A black box attack method and system based on meta-learning to counteract disturbances

Abstract

The present invention discloses a black box attack method and system based on meta-learning adversarial perturbation, wherein a meta-learning training data set D is input into a substitute model of a black box model, a loss function of the substitute model is calculated according to an output result of the substitute model and a preset target label, and a gradient descent update is performed on the initialization perturbation v according to the loss function to obtain a meta-adversarial perturbation v. * . Using the meta-adversarial perturbation v * A black box attack is performed. If the classification result of the black box model for the image sample is a preset target label, the attack is completed; if the classification result is not the preset target label, the image sample is updated, and the black box attack is continued using the updated image sample until the classification result is the preset target label. The meta-adversarial perturbation trained by the present invention selects a better initial position for the original image, greatly improving the query efficiency and attack success rate of the black box model, which is of great significance to improving the black box attack of the neural network.

Description

Technical Field

[0001] The present invention relates to the field of image recognition technology, and in particular to a black box attack method and system based on meta-learning against disturbance. Background Art

[0002] With the rapid development of deep learning technology, the field of image recognition has made continuous breakthroughs in research and application. The ability of deep convolutional neural networks to accurately recognize objects has even surpassed human performance. More and more deep models are being put into use, such as face recognition, autonomous driving, pedestrian monitoring, etc. It can be said that deep learning technology has brought revolutionary progress to computer vision and machine learning, and deep neural networks are also affecting people's daily lives in all aspects.

[0003] However, while deep neural networks shine in many tasks, they also expose serious security risks. A large number of studies have shown that deep neural networks are easily attacked by adversarial samples, which leads to incorrect prediction results, which is very fatal in some tasks with high security requirements. The adversarial samples that perform attacks refer to samples that cause the neural network to produce misclassified samples by adding small perturbations that are difficult for humans to distinguish to the original input samples. Depending on whether the attacker understands the network structure and parameters of the deep model, adversarial attacks can be divided into white-box attacks and black-box attacks. Goodfellow et al. proposed a gradient-based white-box attack method in the literature (Explaining and harnessing Adversarial Examples. Computer Science, 2014.), called the fast gradient sign method (FGSM). This method obtains the adjustment direction of the adversarial perturbation by performing gradient descent on the loss function that determines the degree of category belonging, and then generates adversarial samples through a one-step update. Afterwards, inspired by the FGSM algorithm, a large number of white-box attack methods based on this idea have been proposed one after another. Compared with white-box attack conditions, deep models in most scenarios in real life are not open to users. Therefore, researchers have turned to studying attack methods under black-box conditions. Similar to the idea of ​​white-box attack, black-box attack is also based on gradient. The difference is that the attacker cannot directly obtain the exact gradient of the model, and can only obtain the approximate gradient of the black-box model through the zero-order optimization algorithm or substitute model. Pin-Yu Chen et al. proposed a gradient estimation method in the literature (ZOO: Zeroth Order Optimization Based Black-box Attacks to Deep Neural Networks without Training Substitute Models. ACM, 2017), called the zero-order optimization algorithm (ZOO). This method obtains the gradient by finite difference and uses the ADAM optimizer to iteratively update and generate adversarial samples. Subsequently, Chun-Chen Tu et al. used the encoding and decoding method in the literature (Autozoom: Autoencoder-based zeroth order optimization method for attacking black-box neural networks. CoRR) to reduce the input dimension, and used the RGF algorithm for gradient estimation to improve the query efficiency.

[0004] All the black-box algorithms listed above need to obtain the estimated value of the gradient by performing a large number of queries on the model. However, in many practical applications, the model usually limits the number of queries. Therefore, it is necessary to design an efficient black-box attack algorithm that can complete the attack task with fewer queries. In order to solve this problem, it is necessary to design an effective initial value of the adversarial perturbation. At the same time, this initial adversarial perturbation should have strong generalization ability and can be obtained through simple training. So far, there is no method that can effectively generate black-box adversarial perturbation initial values ​​that are highly generalized and easy to train, which can greatly improve the performance of black-box attacks. Summary of the invention

[0005] In view of this, the present invention provides a black-box attack method based on meta-learning against perturbations, which can improve the query efficiency and attack success rate of the black-box model.

[0006] The specific technical solution adopted by the present invention is as follows:

[0007] A black-box attack method based on meta-learning against perturbations, comprising:

[0008] The meta-learning training dataset D is input into the surrogate model of the black-box model, and the loss function of the surrogate model is calculated according to the output of the surrogate model and the preset target label. The initial perturbation v is updated by gradient descent according to the loss function to obtain the meta-adversarial perturbation v * ;

[0009] The element is subjected to the disturbance v * The image sample to be attacked is superimposed and input into the black box model for black box attack. If the classification result of the black box model for the image sample is the preset target label, the attack is completed. If the classification result of the black box model for the image sample is not the preset target label, the image sample is updated, and the black box attack is continued using the updated image sample until the classification result of the black box model for the image sample is the preset target label.

[0010] Furthermore, the initialization perturbation v is updated by gradient descent to obtain the meta-adversarial perturbation v * for:

[0011] a1. Select a dataset B from the meta-learning training dataset D, superimpose the initialization perturbation v with the dataset B and input them into the substitution model, calculate the loss function of the substitution model according to the output result of the substitution model and the preset target label, perform gradient descent update on the initialization perturbation v according to the loss function, and obtain the adaptation perturbation v';

[0012] a2. Select a data set B' from the meta-learning training data set D, superimpose the adapted perturbation v' and the data set B' and input them into the substitute model again, calculate the loss function of the substitute model according to the output result of the substitute model and the preset target label, perform gradient descent update on the adapted perturbation v' according to the loss function, and obtain the initial meta-adversarial perturbation v1;

[0013] a3, use the initial meta-adversarial perturbation v1 to replace the initialization perturbation v, repeat a1 and a2 until the number of iterations is equal to the preset training algebra epoch, end the training, and obtain the meta-adversarial perturbation v * .

[0014] Furthermore, the initial element adversarial perturbation v1 is projected, and the projected element adversarial perturbation v2 obtained after the projection is used to replace the initialization perturbation v.

[0015] Furthermore, the image samples are updated as follows:

[0016] b1. Use the zero-order optimization algorithm RGF algorithm to estimate the gradient of the black box model and obtain the gradient estimate of the black box model

[0017] b2, using the sign function to estimate the gradient Processing is performed to obtain the gradient estimate after the symbol function processing

[0018] b3, according to the gradient estimation value Set the learning rate lr, and use the difference between the current image sample and the previous image sample as the momentum term to update the image sample. The updated image sample is:

[0019]

[0020] Among them, x i Represents the current image sample, x i+1 represents the updated image sample, x i－1 Represents the previous image sample, and η represents the momentum term coefficient.

[0021] Furthermore, before updating the image sample, the current image sample x i Projection is performed, and the image samples are updated using the current image samples after projection.

[0022] A black-box attack system based on meta-learning against perturbations, including a perturbation training module, an attack module and an iterative update module;

[0023] The perturbation training module is used to input the meta-learning training data set D into the substitute model of the black box model, calculate the loss function of the substitute model according to the output result of the substitute model and the preset target label, and perform gradient descent update on the initial perturbation v according to the loss function to obtain the meta-adversarial perturbation v * ;

[0024] The attack module is used to counter the disturbance v * The image sample to be attacked is superimposed and input into the black box model for black box attack. If the classification result of the black box model for the image sample is the preset target label, the attack is completed; if the classification result of the black box model for the image sample is not the preset target label, the iterative update module is entered;

[0025] The iterative update module is used to update the image samples and send the updated image samples to the attack module to continue the black box attack until the classification result of the black box model for the image samples is a preset target label.

[0026] Furthermore, in the perturbation training module, the initial perturbation v is updated by gradient descent to obtain the meta-adversarial perturbation v * for:

[0027] a1. Select a dataset B from the meta-learning training dataset D, superimpose the initialization perturbation v with the dataset B and input them into the substitution model, calculate the loss function of the substitution model according to the output result of the substitution model and the preset target label, perform gradient descent update on the initialization perturbation v according to the loss function, and obtain the adaptation perturbation v';

[0028] a2. Select a data set B' from the meta-learning training data set D, superimpose the adapted perturbation v' and the data set B' and input them into the substitute model again, calculate the loss function of the substitute model according to the output result of the substitute model and the preset target label, perform gradient descent update on the adapted perturbation v' according to the loss function, and obtain the initial meta-adversarial perturbation v1;

[0029] a3, replace the initialization perturbation v with the initial meta-adversarial perturbation v1, repeat a1 and a2 until the number of iterations is equal to the preset training algebra epoch, end the training, and obtain the meta-adversarial perturbation v * .

[0030] Furthermore, the initial element adversarial perturbation v1 is projected, and the projected element adversarial perturbation v2 obtained after the projection is used to replace the initialization perturbation v.

[0031] Further, in the iterative update module, the image samples are updated as follows:

[0032] b1. Use the zero-order optimization algorithm RGF algorithm to estimate the gradient of the black box model and obtain the gradient estimate of the black box model

[0033] b2, using the fast gradient sign method FGSM to estimate the gradient Perform symbolic function processing to obtain the gradient estimate after symbolic function processing

[0034] b3, according to the gradient estimation value Set the learning rate lr, and use the difference between the current image sample and the previous image sample as the momentum term to update the image sample. The updated image sample is:

[0035]

[0036] Among them, x i Represents the current image sample, x i+1 represents the updated image sample, x i－1 Represents the previous image sample, and η represents the momentum term coefficient.

[0037] Furthermore, before updating the image sample, the current image sample x i Projection is performed, and the image samples are updated using the current image samples after projection.

[0038] Beneficial effects:

[0039] (1) A black-box attack method based on meta-learning adversarial perturbation. The trained meta-adversarial perturbation is used to perform black-box attacks. A better initial position is selected for the original image sample. Under black-box conditions, the query efficiency and attack success rate of the black-box model are greatly improved. At the same time, the generated meta-adversarial perturbation can be transferred between different data sets. It is an initial adversarial perturbation with high generalization ability and easy training, which is of great significance to improving the black-box attack of neural networks.

[0040] (2) In the process of training meta-adversarial perturbations, only a small amount of training data is needed to obtain meta-adversarial perturbations with high generalization performance, which effectively solves the difficulty of collecting data in real scenarios and improves training efficiency. The training process of meta-adversarial perturbations takes less time and data cost to obtain high-quality initial adversarial perturbations.

[0041] (3) The initial meta-adversarial perturbation is projected and the projected meta-adversarial perturbation is used to replace the original perturbation. This can ensure that the meta-adversarial perturbation is limited to the allowed norm value, thereby ensuring that the image sample after superimposing the adversarial perturbation will not produce significant distortion.

[0042] (4) In the sample update process of black-box attack, the introduction of momentum term can further improve the efficiency and accuracy of black-box attack, accelerate the attack and reduce the number of queries to the black-box model to a certain extent.

[0043] (5) Projecting the current image sample and using the projected current image sample to update the image sample can prevent the distortion scale between the updated image sample and the original image sample from being too large, thereby ensuring that the adversarial sample image is not easily detected.

[0044] (6) A black-box attack method based on meta-learning adversarial perturbation opens up new research ideas for black-box attacks. Through the meta-learning method, based on the good transferability of adversarial samples, a universal adversarial perturbation is trained, and a better initial perturbation value is selected for the black-box attack. In the black-box attack environment, different black-box attack algorithms can use the meta-adversarial perturbation trained by this method as the initial condition, thereby accelerating the attack. Since the meta-adversarial perturbation trained by this method also has good cross-dataset transferability, the perturbation can also be used in different data sets to achieve the purpose of accelerating the attack. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 This is a meta-adversarial perturbation training flow chart of a black-box attack method based on meta-learning adversarial perturbation of the present invention.

[0046] Figure 2 This is a flow chart of a black-box attack method based on meta-learning to counteract perturbations of the present invention.

[0047] Figure 3 This is a diagram showing the actual attack operation effect of a black-box attack method based on meta-learning against perturbations of the present invention. DETAILED DESCRIPTION

[0048] A black-box attack method and system based on meta-learning adversarial perturbation, which inputs the meta-learning training data set D into the substitute model of the black-box model, calculates the loss function of the substitute model according to the output result of the substitute model and the preset target label, and performs gradient descent update on the initial perturbation v according to the loss function to obtain the meta-adversarial perturbation v * . Using the meta-adversarial perturbation v * Perform a black-box attack. If the output value of the black-box model is equal to the target label value of the attack target, the attack is completed; if not, the image sample to be attacked is updated, and the updated image sample and the meta-adversarial perturbation v are used. *The black box attack is continued until the output value of the black box model is equal to the target label value of the attack target. The meta-adversarial perturbation trained by the present invention selects a better initial position for the original image, greatly improving the query efficiency and attack success rate of the black box model, which is of great significance to improving the black box attack of the neural network.

[0049] The present invention is described in detail below with reference to the accompanying drawings and embodiments.

[0050] The black box attack in the present invention is mainly carried out for the target attack under the black box condition. The target attack requires that the generated adversarial samples are classified into the specified category by the classifier. For relatively simple non-target attacks, the present invention is also applicable, and only minor adjustments need to be made during the attack process. Therefore, the following mainly takes the target attack as an example.

[0051] like Figure 1 As shown in the figure, first, meta-learning technology is used to generate meta-adversarial perturbations, and the meta-learning training dataset D is input into the substitute model of the black-box model. The loss function of the substitute model is calculated according to the output result of the substitute model and the preset target label. The initial perturbation v is updated by gradient descent according to the loss function to obtain the meta-adversarial perturbation v * Among them, the initial perturbation v is updated by gradient descent to obtain the meta-adversarial perturbation v * The specific steps include:

[0052] a1. Select dataset B from the meta-learning training dataset D, and obtain the adapted perturbation v' based on the initialization perturbation v and dataset B.

[0053] First prepare the meta-learning training dataset D and alternative models M1, M2, ..., M n , randomly initialize the perturbation v∈R d , set the target label value t of the target attack, and set the training algebra epoch; where R represents the real number field, and d is the dimension of the input image sample.

[0054] Select a small batch of data sets B from the data set D, superimpose the perturbation v on the data B, and the data set becomes B+v, which is input into each alternative model M respectively i (i=1,...,n), obtain the output of each model, and calculate the loss function value L(M) corresponding to each alternative model. i ,B+v,t), where the loss function can be a cross entropy loss function, a marginal loss function, etc. The cross entropy loss function is used in the present invention.

[0055] Since the alternative models are known and are all white-box models, we can directly use gradient backpropagation to obtain the derivative of the loss function L with respect to the perturbation v And use the learning rate α to perform gradient descent update on the disturbance v to obtain the adaptive disturbance v';

[0056]

[0057] The learning rate α is a hyperparameter that is adjusted as needed during training.

[0058] a2. Select dataset B' from the meta-learning training dataset D, and obtain the initial meta-adversarial perturbation v1 based on the adapted perturbation v' and dataset B'.

[0059] The adaptation disturbance v' is superimposed on the data B', and the data set becomes B'+v', which is also input into each alternative model M i (i=1,...,n), calculate the loss function value L(M) corresponding to each alternative model i ,B'+v',t), and obtain the derivative of the loss function L to the adaptive perturbation v' through gradient back propagation And use the learning rate β to perform gradient descent update on the initial perturbation v to obtain the meta-adversarial perturbation v;

[0060]

[0061] It should be noted here that the first thing obtained is the adaptive perturbation v', and the parameter updated in this step is the initial perturbation v, which is also one of the main features of meta-learning technology. In subsequent iterative training, the initial perturbation is no longer reset, and the last updated result is used as the current initial value.

[0062] a3. Replace the original perturbation v with the initial meta-adversarial perturbation v1, repeat a1 and a2 until the number of iterations is equal to the preset training algebra epoch, end the training, and obtain the meta-adversarial perturbation v * .

[0063] After updating the adversarial perturbation in each iteration, a projection operation is performed on it, which is expressed as follows:

[0064] v2=Π ε (v * )

[0065] Where Π represents the projection operation function, ε represents the norm value allowed by the adversarial perturbation, v2 represents the projection element adversarial perturbation, and v * represents the meta-adversarial perturbation after iterative update. The meta-adversarial perturbation after each iterative update and the final meta-adversarial perturbation are both represented by v * The projection operation ensures that the adversarial perturbation is limited to the allowed norm value, thereby ensuring that the image after superimposing the adversarial perturbation will not produce significant distortion.

[0066] After the initial element adversarial perturbation v1 is projected, the projected element adversarial perturbation v2 obtained after the projection is used to replace the original perturbation v.

[0067] When the number of iterations does not exceed the training epoch, iteration can finally obtain a universal meta-adversarial perturbation with strong adaptability and attack performance, which can be saved so that it can be called at any time when performing a black box attack.

[0068] The above steps have completed the training of the meta-adversarial perturbation, and the meta-adversarial perturbation at this time has a strong ability to resist attacks. In the process of executing the black box attack, firstly, the saved meta-adversarial perturbation v * Load it, then import the original image x, and use the trained element to perturb v * Superimposed on the original image, the image becomes x'=x+v * It has strong adversarial capabilities, and some image samples can successfully attack the target. The image with superimposed meta-adversarial perturbations is input into the black box model f θ , and get the output f of the black box model θ (x,y). If the black box model outputs f θ (x, y) = t, it proves that the current image has successfully achieved the target attack task, and no subsequent steps are required, and the attack ends; otherwise, the image sample to be attacked is updated, and the updated image sample and the meta-adversarial perturbation v are used. * The black box attack continues until the output value of the black box model is equal to the target label value of the attack target or the number of queries to the black box model exceeds a preset value, and the iteration ends.

[0069] Update the current image sample to be attacked as follows:

[0070] b1. Use the zero-order optimization algorithm RGF algorithm to estimate the gradient of the black box model and obtain the gradient estimate of the black box model

[0071] The main operation steps of the RGF algorithm are as follows: randomly select q unit vectors on the d-dimensional (d is the input image dimension) unit sphere, select the smoothing coefficient σ, and you can get the estimated value of the black box model gradient. To perform a zero-order optimization gradient estimation on the black box model, you need to query the model q+1 times. Therefore, the more times the zero-order optimization gradient estimation is performed, the more times the black box model needs to be queried, and the lower the query efficiency. Through the above formula, the gradient value of the model for the input sample can be estimated, and this gradient value will be used in subsequent attacks.

[0072] b2. Use the fast gradient sign method FGSM to estimate the gradient Perform symbolic function processing to obtain the gradient estimate after symbolic function processing

[0073] Estimate the gradient value by using the sign function For processing, the symbolic function formula is as follows:

[0074]

[0075] It can be seen from the above formula that after the gradient value is processed by the sign function, the part greater than 0 is unified as 1, the part less than 0 is unified as -1, and the part equal to 0 remains 0. The reason for adopting such an operation is, on the one hand, to speed up the convergence speed, and on the other hand, because the gradient estimated by the zero-order optimization algorithm is not the real gradient, and its gradient value is still inaccurate. Therefore, using the sign function to integrate it can reduce the uncertainty of the gradient estimation to a certain extent.

[0076] b3, based on the gradient estimate Set the learning rate lr, and use the difference between the current image sample and the previous image sample as the momentum term to update the image sample. The updated image sample is:

[0077]

[0078] Among them, x i Represents the current image sample, x i+1 represents the updated image sample, x i－1 Represents the previous image sample, and η represents the momentum term coefficient.

[0079] Before updating the image sample, the current image sample x i Perform projection and update the image samples using the current image samples after projection.

[0080] The projection can be selected as L2 norm or L ∞ The projection method such as the norm is used to ensure that the disturbance is within the preset range, thereby controlling the distortion scale between the adversarial sample and the original image. When the classification result of the black box model for image x becomes the target label t, the attack is successful; when the attack is successful or the number of queries to the black box model exceeds the preset value, the iteration ends.

[0081] like Figure 3 As shown, the image size on the CIFAR10 dataset is 32×32×3. Figure 3 (a) is the original input sample, Figure 3 (b) is the meta-adversarial perturbation trained by the present invention, Figure 3(c) is the adversarial sample generated by superimposing the meta-adversarial perturbation on the original image. This sample can be classified into the specified target label category by the deep model and can successfully perform the black-box attack task.

[0082] According to the above-mentioned black-box attack method based on meta-learning against perturbations, the present invention also provides a black-box attack system based on meta-learning against perturbations, including a perturbation training module, an attack module and an iterative update module.

[0083] The perturbation training module is used to train the dataset D and n alternative models M1, M2, ..., M according to the meta-learning n Train to obtain the meta-adversarial perturbation v * ; Where n is a positive integer.

[0084] The attack module is used to exploit the meta-adversarial perturbation v * A black-box attack is performed, and the output value of the black-box model is equal to the target label value of the attack target. If they are equal, the attack is completed. If they are not equal, the iterative update module is entered.

[0085] The iterative update module is used to update the image samples to be attacked, and send the updated image samples to the attack module to continue the black-box attack until the output value of the black-box model is equal to the target label value of the attack target.

[0086] In the perturbation training module, the meta-adversarial perturbation v * The training process is:

[0087] a1. Select dataset B from the meta-learning training dataset D, and obtain the adapted perturbation v' based on the original perturbation v and dataset B;

[0088] a2. Select dataset B' from the meta-learning training dataset D, and obtain the initial meta-adversarial perturbation v1 based on the adapted perturbation v' and dataset B';

[0089] a3. Replace the original perturbation v with the initial meta-adversarial perturbation v1, repeat a1 and a1 until the number of iterations is equal to the preset training algebra epoch, end the training, and obtain the meta-adversarial perturbation v * .

[0090] The initial element adversarial perturbation v1 is projected, and the projected element adversarial perturbation v2 obtained after projection is used to replace the original perturbation v.

[0091] In the iterative update module, the image sample to be attacked is updated as follows:

[0092] b1. Use the zero-order optimization algorithm RGF algorithm to estimate the gradient of the black box model and obtain the gradient estimate of the black box model

[0093] b2. Use the fast gradient sign method FGSM to estimate the gradient Perform symbolic function processing to obtain the gradient estimate after symbolic function processing

[0094] b3, based on the gradient estimate Set the learning rate lr, and use the difference between the current image sample and the previous image sample as the momentum term to update the image sample. The updated image sample is:

[0095]

[0096] Among them, x i Represents the current image sample, x i+1 represents the updated image sample, x i－1 Represents the previous image sample, and η represents the momentum term coefficient.

[0097] Before updating the image sample, the current image sample x i Perform projection and update the image samples using the current image samples after projection.

[0098] The present invention provides a black-box attack method and system for meta-learning adversarial perturbations. Through the meta-learning technology, a small amount of data is used to train the meta-adversarial perturbation in the substitution model, and the trained meta-adversarial perturbation is superimposed on the original sample. Then, the RGF algorithm is used in the black-box model to perform zero-order optimization gradient estimation. Finally, the FGSM algorithm is used to iteratively update the input samples and a momentum term is introduced to accelerate the convergence speed, thereby realizing efficient black-box attack.

[0099] The above specific embodiments only describe the design principle of the present invention. The shapes and names of the components in the description may be different and are not limited. Therefore, those skilled in the art in the field of the present invention may modify or replace the technical solutions recorded in the above embodiments; and these modifications and replacements do not deviate from the creative purpose and technical solutions of the present invention and should all fall within the protection scope of the present invention.

Claims

1. A black-box attack method based on meta-learning against perturbations, characterized in that: include: The meta-learning training dataset D is input into the surrogate model of the black-box model, and the loss function of the surrogate model is calculated according to the output of the surrogate model and the preset target label. The initial perturbation v is updated by gradient descent according to the loss function to obtain the meta-adversarial perturbation v * ; The element is subjected to the disturbance v * The image sample to be attacked is superimposed and input into the black box model for black box attack. If the classification result of the black box model for the image sample is the preset target label, the attack is completed; if the classification result of the black box model for the image sample is not the preset target label, the image sample is updated, and the black box attack is continued using the updated image sample until the classification result of the black box model for the image sample is the preset target label; The initial perturbation v is updated by gradient descent to obtain the meta-adversarial perturbation v * for: a1. Select a dataset B from the meta-learning training dataset D, superimpose the initialization perturbation v with the dataset B and input them into the substitution model, calculate the loss function of the substitution model according to the output result of the substitution model and the preset target label, perform gradient descent update on the initialization perturbation v according to the loss function, and obtain the adaptation perturbation v'; a2. Select a data set B' from the meta-learning training data set D, superimpose the adapted perturbation v' and the data set B' and input them into the substitute model again, calculate the loss function of the substitute model according to the output result of the substitute model and the preset target label, perform gradient descent update on the adapted perturbation v' according to the loss function, and obtain the initial meta-adversarial perturbation v1; a3, replace the initialization perturbation v with the initial meta-adversarial perturbation v1, repeat a1 and a2 until the number of iterations is equal to the preset training algebra epoch, end the training, and obtain the meta-adversarial perturbation v * ; The image samples are updated as follows: b1. Use the zero-order optimization algorithm RGF algorithm to estimate the gradient of the black box model and obtain the gradient estimate of the black box model b2. Use a sign function to estimate the gradient Processing is performed to obtain the gradient estimate after the symbol function processing b3, according to the gradient estimation value Set the learning rate lr, and use the difference between the current image sample and the previous image sample as the momentum term to update the image sample. The updated image sample is: Among them, x i Represents the current image sample, x i+1 represents the updated image sample, x i－1 Represents the previous image sample, and η represents the momentum term coefficient.

2. The black box attack method according to claim 1, characterized in that: The initial element adversarial perturbation v1 is projected, and the projected element adversarial perturbation v2 obtained after the projection is used to replace the initialization perturbation v.

3. The black box attack method according to claim 1, characterized in that: Before updating the image sample, the current image sample x i Projection is performed, and the image samples are updated using the current image samples after projection.

4. A black-box attack system based on meta-learning against perturbations, characterized in that: Includes perturbation training module, attack module and iterative update module; The perturbation training module is used to input the meta-learning training data set D into the substitute model of the black box model, calculate the loss function of the substitute model according to the output result of the substitute model and the preset target label, and perform gradient descent update on the initial perturbation v according to the loss function to obtain the meta-adversarial perturbation v * ; The attack module is used to counter the disturbance v * The image sample to be attacked is superimposed and input into the black box model for black box attack. If the classification result of the black box model for the image sample is the preset target label, the attack is completed; if the classification result of the black box model for the image sample is not the preset target label, the iterative update module is entered; The iterative update module is used to update the image samples and send the updated image samples to the attack module to continue the black box attack until the classification result of the black box model for the image samples is a preset target label; In the perturbation training module, the initial perturbation v is updated by gradient descent to obtain the meta-adversarial perturbation v * for: a1. Select a dataset B from the meta-learning training dataset D, superimpose the initialization perturbation v with the dataset B and input them into the substitution model, calculate the loss function of the substitution model according to the output result of the substitution model and the preset target label, perform gradient descent update on the initialization perturbation v according to the loss function, and obtain the adaptation perturbation v'; a2. Select a data set B' from the meta-learning training data set D, superimpose the adapted perturbation v' and the data set B' and input them into the substitute model again, calculate the loss function of the substitute model according to the output result of the substitute model and the preset target label, perform gradient descent update on the adapted perturbation v' according to the loss function, and obtain the initial meta-adversarial perturbation v1; a3, replace the initialization perturbation v with the initial meta-adversarial perturbation v1, repeat a1 and a2 until the number of iterations is equal to the preset training algebra epoch, end the training, and obtain the meta-adversarial perturbation v * ; In the iterative update module, the image samples are updated as follows: b1. Use the zero-order optimization algorithm RGF algorithm to estimate the gradient of the black box model and obtain the gradient estimate of the black box model b2, using the fast gradient sign method FGSM to estimate the gradient Perform symbolic function processing to obtain the gradient estimate after symbolic function processing b3, according to the gradient estimation value Set the learning rate lr, and use the difference between the current image sample and the previous image sample as the momentum term to update the image sample. The updated image sample is: Among them, x i Represents the current image sample, x i+1 represents the updated image sample, x i－1 Represents the previous image sample, and η represents the momentum term coefficient.

5. The black box attack system according to claim 4, characterized in that: The initial element adversarial perturbation v1 is projected, and the projected element adversarial perturbation v2 obtained after the projection is used to replace the initialization perturbation v.

6. The black box attack system according to claim 4, characterized in that: Before updating the image sample, the current image sample x i Projection is performed, and the image samples are updated using the current image samples after projection.

Images