A method for generating image adversarial samples based on generative adversarial networks

Abstract

The present invention relates to a method for generating image adversarial samples based on a generative adversarial network, which comprises the following steps: preprocessing the collected images; randomly initializing the generator G and the discriminators D1 and D2; inputting the processed image x into the generator G of the generative adversarial network GAN to obtain an initial perturbation vector ε=G(x; θ g ); obtain adversarial samples about the image x; train discriminators D1, D2 and generator G; save generator G; the image preprocessed in step 1 is input to generator G to obtain the perturbation vector of the image, and the adversarial sample of the image is generated after step 4; the present invention can efficiently generate adversarial samples for any black box model; using a dual discriminator structure, the trained discriminator D1 can successfully serve as a proxy model for the target model T, which reduces the number of queries to the target model T to a certain extent; the discriminator D2 is used to constrain the generated perturbation to ensure the visual quality of the adversarial sample.

Description

Technical Field

[0001] The present invention relates to a method for generating image adversarial samples based on a generative adversarial network, and belongs to the fields of machine learning, computer vision, and AI security. Background Art

[0002] Deep Neural Networks (DNNs) have achieved remarkable results in a wide range of applications, including image classification and recognition, speech processing, text classification, and malware detection. However, in 2014, Szeged et al. made an interesting discovery: nearly all known machine learning models, including state-of-the-art DNNs, are vulnerable to adversarial attacks using high-dimensional inputs. Adversarial attacks involve designing imperceptible changes to the original sample, causing the model to output erroneous results with high confidence.

[0003] In black-box attack scenarios, query-based black-box attacks can achieve a high success rate, but they require a large amount of query computation, and the query results are not fully utilized. Therefore, efficient query execution remains a research focus in this field. Transfer-based black-box attacks transfer adversarial examples generated by the source model to the target model for attack. However, the significant differences between the source and target models make this type of attack less successful. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a method for generating image adversarial samples based on a generative adversarial network, thereby training a proxy model that can highly simulate the target model, thereby improving the transferability of adversarial samples and generating adversarial samples that can deceive the target model; a dual-discriminator structure is used in the generative adversarial network to constrain the generated adversarial perturbations, so as to improve the attack success rate on the target model and the visual quality of the adversarial samples; the present invention is applicable to the setting of untargeted black-box attacks based on score queries, and can be extended to targeted attack scenarios.

[0005] In order to solve the above technical problems, the technical solutions adopted by the present invention are as follows:

[0006] The present invention provides a method for generating image adversarial samples based on a generative adversarial network, which adopts the following steps:

[0007] Step 1: Preprocess the collected images;

[0008] Step 2: Randomly initialize the generator G and discriminators D1, D2;

[0009] Step 3: Input the image x processed in step 1 into the generator G of the generative adversarial network GAN to obtain the initial perturbation vector ε = G(x; θ g), where θ g Represents the parameters of the generator G;

[0010] Step 4: Get the adversarial sample for image x;

[0011] Step 5: Train the discriminators D1 and D2.

[0012] Step 6: Train the generator G.

[0013] Step 7: If the loss functions of the generator G and the discriminators D1 and D2 described in steps 5 and 6 converge, stop training and proceed to step 8; otherwise, repeat steps 3-6;

[0014] Step 8. Save the generator G;

[0015] Step 9: The image preprocessed in step 1 is input to the generator G to obtain the perturbation vector of the image. After step 4, the adversarial sample of the image is generated.

[0016] The steps for obtaining the adversarial sample in step 4 of the present invention are as follows:

[0017] 4.1) Clip the perturbation vector ε from step 3 to obtain the perturbation vector ε′=clip(ε,α1,α2), where α1 and α2 are the lower and upper bounds of the clipping, and clip(·) is the clipping function. The specific calculation formula is as follows:

[0018]

[0019] 4.2) Add the modified perturbation vector ε′ to the original sample x to obtain the initial adversarial sample x′, x′=x+ε′;

[0020] 4.3) To ensure that the final adversarial sample is within the ∈ neighborhood of the original sample x, the initial adversarial sample x′ is cropped to obtain the final adversarial sample x adv , the calculation formula is as follows:

[0021]

[0022] in,‖·‖ p represents the p-norm, ∈ is the upper bound of the perturbation.

[0023] Step 5 of the present invention specifically adopts the following steps:

[0024] 5.1) The adversarial sample x adv Input it into the target model T together with the original sample x, and obtain the target model T for the adversarial sample x adv The query result T0(x adv ) and the query result T0(x) for the original sample x;

[0025] 5.2). Set T0(x adv ) and T0(x) are converted into corresponding category labels T(x adv ) and T(x), the query result T0(x adv ) and T0(x) are first passed through the softmax function to obtain the probability value of each category, and then the category label with the largest probability value is selected as T(x adv ) and T(x);

[0026] 5.3). Change (x,T(x)), (x adv ,T(x adv )) is used as training data to input the discriminator D1 and calculate the loss function To update the discriminator D1;

[0027] 5.4). The adversarial sample x adv And the original sample x is used as training data to input the discriminator D2, and the loss function is calculated To update the discriminator D2.

[0028] The specific operation of step 5.3) of the present invention is as follows:

[0029] 5.3.1) The adversarial sample x adv The label value T(x adv ), as well as the label value T(x) corresponding to the query result of the original sample x and the target model T on the original sample, are passed as input to the discriminator D1 of the generative adversarial network GAN. The discriminator D1 is used to fit the target model T, and the loss function formula of the discriminator D1 is defined as:

[0030]

[0031] Among them, x adv is the adversarial sample of the original sample x, T(x adv ) indicates that the adversarial sample x adv The query result obtained by inputting the target model T is converted into the label value. T(x) represents the label value converted from the query result obtained by inputting the original sample x into the target model T. d1 Denotes the model parameters of the discriminator D1, D1(x adv θ d1 ) represents the discriminator D1 for the adversarial sample x adv The output result, D1(x; θ d1 ) represents the output of the discriminator D1 for the original sample x, Entropy(a,b) represents the cross entropy function of a and b, and β is the training weight;

[0032] 5.3.2) During the training of the discriminator D1, in order to reduce the number of queries to the target model T while ensuring that the discriminator D1 fits the target model T well, the training of the discriminator D1 is divided into two stages: pre-training and fine-tuning.

[0033] 5.3.3) When pre-training and fine-tuning the discriminator D1, the following formula is used to update the discriminator D1:

[0034]

[0035] in, represents the parameters of the discriminator D1 obtained after the i-th iteration, represents the parameters of the discriminator D1 obtained after the i+1th iteration, η1 is the learning rate of the discriminator D1, is the loss function About parameters gradient.

[0036] Step 5.4) of the present invention specifically adopts the following steps:

[0037] 5.4.1). In order to ensure that the adversarial sample x adv The visual quality of the adversarial sample is improved, so that the adversarial sample can be more similar to the original sample. The discriminator D2 is used to judge the authenticity of the sample. If the sample is the original sample, it is true and the label is 1; if the sample is the adversarial sample, it is false and the label is 0. adv And the original sample x is input into the discriminator D2 as training data. The loss function formula of the discriminator D2 is:

[0038]

[0039] Among them, P data (x) is the data distribution of the original image x, E is the mathematical expectation of the expression, D2(x; θ d2 ) represents the output of the discriminator D2 for the original sample x, D2(x adv θ d2 ) represents the discriminator D2 for the adversarial sample x adv The output result, θ d2 represents the model parameters of the discriminator D2;

[0040] 5.4.2) The operation of updating the discriminator D2 is as follows:

[0041]

[0042] in, represents the parameters of the discriminator D2 obtained after the i-th iteration, represents the parameters of the discriminator D2 obtained after the i+1th iteration, η2 is the learning rate of the discriminator D2, is the loss function About parameters gradient.

[0043] The specific operation of training the generator G in step 6 of the present invention adopts the following steps:

[0044] 6.1) Discriminator D1 on adversarial sample x adv The output result D1(x adv θ d1 ) is returned to the generator G. For untargeted attacks, the loss function of the generator G with respect to the discriminator D1 is defined as:

[0045]

[0046] Among them, y represents the label of the true category;

[0047] 6.2) In order to make the generated adversarial samples close to the real data distribution, a discriminator D2 is set to distinguish the authenticity of the samples; the discriminator D2 is used for the adversarial sample x adv The output result D2(x adv θ d2 ) is returned to the generator G. The loss function formula of the generator G with respect to the discriminator D2 is defined as:

[0048]

[0049] Among them, x adv Represents the adversarial sample, that is, x adv =Clip x,∈ (clip(G(x;θ g ),α1,α2)+x,x), where: clip(·) and Clip x,∈ (·) is the clipping function to ensure that the generated adversarial sample x adv In the ∈ neighborhood of the original sample x, α1, α2 are the cropping boundaries;

[0050] 6.3) For untargeted attacks, the goal is to maximize the distance between the target model’s predicted category and the true category; for targeted attacks, the goal is to minimize the distance between the target model’s predicted category and the target category. The target loss function is:

[0051]

[0052] in, represents the predicted probability of the target category by the discriminator D1 in a targeted attack or the predicted probability of the true category in an untargeted attack, Represents the maximum value of the predicted probability of other categories by the discriminator D1;

[0053] 6.4) The objective function of training the generator G is:

[0054]

[0055] Among them, γ1, γ2, and γ3 are the weight coefficients of the three losses, which control the relative importance of the three losses; The generated adversarial samples can gradually deceive the discriminator D1 and then migrate to the target model; This makes the generated adversarial samples closer to the real data distribution and produces better visual effects; att To attack the loss, optimize it to produce better attack effects;

[0056] 6.5) The operation of updating the generator G is as follows:

[0057]

[0058] in, represents the parameters of the generator G obtained after the i-th iteration, represents the parameters of the generator G obtained after the i+1th iteration, η is the learning rate of the generator G, is the loss function L with respect to the parameter gradient.

[0059] In step 5.3.2) of the present invention:

[0060] When the number of iterations iter≤n, the discriminator D1 is pre-trained; when the number of iterations iter>n and iter mod m=0, the discriminator D1 is fine-tuned; in other cases, the discriminator D1 model parameters remain unchanged.

[0061] The technical effects achieved by adopting the above technical solution are:

[0062] The present invention adopts a dual-discriminator structure in a generative adversarial network, which can efficiently generate adversarial samples for any black-box model. While ensuring that the generated adversarial samples effectively attack the machine learning-based image classification model, the generated adversarial samples are restricted to the ∈ neighborhood of the original samples. The discriminator D1 is trained in a pre-training followed by fine-tuning mode. The trained discriminator D1 can successfully serve as a proxy model for the target model T, which reduces the number of queries on the target model T to a certain extent. The discriminator D2 is used to constrain the generated perturbations, ensuring the visual quality of the adversarial samples. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 It is a flow chart of the method of the present invention. DETAILED DESCRIPTION

[0064] The present invention will be further described in detail below with reference to the accompanying drawings;

[0065] like Figure 1 As shown, the present invention provides a method for generating image adversarial samples based on a generative adversarial network, comprising the following steps:

[0066] Step 1: Preprocess the collected images to convert the data into tensor and normalize them. This paper uses the third-party library torchvision.transforms.ToTensor() to convert the data type into tensor and normalize the grayscale range from 0-255 to [0,1].

[0067] Step 2: Randomly initialize the generator G and discriminator D1, D2;

[0068] Step 3: Input the image x processed in step 1 into the generator G of the generative adversarial network GAN to obtain the initial perturbation vector ε = G(x; θ g ), where θ g Represents the parameters of the generator G;

[0069] Step 4: Get the adversarial example for image x. The specific steps are as follows:

[0070] 4.1) Clip the perturbation vector ε from step 3 to obtain the perturbation vector ε′ = clip(ε,α1,α2), where α1 and α2 are the lower and upper bounds of the clipping, and clip(·) is the clipping function, calculated as follows:

[0071]

[0072] 4.2) Add the modified perturbation vector ε′ to the original sample x to obtain the initial adversarial sample x′, x′=x+ε′;

[0073] 4.3) To ensure that the final adversarial sample is within the ∈ neighborhood of the original sample x, the initial adversarial sample x′ is cropped to obtain the final adversarial sample x adv , the calculation formula is as follows:

[0074]

[0075] in,‖·‖ p represents the p-norm, ∈ is the upper bound of perturbation;

[0076] Step 5: Train the discriminators D1 and D2. The specific steps are as follows:

[0077] 5.1) The adversarial sample x adv Input it into the target model T together with the original sample x, and obtain the target model T for the adversarial sample x adv The query result T0(x adv ) and the query result T0(x) for the original sample x;

[0078] 5.2) T0(x adv ) and T0(x) are converted into corresponding category labels T(x adv ) and T(x), the query result T0(x adv ) and T0(x) are first passed through the softmax function to obtain the probability value of each category, and then the category label with the largest probability value is selected as T(x adv ) and T(x);

[0079] 5.3) (x, T(x)), (x adv ,T(x adv )) is used as training data to input the discriminator D1 and calculate the loss function L D1 To update the discriminator D1, the specific operation is as follows:

[0080] 5.3.1) The adversarial sample x adv The label value T(x adv ), as well as the label value T(x) corresponding to the query result of the original sample x and the target model T on the original sample, are passed as input to the discriminator D1 of the generative adversarial network GAN. The discriminator D1 is used to fit the target model T, and the loss function formula of the discriminator D1 is defined as:

[0081]

[0082] Among them, x adv is the adversarial sample of the original sample x, T(x adv ) indicates that the adversarial sample x adv The query result obtained by inputting the target model T is converted into the label value. T(x) represents the label value converted from the query result obtained by inputting the original sample x into the target model T. d1 Denotes the model parameters of the discriminator D1, D1(x adv θ d1 ) represents the discriminator D1 for the adversarial sample x adv The output result, D1(x; θ d1 ) represents the output of the discriminator D1 for the original sample x, Entropy(a,b) represents the cross entropy function of a and b, and β is the training weight;

[0083] 5.3.2) During the training of the discriminator D1, in order to reduce the number of queries to the target model T while ensuring that the discriminator D1 fits the target model T well, the training of the discriminator D1 is divided into two stages: pre-training and fine-tuning:

[0084] When the number of iterations iter≤n, the discriminator D1 is pre-trained; when the number of iterations iter>n and iter mod m=0, the discriminator D1 is fine-tuned; in other cases, the model parameters of the discriminator D1 remain unchanged;

[0085] 5.3.3) When pre-training and fine-tuning the discriminator D1, the following formula is used to update the discriminator D1:

[0086]

[0087] in, represents the parameters of the discriminator D1 obtained after the i-th iteration, represents the parameters of the discriminator D1 obtained after the i+1th iteration, η1 is the learning rate of the discriminator D1, is the loss function About parameters gradient;

[0088] 5.4) The adversarial sample x adv And the original sample x is used as training data to input the discriminator D2, and the loss function is calculated To update the discriminator D2; specifically, the following steps are taken:

[0089] 5.4.1) To ensure that the generated adversarial sample x adv The visual quality of the adversarial sample is improved, so that the adversarial sample can be more similar to the original sample. The discriminator D2 is used to judge the authenticity of the sample. If the sample is the original sample, it is true and the label is 1; if the sample is the adversarial sample, it is false and the label is 0. adv And the original sample x is input into the discriminator D2 as training data. The loss function formula of the discriminator D2 is:

[0090]

[0091] Among them, P data (x) is the data distribution of the original image x, E is the mathematical expectation of the expression, D2(x; θ d2 ) represents the output of the discriminator D2 for the original sample x, D2(x adv θ d2 ) represents the discriminator D2 for the adversarial sample x adv The output result, θ d2 represents the model parameters of the discriminator D2;

[0092] 5.4.2): The operation of updating the discriminator D2 is as follows:

[0093]

[0094] in, represents the parameters of the discriminator D2 obtained after the i-th iteration, represents the parameters of the discriminator D2 obtained after the i+1th iteration, η2 is the learning rate of the discriminator D2, is the loss function About parameters gradient;

[0095] The training strategy adopted by the present invention is to first train two discriminators D1 and D2, and then train the generator G. In order to better train the discriminator D1, it is possible to minimize This allows the discriminator D1 to better fit the target black box model T, and thus enables the generator G to generate better adversarial images; the discriminator D2 is trained to determine the authenticity of the generated adversarial samples, so that the generated adversarial samples are closer to the real data distribution.

[0096] The loss function of the discriminator D1, D2 contains the output of the generator G (x; θ g ), that is, the generator and the discriminator are in a game relationship, promoting and restricting each other;

[0097] Step 6: The specific operations of training the generator G are as follows:

[0098] 6.1) Discriminator D1 is trained on adversarial samples x adv The output result D1(x adv θ d1 ) is returned to the generator G. For untargeted attacks, the loss function of the generator G with respect to the discriminator D1 is defined as:

[0099]

[0100] Among them, y represents the label of the true category;

[0101] The training goal of the discriminator D1 is to simulate the output of the target model T. Therefore, a well-trained discriminator D1 can successfully serve as a proxy model for the target model T. If the generated adversarial example can deceive the discriminator D1, then the adversarial example can also be transferred to the target model T.

[0102] 6.2): ​​In order to make the generated adversarial samples close to the real data distribution, set the discriminator D2 to distinguish the true and false samples; set the discriminator D2 to the adversarial sample x advThe output result D2(x adv θ d2 ) is returned to the generator G. The loss function formula of the generator G with respect to the discriminator D2 is defined as:

[0103]

[0104] Among them, x adv Represents the adversarial sample, that is, x adv =Clip x,∈ (clip(G(x;θ g ),α1,α2)+x,x), where: clip(·) and Clip x,∈ (·) is the clipping function to ensure that the generated adversarial sample x adv In the ∈ neighborhood of the original sample x, α1, α2 are the cropping boundaries;

[0105] 6.3): For untargeted attacks, the attack goal is to maximize the distance between the target model’s predicted category and the true category; for targeted attacks, the attack goal is to minimize the distance between the target model’s predicted category and the true category. The target loss function of the attack is:

[0106]

[0107] in, represents the predicted probability of the target category by the discriminator D1 in a targeted attack or the predicted probability of the true category in an untargeted attack, Represents the maximum value of the predicted probability of other categories by the discriminator D1;

[0108] 6.4): The objective function of training the generator G is:

[0109]

[0110] Among them, γ1, γ2, and γ3 are the weight coefficients of the three losses, which control the relative importance of the three losses; The generated adversarial samples can gradually deceive the discriminator D1 and then migrate to the target model; This makes the generated adversarial samples closer to the real data distribution and produces better visual effects; att To attack the loss, optimize it to produce better attack effects;

[0111] 6.5): The operation of updating the generator G is:

[0112]

[0113] in, represents the parameters of the generator G obtained after the i-th iteration, represents the parameters of the generator G obtained after the i+1th iteration, η is the learning rate of the generator G, is the loss function L with respect to the parameter gradient;

[0114] The present invention solves the maximum and minimum functions To obtain the generator G and discriminator D1, D2;

[0115] In order to better train the generator G, we can minimize L G , the adversarial samples generated in this way will reduce the classification ability of discriminators D1 and D2; since discriminator D1 attempts to simulate the target model T, as the number of iterations increases, the fitting ability of discriminator D1 to the target model T gradually increases. In each training iteration, querying discriminator D1 instead of querying target model T will greatly reduce the number of queries to target model T; at the same time, using discriminator D2 to judge the authenticity of adversarial samples, and constraining generator G by the two will make the generated adversarial samples closer to the original data distribution, and the attack success rate will be further improved.

[0116] The generator and the discriminator are in a game-playing relationship. In each iterative training, the discriminator is first trained based on the model parameters of the previous round, and then the generator is trained with the updated discriminator. In each iteration, the target model T, discriminators D1 and D2 will calculate the corresponding prediction results for each input. The discriminator D1 fits the target model T based on the output results of the target model T. As the number of iterations increases, the discriminator D1 fits the target model T better and better, which makes the generator G's attack capability against the target model T continuously increase; at the same time, as the number of iterations increases, the discriminator D2's ability to classify true and false samples becomes stronger and stronger, which will promote the generated adversarial samples to be closer to the distribution of real data;

[0117] Steps 5 and 6 promote and restrict each other, forming a relationship of continuous game and progress between the discriminator D1, D2 and the generator G;

[0118] Step 7. If the loss functions of the discriminators D1, D2 and the generator G in steps 5 and 6 converge, stop training and proceed to step 8. Otherwise, repeat steps 3-6.

[0119] Step 8. Save the generator G;

[0120] Step 9: Input the image preprocessed in step 1 into the generator G saved in step 8 (i.e., the trained generator G) to obtain the perturbation vector of the image. After cropping in step 4, an adversarial sample of the image is generated.

[0121] For the trained generator G, the present invention takes the original sample as input and outputs high-quality adversarial perturbations, thereby obtaining adversarial samples that can be used to efficiently attack black-box models.

[0122] The present invention uses the MNIST dataset for training and testing, and uses a four-layer convolutional image classification model as the target model T. The classification accuracy of the target model T on the MNIST test set can reach 99.4%. In an untargeted and score-query-based attack setting, the adversarial samples generated by the present invention are used to attack the target model T, achieving an attack success rate of 98.92%, and the training time is relatively short. The results show that the image adversarial sample generation method based on the generative adversarial network of the present invention has excellent performance.

[0123] The present invention adopts a dual-discriminator structure in the generative adversarial network, which can efficiently generate adversarial samples for any black-box model. While ensuring that the adversarial samples effectively attack the machine learning-based image classification model, the size of the generated adversarial perturbation is limited to the ∈ neighborhood. The training of the discriminator D1 adopts a pre-training and then fine-tuning mode. The trained discriminator D1 can successfully serve as a proxy model for the target model, which reduces the number of queries on the target model T to a certain extent. The discriminator D2 is used to constrain the adversarial samples, ensuring the visual quality of the generated adversarial samples and making the data distribution of the adversarial samples closer to that of the original samples.

[0124] Finally, it should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions or improvements made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for generating image adversarial samples based on generative adversarial networks, characterized by Use the following steps: Step 1: Preprocess the collected images; Step 2: Randomly initialize the generator G and discriminators D1, D2; Step 3: Input the image x processed in step 1 into the generator G of the generative adversarial network GAN to obtain the initial perturbation vector ε = G(x; θ g ), where θ g Represents the parameters of the generator G; Step 4: Get the adversarial sample for image x; Step 5: Train the discriminators D1 and D2. The specific steps are as follows: 5.1) The adversarial sample x adv Input it into the target model T together with the original sample x, and obtain the target model T for the adversarial sample x adv The query result T0(x adv ) and the query result T0(x) for the original sample x; 5.2). Set T0(x adv ) and T0(x) are converted into corresponding category labels T(x adv ) and T(x), the query result T0(x adv ) and T0(x) are first passed through the softmax function to obtain the probability value of each category, and then the category label with the largest probability value is selected as T(x adv ) and T(x); 5.3). Change (x,T(x)), (x adv ,T(x adv )) is used as training data to input the discriminator D1 and calculate the loss function To update the discriminator D1; 5.4). The adversarial sample x adv And the original sample x is used as training data to input the discriminator D2, and the loss function is calculated To update the discriminator D2; Step 6: Train the generator G. The specific operation is as follows: 6.1) Discriminator D1 on adversarial sample x adv The output result D1(x adv θ d1 ) is returned to the generator G. For untargeted attacks, the loss function of the generator G with respect to the discriminator D1 is defined as: Among them, y represents the label of the true category; 6.2) In order to make the generated adversarial samples close to the real data distribution, a discriminator D2 is set to distinguish the authenticity of the samples; the discriminator D2 is used for the adversarial sample x adv The output result D2(x adv θ d2 ) is returned to the generator G. The loss function formula of the generator G with respect to the discriminator D2 is defined as: Among them, x adv Represents the adversarial sample, that is, x adv =Clip x,∈ (clip(G(x;θ g ),α1,α2)+x,x), where: clip(·) and Clip x,∈ (·) is the clipping function to ensure that the generated adversarial sample x adv In the ∈ neighborhood of the original sample x, α1, α2 are the cropping boundaries; 6.3) For untargeted attacks, the goal is to maximize the distance between the target model’s predicted category and the true category; for targeted attacks, the goal is to minimize the distance between the target model’s predicted category and the target category. The target loss function is: in, represents the predicted probability of the target category by the discriminator D1 in a targeted attack or the predicted probability of the true category in an untargeted attack, Represents the maximum value of the predicted probability of other categories by the discriminator D1; 6.4) The objective function of training the generator G is: Among them, γ1, γ2, and γ3 are the weight coefficients of the three losses, which control the relative importance of the three losses; The generated adversarial samples gradually achieve the purpose of deceiving the discriminator D1 and then migrate to the target model; This makes the generated adversarial samples closer to the real data distribution and produces better visual effects; att To attack the loss, optimize it to produce better attack effects; 6.5) The operation of updating the generator G is as follows: in, represents the parameters of the generator G obtained after the i-th iteration, represents the parameters of the generator G obtained after the i+1th iteration, η is the learning rate of the generator G, is the loss function L with respect to the parameter gradient; Step 7: If the loss functions of the generator G and the discriminators D1 and D2 described in steps 5 and 6 converge, stop training and proceed to step 8; otherwise, repeat steps 3-6; Step 8. Save the generator G; Step 9: The image preprocessed in step 1 is input to the generator G to obtain the perturbation vector of the image. After step 4, the adversarial sample of the image is generated.

2. The method for generating adversarial samples based on a generative adversarial network according to claim 1, characterized in that The specific operations of step 5.3) are as follows: 5.3.1) The adversarial sample x adv The label value T(x adv ), as well as the label value T(x) corresponding to the query result of the original sample x and the target model T on the original sample, are passed as input to the discriminator D1 of the generative adversarial network GAN. The discriminator D1 is used to fit the target model T, and the loss function formula of the discriminator D1 is defined as: Among them, x adv is the adversarial sample of the original sample x, T(x adv ) indicates that the adversarial sample x adv The query result obtained by inputting the target model T is converted into the label value. T(x) represents the label value converted from the query result obtained by inputting the original sample x into the target model T. d1 Denotes the model parameters of the discriminator D1, D1(x adv θ d1 ) represents the discriminator D1 for the adversarial sample x adv The output result, D1(x; θ d1 ) represents the output of the discriminator D1 for the original sample x, Entropy(a,b) represents the cross entropy function of a and b, and β is the training weight; 5.3.2) During the training of the discriminator D1, in order to reduce the number of queries to the target model T while ensuring that the discriminator D1 fits the target model T well, the training of the discriminator D1 is divided into two stages: pre-training and fine-tuning. 5.3.3) When pre-training and fine-tuning the discriminator D1, the following formula is used to update the discriminator D1: in, represents the parameters of the discriminator D1 obtained after the i-th iteration, represents the parameters of the discriminator D1 obtained after the i+1th iteration, η1 is the learning rate of the discriminator D1, is the loss function About parameters gradient.

3. The method for generating adversarial samples based on a generative adversarial network according to claim 2, characterized in that Step 5.4) specifically adopts the following steps: 5.4.1). In order to ensure that the adversarial sample x adv The visual quality of the adversarial sample is improved, so that the adversarial sample can be more similar to the original sample. The discriminator D2 is used to judge the authenticity of the sample. If the sample is the original sample, it is true and the label is 1; if the sample is the adversarial sample, it is false and the label is 0. adv And the original sample x is input into the discriminator D2 as training data. The loss function formula of the discriminator D2 is: Among them, P data (x) is the data distribution of the original image x, E is the mathematical expectation of the expression, D2(x; θ d2 ) represents the output of the discriminator D2 for the original sample x, D2(x adv θ d2 ) represents the discriminator D2 for the adversarial sample x adv The output result, θ d2 represents the model parameters of the discriminator D2; 5.4.2) The operation of updating the discriminator D2 is as follows: in, represents the parameters of the discriminator D2 obtained after the i-th iteration, represents the parameters of the discriminator D2 obtained after the i+1th iteration, η2 is the learning rate of the discriminator D2, is the loss function About parameters gradient.

4. The method for generating adversarial samples based on a generative adversarial network according to claim 2, characterized in that In step 5.3.2): When the number of iterations iter≤n, the discriminator D1 is pre-trained; when the number of iterations iter>n and iter mod m=0, the discriminator D1 is fine-tuned; in other cases, the discriminator D1 model parameters remain unchanged.

Images