Transferable image adversarial sample generation and deep neural network testing method and system

Abstract

The application provides a transferable image adversarial sample generation and deep neural network testing method and system, aiming at testing the robustness of a deep neural network model in a real environment. First, data is collected, and a proxy model with the same function as the to-be-tested model is trained. Then, diversified neighbor samples of input image samples are generated. The gradient of the loss function relative to the neighbor image samples is obtained on the proxy model, and the gradient is standardized. The average of the gradient is taken as the perturbation direction. Finally, according to the dynamic constraint, the pixel values that do not meet the constraint condition are cropped. The above steps are repeated to reach the maximum number of iterations, and transferable image adversarial samples are obtained. The to-be-tested model is tested using the samples. The method innovates the generation method of the generated samples through the diversification of the neighbor image samples, the gradient standardization and the dynamic constraint, improves the success rate of the generation of the transferable image adversarial samples, and improves the quality of the generated images.

Description

TECHNICAL FIELD

[0001] The present application relates to a kind of migratory image adversarial sample generation and the testing method and system of deep neural network model, belong to artificial intelligence test field. BACKGROUND

[0002] Although deep neural network has achieved good effect in many computer tasks and practical applications, recent research shows that DNNs for image processing tasks are particularly vulnerable to image adversarial samples (Adversarial Example) added with tiny perturbations, which are imperceptible to humans but can cause serious errors in AI systems, which poses a security risk to the actual deployment of DNNs.

[0003] Currently, the security of DNNs is mainly tested by generating image adversarial samples of the model to be tested to test whether the deep neural network model can correctly predict on the generated image samples. Although image adversarial samples exist widely, the threat of image adversarial samples produced by white-box attacks is not urgent, because white-box attacks require sufficient internal information of the target model (model to be tested), and the attacker cannot obtain the structure, parameters and other information of the target model in the real application scenario. Another type is black-box attack, which can be roughly divided into two types. One is query-based attack, and the other is migration-based attack. Query-based attack generally needs to access DNNs multiple times to obtain more accurate gradient information, which requires large computational cost and is easy to be detected by the system. Migration-based attack is different, which uses DNNs model with the same task capability as a surrogate model (Surrogate Model), generates image adversarial samples on the surrogate model to attack the target model, and makes the target model produce incorrect output. The migratory image adversarial samples produced by this attack method have lower cost and are no longer limited by the information of the target model, and are more threatening in real deployment environment. Therefore, it has strong practical significance to test the security of target DNNs model against migratory image adversarial samples.

[0004] At present, some methods for generating transferable image adversarial samples have been proposed, among which the better ones are: (1) the momentum-based MI-FGSM method makes the optimization direction more stable by accumulating the gradient of the previous iteration; (2) the input transformation-based DMI randomly scales the input image samples to increase the diversity of the input image samples; (3) the gradient smoothing-based TMI uses Gaussian convolution kernels to perform Gaussian smoothing on the generated gradients, thereby increasing the model's discrimination area on the input image samples; (4) the neighbor gradient variance adjustment-based VMI generates multiple neighbor image samples of the input image sample, and obtains the gradient difference between the multiple neighbor image samples and the current input image sample as the correction direction of the next gradient, further stabilizing the optimization direction. Although the above methods have achieved good results, these methods generally have the following problems:

[0005] (1) The testing method for neural networks with transferable image adversarial samples still has a weak ability to detect errors, and unstable optimization direction is one of the main reasons for the weak ability to detect errors.

[0006] (2) Current testing methods blindly pursue the ability to detect errors but ignore the "imperceptibility" constraint of the perturbation, resulting in poor quality of the generated image samples. Summary of the Invention

[0007] Purpose of the Invention: Considering the greater security threat posed by transferable image adversarial samples to the deployment of deep neural network models in real environments and the problems encountered by current methods for generating transferable image adversarial samples during testing, the present invention provides a method and system for generating transferable image adversarial samples and testing deep neural networks. These improvements are made in two aspects: improving the error detection capability of transferable image adversarial samples by stabilizing the gradient of perturbations, and improving the quality of generated image samples by dynamically generating perturbation constraints.

[0008] Technical Solution: To achieve the above-mentioned purpose, the present invention provides a method for generating transferable image adversarial samples, comprising the following steps:

[0009] Set parameter information, including the maximum perturbation change value ε, the maximum number of iterations T, the number of perturbation radius types N of neighboring image samples, the number M of neighboring image samples on each radius, the radius coefficient β, the maximum proportional coefficient inter, and the attenuation coefficient μ; generate the perturbation step size λ = ε / T, the magnification coefficient α = λ × β of the perturbation of the neighboring image samples, and the proportional coefficient group R of different neighboring perturbation radii relative to the magnification coefficient α; obtain the input image sample, and generate the perturbation constraint range of the image sample based on the relationship between each pixel and the surrounding pixels;

[0010] Iteratively generate transferable image adversarial samples of input image samples according to the following steps:

[0011] The gradient of the proxy model relative to the neighbor image sample is calculated, and the gradient is standardized, the average of the gradient is taken as the perturbation direction, and the perturbation of the current iteration round is obtained according to the perturbation direction and the perturbation step; wherein the jth neighbor image sample x i,r,j is represented as x i,r,j = x i + R(r) x a x p j , x i is the input image sample of the ith iteration round, R(r) represents the rth value of the proportion coefficient array R, p j is a random tensor with the same size as the image sample and subject to uniform distribution;

[0012] The generated perturbation is added to the input image sample, and the image sample with the added perturbation is fine-tuned according to the perturbation constraint to meet the constraint condition, and the intermediate image sample of the current iteration round is obtained.

[0013] It is judged whether the iteration number reaches the maximum iteration number T, if yes, the intermediate image sample obtained in the current iteration round is taken as the transferable image adversarial sample, otherwise the intermediate image sample is taken as the input again for the next iteration round.

[0014] Further, the perturbation constraint range of the image sample is generated according to the following method:

[0015] The neighborhood pixel values of each pixel point of the input image sample are obtained and sorted.

[0016] The minimum value of the maximum value of the neighborhood pixels of each pixel of the input image sample is taken as the upper and lower limit value of the current pixel perturbation, that is, the perturbation constraint of the pixel in the image.

[0017] Further, the method of obtaining the perturbation of the current iteration round according to the gradient direction and the perturbation step includes:

[0018] The gradient of the proxy model relative to each neighbor image sample on each radius is standardized, and the average of the gradients of the M neighbor image samples is calculated, and the average of the gradients of the N different radii of the ith iteration round is taken as the final gradient grad i .

[0019] The gradient accumulation strategy based on momentum is used, and the gradient of the last iteration round and the gradient of the current iteration round are accumulated as the final gradient value n i of the ith iteration:

[0020]

[0021] According to the gradient value ni The sign function sign() is used to determine the perturbation direction of each pixel, and multiplied by the corresponding perturbation step size as the perturbation generated in this round of iteration.

[0022] Furthermore, R=Linspace(0,inter,N+1), where Linspace means generating N+1 numbers at equal distances from 0 to inter.

[0023] The present invention provides a deep neural network testing method based on transferable image adversarial samples, comprising the following steps:

[0024] Obtain the image dataset and corresponding label information corresponding to the deep neural network to be tested;

[0025] Read the collected image dataset and labels, perform data preprocessing, and put the processed image data into a clean image sample set;

[0026] Use the preprocessed training data to train a proxy model with the same functionality as the deep neural network model to be tested and save it;

[0027] Obtain an input image sample from a clean image sample set, and use the transferable image adversarial sample generation method to transfer the image adversarial sample.

[0028] Save to the transferable image adversarial sample data set as test cases;

[0029] The target deep neural network model is tested using test cases from the transferable image adversarial sample set.

[0030] Furthermore, the testing method also includes preprocessing the read image sample data and labels into the size and numerical range required by the model input; after adopting the transferable image adversarial sample generation method, restoring the data form of the original image sample as a test case.

[0031] Furthermore, when using transferable image adversarial samples to test the model to be tested, the performance indicators of the model to be tested on the clean image sample set and the performance indicators on the transferable image adversarial samples are counted respectively, and whether the difference between the two indicators is less than the specified threshold is used as the basis for judging whether the target model is safe and reliable.

[0032] Based on the same inventive concept, the present invention provides a transferable image adversarial sample generation system, comprising:

[0033] The parameter configuration module is used to set parameter information, including the maximum perturbation change value ε, the maximum number of iterations T, the number of perturbation radius types N of neighboring image samples, the number of neighboring image samples on each radius M, the radius coefficient β, the maximum proportional coefficient inter, and the attenuation coefficient μ; generate the perturbation step size λ = ε / T, the magnification coefficient α = λ × β of the neighboring image sample perturbation, and the proportional coefficient group R of different neighboring perturbation radii relative to the magnification coefficient α;

[0034] A constraint generation module is used to obtain an input image sample and generate a perturbation constraint range for the image sample based on the relationship between each pixel and its surrounding pixels;

[0035] And a sample generation module, which is used to iteratively generate transferable image adversarial samples of the input image sample according to the following steps: generate diverse neighboring image samples of the input image sample, calculate the gradient of the proxy model relative to the neighboring image samples, and normalize the gradient, take the average of the gradient as the perturbation direction, and obtain the perturbation of the current round of iteration according to the perturbation direction and perturbation step size; where the jth neighboring image sample x on the rth radius in the i-th iteration round is i,r,j Represented as x i,r,j =x i +R(r)×α×p j , x i is the image sample input in the i-th iteration round, R(r) represents the r-th value of the proportional coefficient group R, p j is a random tensor that obeys uniform distribution and has the same size as the image sample; the generated perturbation is added to the input image sample, and the perturbated image sample is fine-tuned according to the perturbation constraint to satisfy the constraint condition, and the intermediate image sample of the current round iteration is obtained; it is judged whether the number of iterations reaches the maximum number of iterations T. If so, the intermediate image sample obtained in the current round iteration is used as the transferable image adversarial sample, otherwise the intermediate image sample is re-input for the next round iteration.

[0036] Based on the same inventive concept, the present invention provides a deep neural network testing system based on transferable image adversarial samples, including the modules of the transferable image adversarial sample generation system, as well as:

[0037] The preprocessing module is used to obtain the image dataset and corresponding label information corresponding to the deep neural network to be tested; read the collected image dataset and labels, perform data preprocessing, and put the processed image data into a clean image sample set;

[0038] The proxy model training module is used to train and save a proxy model with the same functionality as the deep neural network model to be tested using the preprocessed training data;

[0039] A test case generation module is used to obtain an input image sample from a clean image sample set, and generate a transferable image adversarial sample of the image sample through the transferable image adversarial sample generation system, and save it to the transferable image adversarial sample data set as a test case;

[0040] And a model testing module for testing the target deep neural network model using test cases in the transferable image adversarial sample set.

[0041] Based on the same inventive concept, the present invention provides a computer system comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is loaded into the processor, the computer system implements the method for generating transferable image adversarial samples or the method for testing deep neural networks based on transferable image adversarial samples.

[0042] Beneficial effects: In order to improve the ability of the test method to detect errors, the present invention uses neighbor image sample diversification operations and gradient normalization operations to stabilize the optimization direction. The neighbor diversification operation is to find neighbor image samples on multiple perturbation radii to increase the diversity of neighbor image samples. The purpose of gradient normalization is to make each gradient generated by the neighbor image sample have the same contribution to the optimization process. In addition, in order to improve the quality of the generated image samples, the present invention determines the constraint range of the perturbation based on the relationship between each pixel in the image and the surrounding pixels, so that the perturbation only adds the edge part of the image without destroying the smooth area of ​​the image. Compared with the existing technology, the present invention can find more errors caused by transferable image adversarial samples in the model to be tested, that is, the success rate of generating transferable image adversarial samples is higher, while ensuring the quality of image generation. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 This is a flowchart for generating transferable image adversarial samples according to an embodiment of the present invention.

[0044] Figure 2 This is a flowchart of a deep neural network test according to an embodiment of the present invention.

[0045] Figure 3 The figure is a detailed flow chart of a method according to a specific example of the present invention. DETAILED DESCRIPTION

[0046] The present invention is further illustrated below with reference to specific examples. It should be understood that these examples are only used to illustrate the present invention and are not used to limit the scope of the present invention. After reading the present invention, modifications of various equivalent forms of the present invention made by those skilled in the art all fall within the scope defined by the claims attached to this application.

[0047] like Figure 1As shown, a method for generating migratable image adversarial samples disclosed in an embodiment of the present invention mainly includes: first setting relevant parameter information, including the maximum perturbation change value ε, the maximum number of iterations T, the number of perturbation radius types N of neighboring image samples, the number M of neighboring image samples on each radius, the radius coefficient β, the maximum proportional coefficient inter, the attenuation coefficient μ, and generating a perturbation step size λ=ε / T, a magnification coefficient α=λ×β of the perturbation of the neighboring image samples, and a proportional coefficient group R of different neighboring perturbation radii relative to the magnification coefficient α; then, based on the input image sample, generating a perturbation constraint range of the image sample according to the relationship between each pixel and the surrounding pixels; and then iteratively generating a migratable image adversarial sample for the input image sample. Anti-sample, in each round of iteration, first generate diverse neighboring image samples of the input image sample, calculate the gradient of the proxy model relative to the neighboring image sample, and perform normalization on the gradient. The average of the gradient is used as the perturbation direction, and the perturbation of the current round of iteration is obtained according to the perturbation direction and perturbation step size; then add the generated perturbation to the input image sample, and fine-tune the perturbated image sample according to the perturbation constraint to satisfy the constraint condition, and obtain the intermediate image sample of the current round of iteration; judge whether the number of iterations reaches the maximum number of iterations T. If so, the intermediate image sample obtained in the current round of iteration is used as the transferable image adversarial sample, otherwise the intermediate image sample is re-input for the next round of iteration.

[0048] like Figure 2 As shown, an embodiment of the present invention discloses a method for generating deep neural network test cases based on transferable image adversarial samples, which mainly includes: first obtaining an image dataset and corresponding label information corresponding to the deep neural network to be tested;

[0049] The collected image dataset and labels are read and preprocessed, and the processed image data is placed into a clean image sample set. The preprocessed training data is then used to train a proxy model with the same function as the deep neural network model to be tested and saved. The input image sample is then obtained from the clean image sample set, and the transferable image adversarial sample generation method described above is used to generate a transferable image adversarial sample of the image sample.

[0050] Save it to the transferable image adversarial sample data set as a test case; finally, use the test case in the transferable image adversarial sample set to test the target deep neural network model.

[0051] The following combination Figure 3Taking a deep neural network for image classification as an example, the following describes a method for generating transferable image adversarial samples and a detailed method for testing a deep neural network, as disclosed in an embodiment of the present invention. Assuming that a target image classification model ResNet152 trained using ImageNet needs to be tested, the specific steps are as follows:

[0052] Step 1: Obtain the ImageNet image classification dataset, which mainly includes two aspects:

[0053] Step 11: Download the training set, validation set, test set, and their corresponding labels using the ImageNet dataset download link (https: / / image-net.org / challenges / LSVRC / 2012 / index.php).

[0054] Step 12: Extract the required data from the corresponding compressed file and save it locally.

[0055] Step 2: Read the collected image dataset and corresponding labels, preprocess the read data, and put the test data into a clean image sample set. The specific process is as follows:

[0056] Step 21: Use Pytorch's image reading function to read the ImageNet training set and test set and the corresponding data labels into matrix tensors;

[0057] Step 22: Crop the length and width of the read image sample so that they have the same size as the input of the target neural network model and are both 299; map the pixel values ​​in the image matrix tensor from [0, 255] to the range of [-1.0, 1.0].

[0058] Step 23: The original test set is put into a clean sample set, and the training set is used to train the deep neural network model for image classification.

[0059] Step 3: Use the preprocessed ImageNet training set to train the deep neural network model Inception-V3 for image classification.

[0060] Step 4: Set the parameter configuration information of the transferable image adversarial sample generation method. The specific steps are as follows:

[0061] Step 41: Set the maximum disturbance change value ε = 16.0, the maximum number of iterations T = 10, the number of types of disturbance radius of neighboring image samples N = 6, the number of neighboring image samples on each radius M = 10, the radius coefficient β = 1.8, the maximum proportional coefficient inter = 3.0, and the attenuation coefficient μ = 0.5.

[0062] Step 42: Generate a perturbation step size λ = ε / T; generate a magnification factor α = λ × β for the perturbation of neighboring image samples; generate a set of proportional coefficients R for different neighboring perturbation radii relative to the magnification factor α. Linspace represents generating N + 1 numbers equidistant from 0 to inter and storing them in array R. R(0) represents the proportion corresponding to a perturbation radius of 0 and should be discarded, so we use N proportion values ​​with subscripts 1 to N.

[0063] R=Linspace(0,inter,N+1)

[0064] Step 5: Generate dynamic perturbation constraints. The specific steps are:

[0065] Step 51: Get the 8-neighborhood pixels of each pixel in the x0 input image matrix tensor and sort them;

[0066] Step 52: Take the minimum value of the maximum value among the 8 neighboring pixels of each pixel as the upper and lower limits of the current pixel perturbation constraint, that is, the perturbation constraint of each pixel in the x0 image matrix tensor, and save the perturbation constraint of each pixel in the tensor E.

[0067] Step 6: Based on the input image sample and the proxy model, obtain the gradient of the diverse neighboring image samples of the proxy model relative to the input image sample, normalize the gradient, take the average of the gradient as the perturbation direction, and obtain the image sample perturbation of the current iteration round based on the perturbation direction and perturbation step size. The specific steps are as follows:

[0068] Step 61: Get the current input image sample x i , i represents the current iteration round. On the rth radius x i One of the M nearest neighbor image samples is x i,r,j , j represents the jth nearest neighbor image sample, and 0≤j <M,j为正整数。p j ~U(-2.0,2.0), and p j Has the same shape as the input tensor, used to generate perturbations with an average perturbation radius of 1.0.

[0069] x i,r,j =x i +R(r)×α×p j

[0070] Input M neighboring image samples into the proxy model trained in step 3, and backpropagate to obtain the gradient of the Inception-v3 loss function relative to each neighboring image sample. The loss function here uses the cross entropy loss J(x i,r,j ,y;θ)=-1 ylog(softmax(l(x i,r,j ;θ))),l(x i,r,j ; θ) represents x i,r,j The final logits output result generated by the input to the Inception-v3 model, θ represents the model parameters of Inception-v3, y represents the label value of the input image sample, 1 y In order to stabilize the direction of the perturbation, we normalize the gradient of the Inception-v3 loss function relative to each neighboring image sample to obtain:

[0071]

[0072] in express The L2 norm value of .

[0073] So the average gradient of the M neighboring image samples on the rth radius is:

[0074]

[0075] Step 62: Take the average of the gradients of N different radii as the final gradient. In order to make the gradient of each radius have the same contribution to the optimization result, we need to average the gradients of each grad i,r Normalize, so the gradient generated by the image sample at the i-th iteration is:

[0076]

[0077] Step 63: Use the momentum-based gradient accumulation strategy to accumulate the gradient of the previous iteration and the gradient of the current iteration as the final gradient value n of the i-th iteration. i , to escape from the local optimum:

[0078]

[0079] Step 7: Get pixel perturbation and add it to the input image sample x i In. According to the gradient n i The sign function sign() can determine the perturbation direction of each pixel, multiply it by the corresponding step size as the perturbation generated by this round of iteration, and finally fine-tune the perturbation constraint E generated in step 5 on the perturbed image sample. E , Clip E Refers to truncating the image pixel values ​​that exceed the perturbation constraint range so that each pixel value satisfies the constraint E. Therefore, the image sample generated by this iteration is the input image sample x of the next iteration. i+1 for:

[0080] x i+1 =Clip E (x i +λ*sign(n i ))

[0081] Step 8: Determine whether the maximum number of iterations T has been reached. If so, proceed to step 9. Otherwise, repeat steps 6 to 8.

[0082] Step 9: Restore the generated image sample to the data form of the original image sample, that is, remap the pixel value from [-1.0, -1.0] back to [0, 255], and use the generated transferable image adversarial sample as a test case for the target model;

[0083] Step 10: Use the transferable image adversarial sample to test the ResNet152 model. Statistical analysis of the classification accuracy of the ResNet152 model on the clean image sample set ACRC clean And the classification accuracy ACRC on transferable adversarial image samples adv If ACRC clean with ACRC adv If the difference is less than the required security threshold Th = 0.5, it means that the security of the model is poor. Otherwise, it means that the security requirements are met and the model can be deployed after passing the test.

[0084] Based on the same inventive concept, an embodiment of the present invention provides a system for generating transferable image adversarial samples, including: a parameter configuration module for setting parameter information, including a maximum perturbation change value ε, a maximum number of iterations T, a number of perturbation radius types N of neighboring image samples, a number of neighboring image samples on each radius M, a radius coefficient β, a maximum proportional coefficient inter, and an attenuation coefficient μ; generating a perturbation step size λ = ε / T, an amplification coefficient α = λ × β for perturbation of neighboring image samples, and a set of proportional coefficients R for different neighboring perturbation radii relative to the amplification coefficient α; a constraint generation module for obtaining an input image sample and generating a perturbation constraint range for the image sample based on the relationship between each pixel and its surrounding pixels; and a sample generation module for iteratively generating transferable image adversarial samples of the input image sample according to the following steps: generating diverse neighboring image samples of the input image sample, calculating the gradient of the proxy model relative to the neighboring image samples, normalizing the gradient, taking the average of the gradient as the perturbation direction, and obtaining the perturbation of the current iteration according to the perturbation direction and the perturbation step size; wherein the jth neighboring image sample x on the rth radius in the i-th iteration round is i,r,j Represented as x i,r,j =x i +R(r)×α×p j; Add the generated perturbation to the input image sample, and fine-tune the perturbation-added image sample according to the perturbation constraint to make it meet the constraint condition, and obtain the intermediate image sample of the current round iteration; Determine whether the number of iterations reaches the maximum number of iterations T. If so, use the intermediate image sample obtained in the current round iteration as the transferable image adversarial sample; otherwise, use the intermediate image sample as the input again for the next round iteration.

[0085] Based on the same inventive concept, an embodiment of the present invention provides a deep neural network testing system based on transferable image adversarial samples, including various modules according to the described transferable image adversarial sample generation system, as well as: a preprocessing module for obtaining an image dataset and corresponding label information corresponding to the deep neural network to be tested; and reading the collected image dataset and labels, performing data preprocessing, and placing the processed image data into a clean image sample set; a proxy model training module for using the preprocessed training data to train a proxy model with the same function as the deep neural network model to be tested and save it; a test case generation module for obtaining an input image sample from a clean image sample set, and generating a transferable image adversarial sample of the image sample through the described transferable image adversarial sample generation system, and saving it in a transferable image adversarial sample data set as a test case; and a model testing module for using the test cases in the transferable image adversarial sample set to perform model testing on the target deep neural network model.

[0086] Based on the same inventive concept, an embodiment of the present invention provides a computer system, including a memory, a processor, and a computer program stored in the memory and runnable on the processor. When the computer program is loaded into the processor, it implements the method for generating transferable image adversarial samples, or the method for testing deep neural networks based on transferable image adversarial samples.

Claims

1. A method for generating transferable image adversarial samples, characterized in that: The steps include: Set parameter information, including the maximum perturbation change value ε, the maximum number of iterations T, the number of perturbation radius types N of neighboring image samples, the number M of neighboring image samples on each radius, the radius coefficient β, the maximum proportional coefficient inter, and the attenuation coefficient μ; generate the perturbation step size λ = ε / T, the magnification coefficient α = λ × β of the perturbation of the neighboring image samples, and the proportional coefficient group R of different neighboring perturbation radii relative to the magnification coefficient α; obtain the input image sample, and generate the perturbation constraint range of the image sample based on the relationship between each pixel and the surrounding pixels; Iteratively generate transferable image adversarial samples of input image samples according to the following steps: Generate diverse neighboring image samples of the input image sample, calculate the gradient of the proxy model relative to the neighboring image samples, normalize the gradient, take the average of the gradient as the perturbation direction, and obtain the perturbation of the current round of iteration based on the perturbation direction and perturbation step size; The jth nearest neighbor image sample x on the rth radius in the i-th iteration round i,r,j Represented as x i,r,j =x i +R(r)×α×p j , x i is the image sample input in the i-th iteration round, R(r) represents the r-th value of the proportional coefficient group R, p j is a random tensor that follows a uniform distribution and has the same size as the image sample; The generated perturbation is added to the input image sample, and the perturbation image sample is fine-tuned according to the perturbation constraint to make it meet the constraint condition, and the intermediate image sample of the current iteration is obtained; Determine whether the number of iterations reaches the maximum number of iterations T. If so, use the intermediate image sample obtained in the current round of iteration as the transferable image adversarial sample; otherwise, use the intermediate image sample as input again for the next round of iteration.

2. The method for generating transferable image adversarial samples according to claim 1, characterized in that: Generate the perturbation bounds for the image samples as follows: Get the neighborhood pixel values ​​of each pixel of the input image sample and sort them; The minimum value of the maximum value in the neighborhood pixels of each pixel of the input image sample is taken as the upper and lower limits of the current pixel perturbation, that is, the perturbation constraint of the pixel in the image.

3. The method for generating transferable image adversarial samples according to claim 1, characterized in that: The method for obtaining the perturbation of the current round iteration according to the gradient direction and the perturbation step size includes: Normalize the gradient of the proxy model relative to each neighboring image sample at each radius, calculate the average gradient of M neighboring image samples, and take the average of the gradients of N different radii in the i-th iteration as the final gradient grad i ; Using the momentum-based gradient accumulation strategy, the gradient of the previous iteration and the gradient of the current iteration are accumulated as the final gradient value n of the i-th iteration. i : According to the gradient value n i The sign function sign() is used to determine the perturbation direction of each pixel, and multiplied by the corresponding perturbation step size as the perturbation generated in this round of iteration.

4. The method for generating transferable image adversarial samples according to claim 1, wherein: R=Linspace(0,inter,N+1) Linspace means generating N+1 numbers with equal distance from 0 to inter.

5. A deep neural network testing method based on transferable image adversarial samples, characterized in that: The steps include: Obtain the image dataset and corresponding label information corresponding to the deep neural network to be tested; Read the collected image dataset and labels, perform data preprocessing, and put the processed image data into a clean image sample set; Use the preprocessed training data to train a proxy model with the same functionality as the deep neural network model to be tested and save it; Obtain an input image sample from a clean image sample set, and generate a transferable image adversarial sample of the image sample using the transferable image adversarial sample generation method according to claim 1, Save to the transferable image adversarial sample data set as test cases; Use the test cases in the transferable image adversarial sample set to test the target deep neural network model.

6. The method for testing deep neural networks based on transferable image adversarial samples according to claim 5, characterized in that: It also includes preprocessing the read image sample data and labels into the size and numerical range required by the model input; after adopting the transferable image adversarial sample generation method according to claim 1, restoring the data form of the original image sample as a test case.

7. The method for testing deep neural networks based on transferable image adversarial samples according to claim 5, characterized in that: When using transferable image adversarial samples to test the target model, the model performance indicators of the tested model on the clean image sample set and the model performance indicators on the transferable image adversarial samples are counted respectively. Whether the difference between the two accuracy rates is less than the specified threshold is used as an indicator to judge whether the tested model is safe and reliable.

8. A transferable image adversarial sample generation system, characterized by: include: The parameter configuration module is used to set parameter information, including the maximum perturbation change value ε, the maximum number of iterations T, the number of perturbation radius types N of neighboring image samples, the number of neighboring image samples on each radius M, the radius coefficient β, the maximum proportional coefficient inter, and the attenuation coefficient μ; generate the perturbation step size λ = ε / T, the magnification coefficient α = λ × β of the neighboring image sample perturbation, and the proportional coefficient group R of different neighboring perturbation radii relative to the magnification coefficient α; A constraint generation module is used to obtain an input image sample and generate a perturbation constraint range for the image sample based on the relationship between each pixel and its surrounding pixels; and a sample generation module for iteratively generating transferable image adversarial samples of the input image sample according to the following steps: generating diverse neighboring image samples of the input image sample, calculating the gradient of the proxy model relative to the neighboring image samples, normalizing the gradient, taking the average of the gradients as the perturbation direction, and obtaining the perturbation for the current iteration based on the perturbation direction and perturbation step size; The jth nearest neighbor image sample x on the rth radius in the i-th iteration round i,r,j Represented as x i,r,j =x i +R(r)×α×p j , x i is the image sample input in the i-th iteration round, R(r) represents the r-th value of the proportional coefficient group R, p j is a random tensor that obeys uniform distribution and has the same size as the image sample; the generated perturbation is added to the input image sample, and the perturbated image sample is fine-tuned according to the perturbation constraint to satisfy the constraint condition, and the intermediate image sample of the current round iteration is obtained; it is judged whether the number of iterations reaches the maximum number of iterations T. If so, the intermediate image sample obtained in the current round iteration is used as the transferable image adversarial sample, otherwise the intermediate image sample is re-input for the next round iteration.

9. A deep neural network testing system based on transferable image adversarial samples, characterized by: The system comprises the modules of the system for generating transferable image adversarial samples according to claim 8, and: The preprocessing module is used to obtain the image dataset and corresponding label information corresponding to the deep neural network to be tested; read the collected image dataset and labels, perform data preprocessing, and put the processed image data into a clean image sample set; The proxy model training module is used to train and save a proxy model with the same functionality as the deep neural network model to be tested using the preprocessed training data; A test case generation module is used to obtain an input image sample from a clean image sample set, and generate a transferable image adversarial sample of the image sample through the transferable image adversarial sample generation system, and save it to the transferable image adversarial sample data set as a test case; And a model testing module for testing the target deep neural network model using test cases in the transferable image adversarial sample set.

10. A computer system comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the computer program is loaded into a processor, it implements a method for generating transferable image adversarial samples according to any one of claims 1 to 4, or a deep neural network testing method based on transferable image adversarial samples according to any one of claims 5 to 7.

Images