial intelligence technology is difficult to evaluate and improve in practical applications, the present invention provides a black box adversarial sample generation method based on the Transformer model, which belongs to the field of artificial intelligence technology. The main idea is to consider the impact of different coding blocks on the performance of adversarial samples, and classify the performance of coding blocks using coding block weight scores. Different strategies are used to generate adversarial samples for different coding blocks, balance the impact of image and model information on perturbations, stabilize the update direction of perturbations, and improve the attack success rate and migration ability of adversarial samples. Finally, adaptive weights are designed to adjust the perturbation size of key pixels, so that adversarial perturbations can improve attack capabilities without being noticeable to the human eye. The present invention significantly improves the migration ability of adversarial samples, can effectively evaluate and improve the security of artificial intelligence technology, and its experiments on image classification tasks fully demonstrate the effectiveness of the method.

Description

Technical Field

[0001] The present invention relates to a black-box adversarial sample generation method based on a Transformer model, and belongs to the technical field of artificial intelligence. Background Art

[0002] With the rapid development of artificial intelligence technology, neural network models have played an important role in various fields of society, especially in the field of computer vision, such as face recognition, autonomous driving, and public security. However, studies have shown that neural network models are very susceptible to adversarial samples with high transferability: on the local model, by adding noise to the original image, an image that is visually similar to the original image is generated, causing other neural network models to output errors. As more and more neural network models are used on a large scale in real-world scenarios, their security has aroused people's concerns. At the same time, the unexplainability of neural network models makes the model performance dependent on the training data set, which limits the improvement of model performance and its wide application. Therefore, how to establish credible artificial intelligence technology and evaluate and improve the security of neural network models is an urgent problem to be solved.

[0003] In order to improve the security of neural network models in application fields and reduce potential threats from attackers in real scenarios, on the one hand, the security performance of the model can be evaluated by testing the neural network model with adversarial samples; on the other hand, by adding adversarial samples to the original training set for training, the stability and security of the model can be improved. Therefore, adversarial samples have become an important method to evaluate and improve model performance and a hot research issue in the field of artificial intelligence. At present, various types of neural network model architectures have emerged, such as convolutional neural networks, generative adversarial networks, ViTs (Vision Transformers), etc. Among them, ViTs has a wider receptive field and can better integrate global information. Especially when a large-scale data set is used to train the model, it has excellent performance in many computer vision fields, including object detection and image classification. Most of the existing adversarial attack techniques are proposed for convolutional neural networks. They are overly dependent on convolutional neural network model information, and it is difficult to generate adversarial samples that can simultaneously attack multiple different types of models. There are disadvantages such as low attack success rate and weak migration ability on the ViTs model, which cannot be used to evaluate and improve the security of ViTs. Therefore, it is crucial to study the adversarial sample generation method based on ViTs. Summary of the invention

[0004] In order to solve the problems of low attack success rate and weak migration ability on the ViTs model in the prior art, the present invention provides a black-box adversarial sample generation method based on the Transformer model, which has strong attack performance and reduces the dependence on model information, thereby improving the migration ability of adversarial samples. In the black-box scenario, multiple convolutional neural networks and ViTs models can be attacked at the same time. In the training stage of the model, the adversarial samples generated by the present invention are fused with the original training set, which can effectively improve the comprehensive performance of the model. At the same time, the present invention provides a more effective evaluation method for the security of neural network models in application scenarios.

[0005] The technical solution adopted by the present invention is specifically as follows:

[0006] A black-box adversarial sample generation method based on a Transformer model. The method adopts two strategies to jointly generate adversarial samples for different coding block attributes in the Transformer. For robust coding blocks, a cross entropy loss strategy is used, and for non-robust coding blocks, a self-attention feature loss strategy is used. The method can avoid the redundancy of model information and improve the migration ability of adversarial samples. The method is characterized in that the method comprises the following steps:

[0007] Step 1: Get the original image and the corresponding label to form the original data set, and initialize the adversarial perturbation with the same size as the original image;

[0008] Step 2: Generate multiple noise images with the same size as the original image to form a negative sample data set;

[0009] Step 3: According to the original image and the negative sample data set, the coding blocks in the visual transformer, i.e., the ViT model, are divided into robust coding blocks and non-robust coding blocks; wherein the ViT model is a pre-trained model, comprising a plurality of coding blocks, each of which can extract classification information for calculating the target loss value;

[0010] Step 4: linearly superimpose the adversarial perturbation and the original image and input them into the ViT model, iteratively update the adversarial perturbation until the iteration stop condition is met, output the final adversarial perturbation, linearly superimpose the final adversarial perturbation and the original image to obtain the corresponding adversarial sample;

[0011] In particular, in step 2, a negative sample data set is formed, which specifically includes:

[0012] Determine that the number of images included in the negative sample data set corresponding to the original image is M;

[0013] According to the following formula, the mth image x′ in the negative sample dataset corresponding to the original image is obtained:

[0014]

[0015] in, is the mth noise; p represents the probability that a pixel in the noise image is 0, 1-p represents the probability that a pixel in the noise image is 1; x is the original image; ⊙ represents the vector dot product.

[0016] In particular, in step 3, the coding blocks in the ViT model are divided into robust coding blocks and non-robust coding blocks, specifically including:

[0017] According to the original image and the ViT model, determine the target loss function value of the model with respect to the original image and the self-attention feature map of each coding block with respect to the original image, which are referred to as the first loss value and the first self-attention feature map respectively;

[0018] According to the first loss value and the first self-attention feature map, a first coding block weight score in each coding block is obtained.

[0019] According to each image in the negative sample data set and the ViT model, determine the target loss function of the model with respect to the negative sample and the self-attention feature map of each coding block with respect to the negative sample, which are respectively referred to as the second loss value and the second self-attention feature map;

[0020] Determine a second coding block weight score in each coding block according to the second loss value and the second self-attention feature map;

[0021] According to the second coding block weight score of each image in the negative sample data set, an average second coding block weight score in each coding block is obtained;

[0022] According to the weight score of the first coding block and the average weight score of the second coding block, the anti-interference ability of each coding block is determined, the first K coding blocks with strong anti-interference ability are divided into robust coding blocks, and the remaining coding blocks are divided into non-robust coding blocks.

[0023] In particular, the first coding block weight score of each coding block is obtained according to the following formula:

[0024]

[0025] Where B represents the number of coding blocks in the ViT model; i represents the number of coding blocks; J(x,y) represents the loss function of the ViT model; SAM i (x) represents the self-attention feature map extracted by the i-th encoding block; It means to find the gradient with respect to x.

[0026] In particular, the average second coding block weight score of each coding block is obtained according to the following formula:

[0027]

[0028] Where M is the number of images contained in the negative sample dataset.

[0029] In particular, the robust coding block and the non-robust coding block described in step 3 specifically include:

[0030] According to the following formula, the anti-interference ability of each coding block is obtained:

[0031]

[0032] Among them, || represents the absolute value; w i (x) represents the first coding block weight score of the i-th coding block, represents the average second coding block weight score of the i-th coding block.

[0033] According to the following formula, the coding block positions with strong to weak anti-interference capabilities are obtained:

[0034] S=[s1,s2,…,s B ]

[0035] Among them, the coding blocks corresponding to the first K positions are robust coding blocks, and the rest are non-robust coding blocks.

[0036] In particular, the iterative update countermeasure perturbation described in step 4 specifically includes:

[0037] Linearly superimpose the adversarial perturbation with the original image to obtain a temporary adversarial sample, and input it into the ViT model;

[0038] According to the non-robust coding block and the self-attention feature map extracted therefrom, a loss function based on the self-attention feature map of the adversarial sample and the original image is calculated.

[0039] According to the robust coding block, the cross entropy loss function of the adversarial sample and the original image is calculated.

[0040] Calculate the pixel-based loss function of the adversarial example and the original image.

[0041] Update the adversarial sample according to the total loss function.

[0042] The total loss function is as follows:

[0043]

[0044] in, (x,y) represents the sth k The cross entropy loss function of the encoding block; x *is an adversarial sample, y is the true label corresponding to the original image; ‖‖2 represents the Euclidean distance; Indicates the s k The self-attention feature map extracted from the encoding block; λ and μ are constants used to balance the loss function.

[0045] In particular, in step 4, the adversarial sample is updated according to the following formula:

[0046]

[0047] in, represents the adversarial sample obtained at the tth iteration; α is the step size of a single update of the adversarial perturbation; sign() is a sign function used to determine the direction of the perturbation; Represents the gradient of the loss; Represents adaptive weights; RELU() is a linear rectification function.

[0048] It can be seen from the above technical scheme that the black-box adversarial sample generation method based on the Transformer model provided by the present invention can effectively attack a variety of unknown neural network models. By fully considering the properties of different coding blocks in ViT, the coding blocks are divided into two types: robust and non-robust coding blocks according to the weight scores of the coding blocks, and two attack strategies are established to jointly generate adversarial samples, balancing the impact of the image itself and local model information on the adversarial samples, so as to suppress the redundancy of non-essential model information and image self-attention features that are highly related to the model, and significantly improve the migration ability of adversarial samples. By constraining the pixel-level and self-attention feature-level differences between the adversarial sample and the original image, the update direction of the adversarial disturbance is stabilized. Furthermore, an adaptive weight is designed to adjust the disturbance size of different pixels, highlighting the key pixel information, so that the adversarial sample has a stronger attack capability without being affected by the visual effect.

[0049] In summary, the adversarial sample generation method proposed in the present invention effectively solves the problems of low attack success rate and weak migration ability on the ViTs model, and still has strong attack performance on the convolutional neural network model. It is more suitable for security detection of neural network models in real scenarios, and can be used to train more stable and secure neural network models. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 is a flow chart of a method for generating adversarial samples according to an embodiment of the present invention;

[0051] Figure 2 is a flow chart of coding block selection provided by an embodiment of the present invention;

[0052] Figure 3 is a coding block selection block diagram provided by an embodiment of the present invention;

[0053] Figure 4 is a block diagram of adversarial sample generation provided by an embodiment of the present invention; DETAILED DESCRIPTION

[0054] The present invention proposes a black-box adversarial sample generation method based on the Transformer model. In order to solve the problems of low attack success rate and weak migration ability in the prior art on the ViTs model, the properties of different coding blocks in ViTs are fully considered, and two strategies are used to jointly generate adversarial samples for different coding blocks to reduce the degree of dependence on model information, thereby improving the migration ability of adversarial samples. In order to further improve the attack capability, adaptive weights are used to adjust the size of the perturbation for key pixel points of the image to destroy the key pixel points, which significantly improves the attack performance of the adversarial sample. Figure 1 The flowchart of the method of the present invention is clearly shown in FIG. 1 , and the specific implementation steps are as follows:

[0055] (1) Obtain the original image and the corresponding label to form the original dataset, and initialize the adversarial perturbation with the same size as the original image. In this example, one image is randomly selected from each class of the ILSVRC 2012 validation dataset, a total of 1,000 images as the original image.

[0056] (2) Generate multiple noise images with the same size as the original image to form a negative sample data set. In this example, there are M images in the negative sample data set. Specifically, the image in the mth negative sample data set is obtained according to the following formula:

[0057]

[0058] in, is the mth noise; p represents the probability that a pixel in the noise image is 0, 1-p represents the probability that a pixel in the noise image is 1; x is the original image; ⊙ represents the vector dot product.

[0059] (3) Figure 2 As shown in Figure 1, the coding blocks are divided using the coding block weight scores. According to the original image and the ViT model, the ViT model is a pre-trained model that can correctly predict the original image. The model contains multiple coding blocks, and each coding block can extract classification information to calculate the target loss value. Figure 3 The coding block selection diagram is clearly shown in . In order to obtain the first coding block weight score in each coding block, the original image is first transformed into an image block that conforms to the ViT model input, and then the image block is input into the ViT model to obtain the first loss value of the model. The first self-attention feature map is obtained from each coding block according to the following formula:

[0060]

[0061] Among them, softmax() is a neural network activation function; Q i , K i and V i V i is the self-attention weight matrix of the ViT model; D q is the dimension of the learnable matrix in the ViT model; () T Indicates transpose.

[0062] (4) According to the first loss value and the first self-attention feature map in each coding block, the weight score of the first coding block in the i-th coding block is obtained. The specific calculation formula is as follows:

[0063]

[0064] Where B represents the number of coding blocks in the ViT model; i represents the number of coding blocks; J(x,y) represents the loss function of the ViT model; SAM i (x) represents the self-attention feature map extracted by the i-th encoding block; Indicates the gradient of x; W(x) = [w 1 (x),w 2 (x),…,w B (x)] is the weight score of the first coding block of the model.

[0065] (5) According to the negative sample data set and the ViT model, the second loss value of the target loss function and the second self-attention feature map in each coding block are determined, and then the second coding block weight score in each coding block is calculated. Finally, according to the second coding block weight score of each image in the negative sample data set, the average second coding block weight score of each coding block is obtained. The specific formula is as follows:

[0066]

[0067] Among them, M is the number of images contained in the negative sample dataset; is the average second coding block weight score of the model.

[0068] (6) According to the weight score of the first coding block and the average weight score of the second coding block, the anti-interference ability of each coding block is determined. The specific calculation formula is as follows:

[0069]

[0070] Among them, || means taking the absolute value; w i (x) represents the first coding block weight score of the i-th coding block, represents the average second coding block weight score of the i-th coding block. 1 ,d 2 ,…,d B ] represents the overall anti-interference ability of the model. On the one hand, d i The larger the value, the greater the difference between the weight score of the first coding block extracted by the i-th coding block and the average weight score of the second coding block, that is, the coding block is easily interfered by noise, has weak anti-interference ability, and has poor robust performance. On the other hand, the weaker the anti-interference ability of the coding block, the more sensitive it is to noise, making it easier to perceive the difference between the two images.

[0071] (7) Sort the anti-interference ability of each coding block from strong to weak, record the position of the corresponding coding block, divide the first K coding blocks with strong anti-interference ability into robust coding blocks, and divide the remaining coding blocks into non-robust coding blocks. The specific formula is as follows:

[0072] S=[s1,s2,…,s B ]

[0073] Among them, the coding blocks corresponding to the first K positions are robust coding blocks, and the rest are non-robust coding blocks.

[0074] (8) Figure 4 As shown, the adversarial perturbation is linearly superimposed with the original image and input into the ViT model. By dividing the coding blocks, information is extracted from the coding blocks in a targeted manner, which effectively reduces the redundancy of non-essential model information and image self-attention features that are highly relevant to the model, and improves the mobility of adversarial samples. In this regard, the present invention combines two strategies to generate adversarial samples, balancing the image itself and the local model information. The specific method is as follows:

[0075] A. For robust coding blocks, use the cross entropy loss strategy

[0076] Because the robust coding block is not easily disturbed by noise, it is more inclined to extract image information that plays a key role in the model prediction results. According to the image information extracted from the robust coding block, the impact of the adversarial sample on the model prediction results can be accurately obtained, and the direction of change of the adversarial perturbation can be determined. In the ViT model, the image information extracted by each coding block can output the final prediction result through a multi-head linear classifier, so the image information can be extracted from the robust coding block to obtain the cross entropy loss function of multiple coding blocks.

[0077] B. For non-robust coding blocks, use a self-attention feature loss strategy

[0078] The non-robust encoding block has the advantage of being sensitive to noise and can effectively measure the difference between the adversarial sample and the original image, thereby stabilizing the update direction of the perturbation, promoting more perturbation generation, and improving the attack performance of the adversarial sample. According to the self-attention feature map extracted by the non-robust encoder, the self-attention feature map loss between the adversarial sample and the original image is determined.

[0079] The final loss function integrates the cross entropy loss strategy and the self-attention feature map loss strategy. Furthermore, the pixel-level loss is used to improve the attack capability of adversarial samples. The specific expression of the total loss function is as follows:

[0080]

[0081] in, Represents the s k The cross entropy loss function of the encoding block; x* is the adversarial sample, y is the true label corresponding to the original image; ‖‖2 represents the Euclidean distance; Indicates the s k The self-attention feature map extracted from the encoding block; λ and μ are constants used to balance the loss function.

[0082] (9) According to the average second coding block weight score obtained by the optimal robust coding block, determine the size of the temporary adversarial perturbation adjusted by adaptive weights, and improve the attack capability of the adversarial sample by expanding the perturbation length of key pixels. Finally, it is linearly superimposed with the original image to obtain the adversarial sample for the next round of iteration. The specific formula is as follows:

[0083]

[0084] in, represents the adversarial sample obtained at the tth iteration; sign() is a sign function with a value of +1 or -1, which is used to determine the update direction of the perturbation; α is the single update step size of the perturbation; Represents the adaptive weight matrix, where RELU(x)=max(0,x) is a linear rectification function, therefore, the adaptive weight 1≤AW(x)≤2.

[0085] This application conducts experiments in image classification tasks, randomly selects one image from each class of the ILSVRC 2012 validation data set as the original image, a total of 1000 original images, generates adversarial samples on the Deit-T model, and tests on 5 ViTs models and 5 convolutional neural network models, and finally compares with 5 adversarial sample generation methods. The experiment measures the performance of the method by the attack success rate. The larger the attack success rate value, the better the attack performance and migration rate of the adversarial sample. Table 1 is the attack performance of the adversarial sample on 5 ViTs models, and Table 2 is the attack performance of the adversarial sample on 5 convolutional neural networks. It can be seen that compared with other methods, the attack success rate of the adversarial sample of this application is better, and the migration ability of the adversarial sample is significantly improved. It has good attack performance and migration performance both on convolutional neural networks and ViTs models. Therefore, the method of the present invention can better evaluate and improve the security of neural network models in application scenarios.

[0086] Table 1

[0087]

[0088]

[0089] Table 2

[0090]

Claims

1. A black-box adversarial sample generation method based on the Transformer model. This method uses two strategies to jointly generate adversarial samples for different coding block attributes in the Transformer. For robust coding blocks, a cross entropy loss strategy is used, and for non-robust coding blocks, a self-attention feature loss strategy is used. This method can avoid the redundancy of model information and improve the migration ability of adversarial samples. It is characterized by The method comprises the following steps: Step 1: Get the original image and the corresponding label to form the original data set, and initialize the adversarial perturbation with the same size as the original image; Step 2: Generate multiple noise images with the same size as the original image to form a negative sample data set; Step 3: According to the original image and the negative sample data set, the coding blocks in the visual transformer, i.e., the ViT model, are divided into robust coding blocks and non-robust coding blocks; wherein the ViT model is a pre-trained model, comprising a plurality of coding blocks, each of which can extract classification information for calculating the target loss value; Step 4: Linearly superimpose the adversarial perturbation and the original image and input them into the ViT model, iteratively update the adversarial perturbation until the iteration stop condition is met, output the final adversarial perturbation, linearly superimpose the final adversarial perturbation and the original image to obtain the corresponding adversarial sample.

2. The method for generating black-box adversarial samples based on the Transformer model according to claim 1, characterized in that: In step 2, a negative sample data set is formed, which specifically includes: Determine that the number of images included in the negative sample data set corresponding to the original image is M; According to the following formula, the mth image in the negative sample dataset corresponding to the original image is obtained: in, is the mth noise image; p represents the probability that a pixel in the noise image is 0, 1-p represents the probability that a pixel in the noise image is 1; x is the original image; ⊙ represents the vector dot product.

3. The black-box adversarial sample generation method based on the Transformer model as claimed in claim 1, characterized in that: In step 3, the coding blocks in the ViT model are divided into robust coding blocks and non-robust coding blocks, specifically including: According to the original image and the ViT model, determine the target loss function value of the model with respect to the original image and the self-attention feature map of each coding block with respect to the original image, which are respectively referred to as the first loss value and the first self-attention feature map; according to the first loss value and the first self-attention feature map, obtain the first coding block weight score in each coding block; According to each image in the negative sample data set and the ViT model, determine the target loss function of the model with respect to the negative sample and the self-attention feature map of each coding block with respect to the negative sample, which are respectively referred to as the second loss value and the second self-attention feature map; Determine a second coding block weight score in each coding block according to the second loss value and the second self-attention feature map; According to the second coding block weight score of each image in the negative sample data set, an average second coding block weight score in each coding block is obtained; According to the weight score of the first coding block and the average weight score of the second coding block, the anti-interference ability of each coding block is determined, the first K coding blocks with strong anti-interference ability are divided into robust coding blocks, and the remaining coding blocks are divided into non-robust coding blocks.

4. The black-box adversarial sample generation method based on the Transformer model as claimed in claim 3, characterized in that According to the following formula, the first coding block weight score of each coding block is obtained: Where B represents the number of coding blocks in the ViT model; i represents the number of coding blocks; J(x,y) represents the loss function of the ViT model; SAM i (x) represents the self-attention feature map extracted by the i-th encoding block; It means to find the gradient with respect to x.

5. The method for generating black-box adversarial samples based on the Transformer model as claimed in claim 3, characterized in that: According to the following formula, the average second coding block weight score of each coding block is obtained: Where M is the number of images contained in the negative sample dataset.

6. The method for generating black-box adversarial samples based on the Transformer model as claimed in claim 3, characterized in that: The robust coding block and the non-robust coding block specifically include: According to the following formula, the anti-interference ability of each coding block is obtained: Among them, || represents the absolute value; w i (x) represents the first coding block weight score of the i-th coding block, represents the average second coding block weight score of the i-th coding block; According to the following formula, the coding block positions with strong to weak anti-interference capabilities are obtained: S=[s1,s2,…,s B ] Among them, the coding blocks corresponding to the first K positions are robust coding blocks, and the rest are non-robust coding blocks.

7. The method for generating black-box adversarial samples based on the Transformer model according to claim 1, characterized in that: The iterative update countermeasure perturbation described in step 4 specifically includes: Linearly superimpose the adversarial perturbation with the original image to obtain a temporary adversarial sample, and input it into the ViT model; According to the non-robust coding block and the self-attention feature map extracted therefrom, calculating a loss function based on the self-attention feature map of the adversarial sample and the original image; According to the robust coding block, calculate the cross entropy loss function of the adversarial sample and the original image; Calculating a pixel-based loss function for the adversarial example and the original image; Update the adversarial sample according to the total loss function; The total loss function is as follows: in, Represents the s k The cross entropy loss function of the encoding block; x * is an adversarial sample, y is the true label corresponding to the original image; ‖ ‖2 represents the Euclidean distance; Indicates the s k The self-attention feature map extracted from the encoding block; λ and μ are constants used to balance the loss function.

8. The method for generating black-box adversarial samples based on the Transformer model according to claim 7, characterized in that: Update the adversarial sample according to the following formula: in, represents the adversarial sample obtained at the tth iteration; α is the step size of a single update of the adversarial perturbation; sign() is a sign function used to determine the direction of the perturbation; Represents adaptive weights, and RELU() is a linear rectification function.

Images