Adversarial Example Attack Method and System Based on Improved Adaptive Differential Evolution Algorithm

Abstract

This invention relates to an adversarial example attack method and system based on an improved adaptive differential evolution algorithm, comprising: acquiring an original image; adding adversarial perturbations to each pixel of the original image to obtain adversarial perturbation pixels; iteratively optimizing the adversarial perturbation pixels using an improved adaptive differential evolution algorithm to obtain the optimal solution for the adversarial perturbation pixels; the improved adaptive differential evolution algorithm continuously updates the mutation factor and crossover probability in the classic differential evolution algorithm according to the number of population iterations; adding the optimal solution of the adversarial perturbation pixels to the original image to obtain adversarial examples; and using adversarial examples to attack an image classifier model. This invention updates the mutation factor and crossover probability according to the number of iterations, enabling adaptive adjustment of the mutation factor and crossover probability, considering the feedback information of the population evolution process in the differential evolution algorithm and the dynamic requirements of the number of iterations on population evolution, thereby improving the success rate of adversarial example attacks.

Description

Technical Field

[0001] This invention relates to the field of image recognition technology, and in particular to an adversarial sample attack method and system based on an improved adaptive differential evolution algorithm. Background Technology

[0002] The continuous development of artificial intelligence has led to significant progress in deep learning across numerous fields, particularly in computer vision, where image recognition technology, due to its high accuracy, has been increasingly deployed in practical applications. However, research indicates that adversarial examples generated by adding minute perturbations to natural images can effectively deceive deep learning models, causing them to output incorrect results with high confidence. White-box adversarial attack schemes, such as FGSM proposed by Goodfellow et al. and DeepFool proposed by Moosavi-Dezfooli et al., require attackers to have full knowledge of the target model's structure and parameters, thus significantly limiting their practical application. Black-box attacks, on the other hand, do not require knowledge of the model's internal information, making them more widely applicable in physical environments. Therefore, for extremely limited scenarios, Su et al. first proposed an adversarial black-box attack that modifies only a very small number of pixels. By encoding the location information and perturbation intensity of the perturbation pixels, and using the classic differential evolution algorithm, the neural network model receives feedback information to guide the evolutionary direction of the adversarial perturbation until the maximum number of iterations is reached or the system converges to a stable state to obtain the optimal solution. However, single-pixel attacks, based on the traditional Differential Evolution (DE) algorithm, only implement a simple case where the mutation strategy remains unchanged, the mutation factor is fixed, and there is no crossover operation, resulting in low applicability. Subsequently, Su et al. used the controlled variable method to explore the impact of different mutation factors and crossover probabilities in the Differential Evolution (DE) algorithm on the success rate of adversarial example attacks. Under strict control conditions, they simultaneously controlled the pixel perturbation amount and the overall perturbation intensity; however, this adversarial example attack still had a low success rate. Summary of the Invention

[0003] The purpose of this invention is to provide an adversarial sample attack method and system based on an improved adaptive differential evolution algorithm, so as to improve the success rate of adversarial sample attacks.

[0004] To achieve the above objectives, the present invention provides the following solution:

[0005] An adversarial example attack method based on an improved adaptive differential evolution algorithm includes:

[0006] Obtain the original image;

[0007] An adversarial perturbation is added to each pixel of the original image to obtain adversarial perturbation pixels;

[0008] An improved adaptive differential evolution algorithm is used to iteratively optimize the adversarial perturbation pixels to obtain the optimal solution for the adversarial perturbation pixels; the improved adaptive differential evolution algorithm continuously updates the mutation factor and crossover probability in the classical differential evolution algorithm according to the number of population iterations;

[0009] The optimal solution of the adversarial perturbation pixel is added to the original image to obtain an adversarial sample;

[0010] The adversarial examples are used to attack the image classifier model.

[0011] Optionally, the step of iteratively optimizing the adversarial perturbation pixels using an improved adaptive differential evolution algorithm to obtain the optimal solution for the adversarial perturbation pixels specifically includes:

[0012] The anti-disturbance pixels are encoded to generate an initial anti-disturbance pixel population;

[0013] Determine whether the iteration termination condition has been met; the iteration termination condition includes the current iteration number reaching the maximum iteration number or the attack category probability corresponding to the individual of the current adversarial perturbation pixel population being greater than a preset probability value; the attack category probability corresponding to the individual of the current adversarial perturbation pixel population is the probability that the sample image is classified as an attack target after being input into the image classifier model; the sample image is obtained by adding the individuals of the current adversarial perturbation pixel population to the original image;

[0014] If so, then the individual in the current adversarial pixel population is the optimal solution for the adversarial pixel;

[0015] If not, then mutation and crossover operations are performed on individuals in the current anti-disturbance pixel population to obtain a crossover population; the mutation factor of the mutation operation and the crossover probability of the crossover operation are calculated based on the current number of iterations;

[0016] The fitness of individuals in the crossover population and the previous generation of adversarial pixel population is calculated respectively. Based on the fitness, a selection operation is performed on individuals in the crossover population and the previous generation of adversarial pixel population to generate the next generation of adversarial pixel population.

[0017] Set the next generation of adversarial perturbation pixel population to the current adversarial perturbation pixel population, and return to the step "Determine whether the iteration termination condition has been met".

[0018] Optionally, the expression for the mutation factor in the mutation operation is:

[0019]

[0020] The expression for the crossover probability of the crossover operation is:

[0021]

[0022] Among them, F g F0 is the mutation factor corresponding to the g-th generation anti-perturbation pixel population, where g represents the current iteration number of the population, G represents the maximum iteration number of the population, F0 is the initial mutation factor, and CR is the mutation factor. g CR0 represents the crossover probability of the g-th generation anti-perturbation pixel population, and CR0 represents the initial crossover probability.

[0023] Optionally, the mutation operation specifically includes:

[0024] Select five distinct individuals from the currently described anti-perturbation pixel population;

[0025] The first intermediate variant individual is generated by randomly selecting three of the five distinct individuals from the five distinct individuals.

[0026] A second intermediate mutant individual is generated by combining the remaining two distinct individuals from the five distinct individuals with the current best individual; the fitness of individuals in the current adversarial pixel population is compared with the fitness of individuals in the previous generation population, and the individual with higher fitness is selected as the current best individual;

[0027] Calculate the first weight of the first intermediate mutant and the second weight of the second intermediate mutant based on the current iteration number;

[0028] Target mutant individuals are generated based on the first intermediate mutant individual and its corresponding first weight, and the second intermediate mutant individual and its corresponding second weight; all the target mutant individuals constitute the mutant population.

[0029] Optionally, the expression for the first intermediate variant is:

[0030] v1 i,g =x r1,g +F g ×(x r2,g -x r3,g )

[0031] The expression for the second intermediate variant is:

[0032] v2 i,g =x best,g +F g ×(x r4,g -x r5,g )

[0033] Among them, v1 i,g For the i-th first intermediate mutant individual in the g-th generation, x r1,g x r2,g x r3,g xr4,g x r5,g For the five distinct individuals selected from the g-th generation of the anti-perturbation pixel population, F g v2 is the mutation factor corresponding to the g-th generation population. i,g For the i-th second intermediate variant individual in the g-th generation, x best,g This is the current optimal individual.

[0034] Optionally, the expression for the target mutant individual is:

[0035]

[0036] Among them, v i,g Let v1 be the i-th target mutant individual in the g-th generation, where G represents the maximum number of iterations in the population. i,g v2 is the i-th first intermediate mutant individual in the g-th generation. i,g This is the i-th second intermediate variant individual in the g-th generation.

[0037] Optionally, the crossover operation specifically includes:

[0038] Randomly select the first target value in the interval [0,1].

[0039] A second target value is randomly selected from the integer interval (1, D); D is an integer greater than 1 and less than or equal to 5; D represents the total number of data dimensions of individuals in the population;

[0040] Determine whether the first target value is less than the crossover probability corresponding to the g-th iteration number to obtain the first determination result;

[0041] Determine whether the second target value is equal to the number of data dimensions of the individual population to obtain a second determination result. The number of data dimensions of the individual population is the number of element dimensions of the adversarial perturbation pixel. The elements of the adversarial perturbation pixel include position elements and color elements.

[0042] When the first judgment result is yes or the second judgment result is yes, the element of the j-th dimension of the i-th target mutant individual in the g-th generation mutant population is taken as the element of the j-th dimension of the i-th crossover individual in the g-th generation crossover population; otherwise, the element of the j-th dimension of the i-th individual in the g-th generation adversarial perturbation pixel population is taken as the element of the j-th dimension of the i-th crossover individual in the g-th generation crossover population; the 0-th generation adversarial perturbation pixel population is the initial adversarial perturbation pixel population.

[0043] Optionally, the calculation formula for the selection operation is:

[0044]

[0045] Where, x i,g+1Let u represent the i-th individual in the (g+1)-th generation adversarial perturbation pixel population, where i = 1, 2, ..., NP. i,g Let x represent the i-th individual in the crossover population of generation g. i,g For the i-th individual in the g-th generation of the anti-perturbation pixel population, f loss (u i,g f represents the fitness of the i-th individual in the g-th generation crossover population. loss (x i,g ) represents the fitness of the i-th individual in the g-th generation of the pixel population resistant to perturbation.

[0046] This invention also provides an adversarial example attack system based on an improved adaptive differential evolution algorithm, comprising:

[0047] The raw image acquisition module is used to acquire raw images.

[0048] The adversarial perturbation pixel acquisition module is used to add adversarial perturbation to each pixel of the original image to obtain adversarial perturbation pixels;

[0049] The optimal solution acquisition module for adversarial perturbation pixels is used to iteratively optimize the adversarial perturbation pixels using an improved adaptive differential evolution algorithm to obtain the optimal solution for the adversarial perturbation pixels; the improved adaptive differential evolution algorithm continuously updates the mutation factor and crossover probability in the classic differential evolution algorithm according to the number of population iterations.

[0050] An adversarial example acquisition module is used to add the optimal solution of the adversarial perturbation pixel to the original image to obtain adversarial examples;

[0051] An attack module is used to attack the image classifier model using the adversarial examples.

[0052] Optionally, the optimal solution acquisition module for counteracting perturbation pixels specifically includes:

[0053] The anti-disturbance pixels are encoded to generate an initial anti-disturbance pixel population;

[0054] Determine whether the iteration termination condition has been met; the iteration termination condition includes the current iteration number reaching the maximum iteration number or the attack category probability corresponding to the individual of the current adversarial perturbation pixel population being greater than a preset probability value; the attack category probability corresponding to the individual of the current adversarial perturbation pixel population is the probability that the sample image is classified as an attack target after being input into the image classifier model; the sample image is obtained by adding the individuals of the current adversarial perturbation pixel population to the original image;

[0055] If so, then the individual in the current adversarial pixel population is the optimal solution for the adversarial pixel;

[0056] If not, then mutation and crossover operations are performed on individuals in the current anti-disturbance pixel population to obtain a crossover population; the mutation factor of the mutation operation and the crossover probability of the crossover operation are calculated based on the current number of iterations;

[0057] The fitness of individuals in the crossover population and the previous generation of adversarial pixel population is calculated respectively. Based on the fitness, a selection operation is performed on individuals in the crossover population and the previous generation of adversarial pixel population to generate the next generation of adversarial pixel population.

[0058] Set the next generation of adversarial perturbation pixel population to the current adversarial perturbation pixel population, and return to the step "Determine whether the iteration termination condition has been met".

[0059] According to specific embodiments provided by the present invention, the present invention discloses the following technical effects:

[0060] This invention provides an adversarial example attack method and system based on an improved adaptive differential evolution algorithm, comprising: acquiring an original image; adding adversarial perturbations to each pixel of the original image to obtain adversarial perturbation pixels; iteratively optimizing the adversarial perturbation pixels using an improved adaptive differential evolution algorithm to obtain the optimal solution for the adversarial perturbation pixels; wherein the improved adaptive differential evolution algorithm continuously updates the mutation factor and crossover probability in the classical differential evolution algorithm according to the number of population iterations; adding the optimal solution of the adversarial perturbation pixels to the original image to obtain adversarial examples; and using the adversarial examples to attack an image classifier model. This invention updates the mutation factor and crossover probability according to the number of iterations, enabling adaptive adjustment of the mutation factor and crossover probability, considering the feedback information of the population evolution process in the differential evolution algorithm and the dynamic requirements of the number of iterations on population evolution, thereby improving the success rate of adversarial example attacks. Attached Figure Description

[0061] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0062] Figure 1 This is a schematic diagram of the adversarial sample attack method based on the improved adaptive differential evolution algorithm provided in Embodiment 1 of the present invention;

[0063] Figure 2 This is a flowchart illustrating the specific implementation of the adversarial sample attack method based on the improved adaptive differential evolution algorithm provided in Embodiment 1 of the present invention.

[0064] Figure 3 This is a block diagram of an adversarial sample attack system based on an improved adaptive differential evolution algorithm, provided in Embodiment 2 of the present invention. Detailed Implementation

[0065] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0066] The purpose of this invention is to provide an adversarial sample attack method and system based on an improved adaptive differential evolution algorithm, so as to improve the success rate of adversarial sample attacks.

[0067] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0068] Example 1

[0069] This embodiment provides an adversarial sample attack method based on an improved adaptive differential evolution algorithm. See [link to relevant documentation]. Figure 1 The method includes:

[0070] Step S1: Obtain the original image.

[0071] Step S2: Add an adversarial perturbation to each pixel of the original image to obtain adversarial perturbation pixels.

[0072] Step S3: Iteratively optimize the adversarial perturbation pixels using the improved adaptive differential evolution algorithm to obtain the optimal solution for the adversarial perturbation pixels; the improved adaptive differential evolution algorithm continuously updates the mutation factor and crossover probability in the classic differential evolution algorithm according to the number of population iterations.

[0073] Step S4: Add the optimal solution of the adversarial perturbation pixel to the original image to obtain the adversarial sample.

[0074] Step S5: Utilize the adversarial examples to attack the image classifier model.

[0075] This embodiment uses a ResNet image classification model trained on the CIFAR10 dataset as an example to describe in detail the specific process of applying adversarial example generation:

[0076] In this embodiment, step S1 selects an image from the CIFAR10 dataset as the original image, and represents the original image I as an n-dimensional input vector x = (x1, x2, ..., x...). n ), where xi Let x represent the pixel value. Then, the probability that the target classifier f (in this embodiment, the ResNet image classification model is used as the target classifier) ​​correctly classifies the input vector x into category t is f. t (x). Vector p(x) = (p1, p2, ..., p n The superposition of adversarial perturbations on the input vector x is defined as such, enabling the ResNet model to misclassify the original image category, where element p i This indicates that the element x in the corresponding dimension of the input vector x i The adversarial perturbation added to p, specifically, i =(x i ,y i ,r i ,g i ,b i This contains the position and color information of the adversarially perturbed pixels, and then an adaptive differential evolution algorithm will be used to process element p. i The image is optimized as an individual element within a population to obtain the optimal adversarial perturbation for the original image. In this embodiment, the optimal adversarial perturbation p(x) is... * The following conditions must be met:

[0077]

[0078] subject to ||p(x)||0≤L

[0079] Where, adv is the attack target, which is a category different from the category t described in the original image I; in the constraint condition (subjectto), L is the maximum amount of modification of the adversarial perturbation, and ||p(x)||0 means that the vector p(x) is modified in several dimensions under the L0 norm condition, that is, only the original image I is perturbed locally.

[0080] In this embodiment, step S3 specifically includes the following steps:

[0081] Step S31: Encode the anti-disturbance pixels to generate an initial anti-disturbance pixel population.

[0082] Step S32: Determine whether the iteration termination condition has been met; the iteration termination condition includes the current iteration number reaching the maximum iteration number or the attack category probability corresponding to the individual of the current adversarial perturbation pixel population being greater than a preset probability value; the attack category probability corresponding to the individual of the current adversarial perturbation pixel population is the probability that the sample image is classified as an attack target after being input into the image classifier model; the sample image is obtained by adding the individuals of the current adversarial perturbation pixel population to the original image.

[0083] Step S33: If so, then the individual in the current anti-disturbance pixel population is the optimal solution for the anti-disturbance pixel.

[0084] Step S34: If not, perform mutation and crossover operations on the individuals in the current anti-disturbance pixel population to obtain a crossover population; the mutation factor of the mutation operation and the crossover probability of the crossover operation are calculated based on the current iteration number.

[0085] Step S35: Calculate the fitness of individuals in the crossover population and the previous generation of adversarial perturbation pixel population respectively, and perform selection operations on individuals in the crossover population and the previous generation of adversarial perturbation pixel population according to the fitness to generate the next generation of adversarial perturbation pixel population.

[0086] Step S36: Set the next generation of adversarial perturbation pixel population to the current adversarial perturbation pixel population, and return to the step "Determine whether the iteration termination condition has been met".

[0087] The following example illustrates step S3 in detail:

[0088] First, the population size is initialized to NP, meaning that NP individuals are generated in each iteration, each individual being a candidate solution for image perturbation. This embodiment specifies that the initialized adversarial perturbation pixel population is the 0th generation adversarial perturbation pixel population. The generation method for the 0th generation adversarial perturbation pixel population is as follows:

[0089] x i,j,0 =min j +rand[0,1]×(max j -min j )

[0090] Among them, {x i,j,0 |i=1,2,...,NP;j=1,2,...,5}, where {j=1,2,...,5} represents the quintuple element p. i =(x i ,y i ,r i ,g i ,b i The dimension on ) then [min j ,max j [] represents the range of values ​​for an individual in the j-th dimension of the population, and rand[0,1] is a uniformly distributed random number obtained within [0,1]. Simultaneously, the initial values ​​of the mutation factor F and the crossover probability CR are both set to 1.

[0091] Secondly, the changes in the population iteration process have dynamic requirements for control parameters and operational strategies. Regarding the mutation factor F in the mutation operation, in the early stages of evolution, when the fitness of individuals is poor, a larger F value enhances the global perturbation capability of the difference vector, expands the search range of solutions, and is more conducive to escaping local optima. In the later stages of evolution, when the fitness of individuals increases, a smaller F value increases the algorithm's local optimization capability, improves the optimization accuracy of the solution, and allows individuals to approach the optimal solution more closely. Regarding the crossover probability CR, a larger value in the early stages of evolution ensures that the elements of the generated crossover individuals come more from mutated individuals, increasing the algorithm's evolution speed. In the later stages of evolution, when fine-tuning of crossover individuals is needed, a relatively smaller CR value can slow down the evolution speed and ensure the accuracy of the final optimization result. Therefore, compared to the classic differential evolution algorithm which maintains fixed control parameters throughout the population iteration process, this invention updates the mutation factor and crossover probability based on the current iteration number, which better meets the different requirements of the population evolution process for control parameters and is more conducive to the evolutionary direction of the population.

[0092] In this embodiment, the expression for the mutation factor of the mutation operation is:

[0093]

[0094] The expression for the crossover probability of the crossover operation is:

[0095]

[0096] Among them, F g F0 is the mutation factor corresponding to the g-th generation anti-perturbation pixel population, where g represents the current iteration number of the population, G represents the maximum iteration number of the population, F0 is the initial mutation factor, and CR is the mutation factor. g CR0 represents the crossover probability of the g-th generation anti-perturbation pixel population, and CR0 represents the initial crossover probability.

[0097] In this embodiment, the mutation operation in step S34 specifically includes the following steps:

[0098] Select five distinct individuals from the currently described anti-perturbation pixel population;

[0099] The first intermediate variant individual is generated by randomly selecting three of the five distinct individuals from the five distinct individuals.

[0100] A second intermediate mutant individual is generated by combining the remaining two distinct individuals from the five distinct individuals with the current best individual; the fitness of individuals in the current adversarial pixel population is compared with the fitness of individuals in the previous generation population, and the individual with higher fitness is selected as the current best individual;

[0101] Calculate the first weight of the first intermediate mutant and the second weight of the second intermediate mutant based on the current iteration number;

[0102] Target mutant individuals are generated based on the first intermediate mutant individual and its corresponding first weight, and the second intermediate mutant individual and its corresponding second weight; all the target mutant individuals constitute the mutant population.

[0103] The mutation operation in S34 is described in detail below:

[0104] For the dynamic requirements of mutation strategies during population iteration, the early stages of evolution demand higher global search capabilities, making the DE / rand / 1 strategy, which randomly selects individuals, more suitable. In the later stages of evolution, the algorithm's local optimization ability is emphasized, and the DE / best / 1 strategy, which utilizes information from the optimal individual, better meets the solution requirements. Therefore, throughout the entire population evolution process, combining the two mutation strategies proportionally according to the number of iterations results in an adaptive mutation strategy that better adapts to the different needs of population evolution for mutation strategies.

[0105] First, five distinct individuals are randomly selected, and three of them are chosen to generate the first intermediate mutant individual using the mutation strategy DE / rand / 1. The expression for the first intermediate mutant individual is:

[0106] v1 i,g =x r1,g +F g ×(x r2,g -x r3,g )

[0107] In the process of population evolution, the current best individual is defined as the individual with the highest fitness in the population. For the loss function minimization problem defined in adversarial example attacks, the smaller the loss value, the higher the fitness. At the time of population initialization, the best individual is a random individual in the adversarial perturbation pixel population of generation 0. In the subsequent population iterations, the fitness of each individual is compared with that of the current best individual in the previous generation adversarial perturbation pixel population, and the individual with the higher fitness is selected as the current best individual.

[0108] Therefore, the second intermediate mutant individual is generated by using two other individuals from the five distinct individuals and the current best individual through the mutation strategy DE / best / 1. The expression for the second intermediate mutant individual is:

[0109] v2 i,g =x best,g +F g ×(x r4,g -x r5,g )

[0110] Among them, v1i,g For the i-th first intermediate mutant individual in the g-th generation, x r1,g x r2,g x r3,g x r4,g x r5,g For the five distinct individuals selected from the g-th generation of the anti-perturbation pixel population, F g v2 is the mutation factor corresponding to the g-th generation population. i,g For the i-th second intermediate variant individual in the g-th generation, x best,g This is the current optimal individual.

[0111] Finally, based on the current iteration number, the target mutant is formed by proportionally selecting two intermediate mutant individuals. The expression for the target mutant is:

[0112]

[0113] Among them, v i,g Let v1 be the i-th target mutant individual in the g-th generation, where G represents the maximum number of iterations in the population. i,g v2 is the i-th first intermediate mutant individual in the g-th generation. i,g This is the i-th second intermediate variant individual in the g-th generation. The first weight of the first intermediate variant individual. The second weight is the second intermediate variant individual.

[0114] In this embodiment, the crossover operation in step S34 includes the following steps:

[0115] Randomly select the first target value in the interval [0,1].

[0116] A second target value is randomly selected from the integer range (1, D); D is an integer greater than 1 and less than or equal to 5. In this embodiment, the integer D can be 5.

[0117] Determine whether the first target value is less than the crossover probability corresponding to the g-th iteration number to obtain the first determination result.

[0118] Determine whether the second target value is equal to the number of data dimensions of the individual population to obtain a second determination result. The number of data dimensions of the individual population is the number of element dimensions of the adversarial perturbation pixel. The elements of the adversarial perturbation pixel include position elements and color elements.

[0119] When the first judgment result is yes or the second judgment result is yes, the element of the j-th dimension of the i-th target mutant individual in the g-th generation mutant population is taken as the element of the j-th dimension of the i-th crossover individual in the g-th generation crossover population; otherwise, the element of the j-th dimension of the i-th individual in the g-th generation adversarial perturbation pixel population is taken as the element of the j-th dimension of the i-th crossover individual in the g-th generation crossover population; the 0-th generation adversarial perturbation pixel population is the initial adversarial perturbation pixel population.

[0120] In this embodiment, each individual (i.e., the adversarial perturbation pixel) contains the position and color information of the adversarial perturbation pixel, i.e., the adversarial perturbation pixel p i =(x i ,y i ,r i ,g i ,b i At this point, the adversarial perturbation pixel includes data in 5 dimensions, j = 1, 2, ..., 5.

[0121] The following example illustrates the crossover operation:

[0122] To enhance population diversity, a crossover operation needs to be performed between the initial individuals and the mutated individuals to obtain the crossover individuals. First, a first target value is randomly selected from the interval [0,1] and compared with the current crossover probability CR. g Compare the values. When the first target value is less than CR... g Or when the second target value j is randomly generated in the integer interval (1, D) rand When the value equals the current iteration parameter j, the element of the j-th dimension of the i-th target mutant individual in the g-th generation mutant population is used as the element of the j-th dimension of the i-th crossover individual in the g-th generation crossover population; otherwise, the element of the j-th dimension of the i-th individual in the g-th generation adversarial perturbation pixel population is selected as the element of the j-th dimension of the i-th crossover individual in the g-th generation crossover population. The specific calculation formula for the crossover operation is as follows:

[0123]

[0124] Where, j = j rand This is used to ensure that at least one element in the crossover individual comes from the mutated individual, avoiding a situation where all initial adversarial perturbation pixel population individuals are passed to the crossover individual, thus failing to effectively generate new individuals. i,j,g v is the j-th element of the i-th individual in the g-th generation crossover population. i,j,g x is the j-th element of the i-th individual in the g-th generation mutant population. i,j,g It represents the j-th element of the i-th individual in the g-th generation anti-perturbation pixel population.

[0125] Then, the fitness of the crossover individual and the initial individual are calculated separately, and their fitness is compared according to the greedy principle. For the loss function minimization problem defined in adversarial example attacks, the calculation formula for the selection operation in step S35 is:

[0126]

[0127] Where, x i,g+1 Let u represent the i-th individual in the (g+1)-th generation adversarial perturbation pixel population, where i = 1, 2, ..., NP. i,g Let x represent the i-th individual in the crossover population of generation g. i,g For the i-th individual in the g-th generation of the anti-perturbation pixel population, f loss (u i,g f represents the fitness of the i-th individual in the g-th generation crossover population. loss (x i,g ) represents the fitness of the i-th individual in the g-th generation of the pixel population resistant to perturbation.

[0128] After selecting the winning individuals, i.e., those with high fitness, the winning individuals are added to the original image I to obtain sample images. The sample images are then judged to determine whether they meet the following conditions:

[0129] f adv (x+x i,g+1 )>f t (x)

[0130] Among them, f adv (x+x i,g+1 f represents the probability that a sample image is classified as an attack target. t (x) represents the probability that the original image is classified into category t.

[0131] If the conditions are met, adversarial examples are generated, which can cause the ResNet model to misclassify the original image. Otherwise, the winning individuals will continue to be added to the original image I. If no individual that meets the conditions is found after traversing all the current winning individuals, the individual will enter the next iteration until an individual that meets the conditions or the maximum number of iterations is obtained.

[0132] This invention implements an adversarial example attack method based on an improved adaptive differential evolution algorithm through the above steps. By considering the feedback information of the population evolution process in the differential evolution algorithm and the dynamic requirements of the number of iterations on population evolution, the crossover strategy and control parameters are adaptively adjusted to guide the direction of population evolution, optimize the population evolution effect, and ultimately obtain the optimal solution for adversarial perturbation. This allows for the successful induction of typical neural network model classification errors by perturbing only a very small number of pixels in the original image sample. Compared with adversarial example black-box attacks with the same amount of perturbation, this method has a higher success rate, further improving the applicability of adversarial example attacks in physical environments. Furthermore, this invention can be applied to different datasets and models, also demonstrating good attack performance.

[0133] Example 2

[0134] This embodiment provides an adversarial sample attack system based on an improved adaptive differential evolution algorithm. See [link to relevant documentation]. Figure 3 The system includes:

[0135] The original image acquisition module T1 is used to acquire the original image.

[0136] The adversarial perturbation pixel acquisition module T2 is used to add adversarial perturbation to each pixel of the original image to obtain adversarial perturbation pixels.

[0137] The optimal solution acquisition module T3 for adversarial perturbation pixels is used to iteratively optimize the adversarial perturbation pixels using an improved adaptive differential evolution algorithm to obtain the optimal solution for adversarial perturbation pixels; the improved adaptive differential evolution algorithm continuously updates the mutation factor and crossover probability in the classic differential evolution algorithm according to the number of population iterations.

[0138] The adversarial example acquisition module T4 is used to add the optimal solution of the adversarial perturbation pixel to the original image to obtain adversarial examples.

[0139] Attack module T5 is used to attack the image classifier model using the adversarial examples.

[0140] In this embodiment, the optimal solution acquisition module for resisting perturbation pixels specifically includes:

[0141] The anti-disturbance pixels are encoded to generate an initial anti-disturbance pixel population;

[0142] Determine whether the iteration termination condition has been met; the iteration termination condition includes the current iteration number reaching the maximum iteration number or the attack category probability corresponding to the individual of the current adversarial perturbation pixel population being greater than a preset probability value; the attack category probability corresponding to the individual of the current adversarial perturbation pixel population is the probability that the sample image is classified as an attack target after being input into the image classifier model; the sample image is obtained by adding the individuals of the current adversarial perturbation pixel population to the original image;

[0143] If so, then the individual in the current adversarial pixel population is the optimal solution for the adversarial pixel;

[0144] If not, then mutation and crossover operations are performed on individuals in the current anti-disturbance pixel population to obtain a crossover population; the mutation factor of the mutation operation and the crossover probability of the crossover operation are calculated based on the current number of iterations;

[0145] The fitness of individuals in the crossover population and the previous generation of adversarial pixel population is calculated respectively. Based on the fitness, a selection operation is performed on individuals in the crossover population and the previous generation of adversarial pixel population to generate the next generation of adversarial pixel population.

[0146] Set the next generation of adversarial perturbation pixel population to the current adversarial perturbation pixel population, and return to the step "Determine whether the iteration termination condition has been met".

[0147] The system disclosed in the embodiments is described in a relatively simple manner because it corresponds to the method disclosed in the embodiments. For relevant details, please refer to the method section.

[0148] This document uses specific examples to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. Furthermore, those skilled in the art will recognize that, based on the ideas of the present invention, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for an improved adaptive differential evolution algorithm-based adversarial sample attack, characterized in that, The method comprises the following steps: obtaining an original image; adding an adversarial perturbation to each pixel point of the original image to obtain an adversarial perturbation pixel; using an improved adaptive differential evolution algorithm to iteratively optimize the adversarial perturbation pixel to obtain an optimal solution of the adversarial perturbation pixel, specifically comprising: encoding the adversarial perturbation pixel to generate an initial adversarial perturbation pixel population; determining whether an iteration termination condition is reached; the iteration termination condition comprises that the current iteration number reaches a maximum iteration number or the attack category probability corresponding to the individual of the current adversarial perturbation pixel population is greater than a preset probability value; the attack category probability corresponding to the individual of the current adversarial perturbation pixel population is the probability that the sample image input into the image classifier model is classified as an attack target; the sample image is obtained by adding the individual of the current adversarial perturbation pixel population to the original image; if yes, the individual in the current adversarial perturbation pixel population is the optimal solution of the adversarial perturbation pixel; if no, performing mutation operation and crossover operation on the individual in the current adversarial perturbation pixel population to obtain a crossover population; the mutation factor of the mutation operation and the crossover probability of the crossover operation are calculated according to the current iteration number; respectively calculating the fitness of the individuals in the crossover population and the previous generation adversarial perturbation pixel population, and performing selection operation on the individuals in the crossover population and the previous generation adversarial perturbation pixel population according to the fitness to generate a next generation adversarial perturbation pixel population; letting the next generation adversarial perturbation pixel population be the current adversarial perturbation pixel population, and returning to the step of "determining whether an iteration termination condition is reached"; the improved adaptive differential evolution algorithm updates the mutation factor and the crossover probability in the classical differential evolution algorithm according to the population iteration number, so as to guide the population evolution direction and optimize the population evolution effect, and realize the perturbation of only a small number of pixel points of the original image sample; the expression of the mutation factor of the mutation operation is: 0 the expression of the crossover probability of the crossover operation is: 0 wherein, is the initial mutation factor, is the mutation factor corresponding to the anti-disturbance pixel population of the i-th generation, represents the current iteration number of the population, represents the maximum iteration number of the population, 0 is the initial mutation factor, is the initial mutation factor, is the initial crossover probability, 0 is the initial crossover probability; adding the optimal solution of the adversarial perturbation pixel to the original image to obtain an adversarial sample; using the adversarial sample to attack the image classifier model.

2. The method of claim 1, wherein the improved adaptive differential evolution algorithm-based adversarial sample attack method is characterized by, The mutation operation specifically comprises: selecting five different individuals from the individuals in the current adversarial perturbation pixel population; selecting three different individuals from the five different individuals to generate a first intermediate mutation individual; generating a second intermediate mutation individual according to the remaining two different individuals in the five different individuals and the current optimal individual; comparing the fitness of the individuals in the current adversarial perturbation pixel population with the fitness of the individuals in the previous population, and selecting the individual with higher fitness as the current optimal individual; calculating a first weight of the first intermediate mutation individual and a second weight of the second intermediate mutation individual according to the current iteration number; generating a target mutation individual according to the first intermediate mutation individual and the corresponding first weight and the second intermediate mutation individual and the corresponding second weight; all the target mutation individuals constitute a mutation population.

3. The method of claim 2, wherein the method is characterized by, the expression of the first intermediate mutation individual is: the expression of the second intermediate mutation individual is: wherein, is the first generation the first i intermediate variant individual, 、 、 、 、 is the fifth generation five different individuals of the population of adversarial perturbed pixels, is the first generation the mutation factor corresponding to the population, is the first generation the second i intermediate variant individual, is the current optimal individual.

4. The method of claim 3, wherein the improved adaptive differential evolution algorithm-based adversarial sample attack method is characterized by, An expression of the target variant individual is: in, For the first The generation i One target variant individual, This represents the maximum number of iterations for the population. For the first The generation i The first intermediate variant individual. For the first The generation i A second intermediate variant individual.

5. The method of claim 2, wherein the method is characterized by, The cross operation specifically includes: In the interval a first target value is randomly selected; In the integer interval (D A second target value is randomly selected; D is an integer greater than 1 and less than or equal to 5; D represents the total number of data dimensions of the population individuals; determining whether the first target value is less than the first threshold value a cross probability corresponding to the number of iterations of the second iteration, to obtain a first determination result determining whether the second target value is equal to the data dimension number of the population individual, to obtain a second determination result, the data dimension number of the population individual being the element dimension number of the adversarial perturbation pixel; the element of the adversarial perturbation pixel including a position element and a color element; When the first judgment result is yes or the second judgment result is yes, the first... The first generation of variant population i The target variant individual j The element of dimension as the first In the crossover population, the first i The first cross individual j The element of dimension 1; otherwise, select the element of dimension 2. The first generation of adversarial perturbation pixel population i The first individual j The element of dimension as the first Crossover population i The first cross individual j The elements of the dimension; the 0th generation adversarial perturbation pixel population is the initial adversarial perturbation pixel population.

6. The method of claim 1, wherein, The calculation formula of the selection operation is: wherein, represents the jth individual of the ith generation of the cross population, +1 generation of the adversarial perturbed pixel population, i represents the jth individual of the ith generation of the cross population, , represents the jth individual of the ith generation of the cross population, represents the jth individual of the ith generation of the cross population, i represents the jth individual of the ith generation of the cross population, represents the jth individual of the ith generation of the cross population, g represents the jth individual of the ith generation of the cross population, i represents the jth individual of the ith generation of the cross population, represents the jth individual of the ith generation of the cross population, represents the jth individual of the ith generation of the cross population, i represents the jth individual of the ith generation of the cross population, represents the jth individual of the ith generation of the cross population, g represents the jth individual of the ith generation of the cross population, i represents the jth individual of the ith generation of the cross population, 7. An improved adaptive differential evolution algorithm based adversarial sample attack system, characterized in that, including: An original image acquisition module is configured to acquire an original image; An adversarial perturbation pixel acquisition module is configured to add an adversarial perturbation to each pixel point of the original image to obtain an adversarial perturbation pixel; An optimal solution acquisition module of the adversarial perturbation pixel is configured to perform iterative optimization on the adversarial perturbation pixel by using an improved adaptive differential evolution algorithm to obtain an optimal solution of the adversarial perturbation pixel, and specifically includes: encoding the adversarial perturbation pixel to generate an initial adversarial perturbation pixel population; determining whether an iteration termination condition is reached; the iteration termination condition including that a current iteration number reaches a maximum iteration number or that an attack category probability corresponding to an individual of a current adversarial perturbation pixel population is greater than a preset probability value; the attack category probability corresponding to the individual of the current adversarial perturbation pixel population being a probability that a sample image input into the image classifier model is classified as an attack target; the sample image being obtained by adding an individual of the current adversarial perturbation pixel population to the original image; if yes, the individual in the current adversarial perturbation pixel population is the optimal solution of the adversarial perturbation pixel; if no, performing a mutation operation and a cross operation on the individual in the current adversarial perturbation pixel population to obtain a cross population; a mutation factor of the mutation operation and a cross probability of the cross operation being calculated according to the current iteration number; calculating the fitness of the individual in the cross population and a previous generation adversarial perturbation pixel population respectively, and performing a selection operation on the individual in the cross population and the previous generation adversarial perturbation pixel population according to the fitness to generate a next generation adversarial perturbation pixel population; setting the next generation adversarial perturbation pixel population as the current adversarial perturbation pixel population, and returning to the step of determining whether the iteration termination condition is reached; the improved adaptive differential evolution algorithm being an algorithm in which a mutation factor and a cross probability in a classical differential evolution algorithm are constantly updated according to population iteration numbers, so as to guide a population evolution direction and optimize a population evolution effect, and realize perturbation on only a small number of pixel points of an original image sample; an expression of the mutation factor of the mutation operation being: 0 an expression of the cross probability of the cross operation being: 0 wherein, is the initial mutation factor, is the mutation factor corresponding to the anti-disturbance pixel population of the i-th generation, represents the current iteration number of the population, represents the maximum iteration number of the population, 0 is the initial mutation factor, is the initial mutation factor, is the initial crossover probability, 0 is the initial crossover probability; an adversarial sample acquisition module is configured to add the optimal solution of the adversarial perturbation pixel to the original image to obtain an adversarial sample; and an attack module is configured to attack an image classifier model by using the adversarial sample.

Images