A score-based sticker adversarial attack method

Abstract

This paper, which belongs to the field of adversarial examples in deep learning, proposes a score-based sticker adversarial attack method, which includes task abstraction and a generation process. Task abstraction involves abstracting a specific attack task into an objective function, which uses the adversarial perturbation as input. By continuously reducing the value of the optimized objective function, the corresponding perturbation is obtained to generate adversarial examples. The generation process involves continuously reducing the value of the objective function under black-box conditions, which is the optimization algorithm. This method, proposed by this paper, features high query efficiency and a high attack success rate. The generated adversarial examples have a high attack success rate, are of high quality, and are difficult to detect by the attacked model.

Description

Technical Field

[0001] The present invention relates to the field of adversarial samples in deep learning, and in particular to a score-based sticker adversarial attack method. Background Art

[0002] In recent years, deep learning networks have achieved significant success in various fields, such as autonomous driving, human-machine interaction, and human identity recognition. These applications, many of which are security-critical, include financial applications and VIP recognition. However, recent research has shown that deep learning models can be affected by certain subtle perturbations that are not easily noticed by humans. These images carrying these perturbations are called adversarial examples. Research on the principles behind adversarial examples holds promise for further advancements in deep learning across various application areas, and adversarial attacks are one area of research related to adversarial examples.

[0003] Currently, research on adversarial attack algorithms can be categorized into white-box and black-box attacks, based on the level of access the attacker has to the target model. White-box attacks assume that the attacker has access to all information about the target model, including its internal structure, state, and weights. This allows them to easily use gradient information to guide the generation of adversarial examples. Black-box attacks, on the other hand, assume that the attacker only has access to partial output information from the target classification model, including the score classification vector and the decision-making classification result. Clearly, black-box attacks are more practical, as most commercially available intelligent systems do not disclose their internal information to users.

[0004] In black-box attacks, they can be further divided according to the attack method into the transfer-based type proposed by Guo Y, Li Q, Chen H. Backpropagating linearly improves transferability of adversarial examples, the decision-based type proposed by Brendel W, Rauber J, Bethge M. Decision-based adversariallattacks: Reliable attacks against black-box machine learning models, and the score-based type proposed by Su J, Vargas DV, Sakurai K. One pixel attack for fooling deep neural networks.

[0005] Transfer-based methods rely primarily on the transferability of adversarial examples, meaning that adversarial examples that successfully attack one model can also serve as adversarial examples for other models. Therefore, transfer-based adversarial attack algorithms typically construct a proxy model to mimic the behavior of the target model. A white-box attack algorithm is then applied to it to generate adversarial examples, hoping that these examples will successfully attack the target model. The advantage of this approach is that once the proxy model is obtained, frequent queries to the target model are unnecessary. However, a disadvantage is that retraining the proxy model requires a large amount of data similar to the target model's training data, which is difficult to achieve in practice. Furthermore, the transferability of adversarial examples generated on the proxy model cannot be guaranteed, resulting in a low attack success rate for this approach.

[0006] Decision-based attack algorithms assume they can only obtain the target model's decision-based outputs. Therefore, these algorithms typically start with a randomly generated, fully perturbed image and use queries to estimate the target model's decision boundary and gradient information. Ultimately, they identify the sample point on the boundary closest to the original sample point as the adversarial sample image. These algorithms have a 100% attack success rate and impose fewer constraints on the target model, but they also require a higher number of queries and more complex computations than fractional-based algorithms.

[0007] Fractional-based algorithms assume that the attacker can obtain the target model's fractional classification vector output. By extracting the attack task into a target formula and solving it through zero-order optimization or heuristic algorithms, they ultimately generate adversarial examples. Fractional-based algorithms offer the advantages of computational simplicity and fast execution, and have the potential to achieve the lowest query count of the three algorithms.

[0008] In white-box attacks, the C&W algorithm has excellent attack performance. It proposes two target formula abstractions for targeted attack tasks and non-target attack tasks, which provide an important mathematical foundation for fractional attack algorithms. Subsequent target formulas for fractional attack algorithms are almost all improvements based on it. The OnePixel algorithm uses a heuristic algorithm and seeks to generate adversarial samples by changing only a few pixels without considering the degree of perturbation to the pixels. However, the generated pixels are relatively discrete in distribution and have complex and bright colors, which cannot be actually printed. The BanditAttack algorithm proposes to use prior knowledge to improve the accuracy of gradient estimation, thereby reducing the number of queries to the target model. This method of optimization using prior knowledge is applicable to almost any gradient-based attack algorithm.

[0009] Currently, the adversarial perturbations generated by these three algorithms are non-printable, meaning they exist only in digital space and cannot be attached to physical objects. Furthermore, we hope to find a method that combines the advantages of high attack success rate, low query count, simplicity and speed, and that can actually print the generated perturbations and attach them to physical objects, thereby enabling a wider range of attacks. Summary of the Invention

[0010] Based on the deficiencies of the existing technology, the present invention proposes a score-based sticker anti-attack method, which has the characteristics of high query efficiency and attack success rate.

[0011] The technical solutions of the present invention are as follows:

[0012] A score-based sticker adversarial attack method includes task abstraction and generation processes. Task abstraction abstracts the specific attack task into an objective function, with adversarial perturbations as input. By continuously reducing the value of the optimized objective function, the corresponding perturbation is obtained when the optimal value is reached, generating adversarial samples. The generation process continuously reduces the value of the objective function under black-box settings, which is the optimization algorithm. The specific steps are as follows:

[0013] 1) Task abstraction

[0014] Input a digital original image x0 and the target classification model f(·) to be attacked into the objective function; input the digital matrix of the digital original image x0 into the target classification model f(·), output the classification probability vector P corresponding to the digital original image x0, and take the category corresponding to the maximum value subscript in the classification probability vector P as the final classification result;

[0015] According to different attack requirements, there are two abstract objective functions: targeted attack and untargeted attack. The content of targeted attack is to generate adversarial samples to make the target classification model misjudge; the content of untargeted attack is to generate adversarial samples to make the target model classify them as a specified class.

[0016] 1.1) The objective function of untargeted attack is as follows:

[0017]

[0018] Among them, δ is the adversarial disturbance, P t is the classification probability of the true class corresponding to the digital original image x0; P_{dodg} is the probability that the digital original image x0 is classified as a non-original true class t;

[0019] 1.2) Targeted Attacks

[0020] The objective function of the targeted attack is obtained by transforming the objective formula of the untargeted attack as follows:

[0021]

[0022] Among them, δ is the adversarial disturbance, P i is the probability that the original digital image x0 is classified as the target class i; P_{imper} is the probability that the original digital image x0 is classified as the non-target class i;

[0023] In a targeted attack, when the score of the original digital image classified as the target category after the adversarial perturbation is added is not the largest, the loss value is positive; when the classification score of the target category is the largest, the loss value is negative, indicating that the targeted attack adversarial sample has been successfully generated;

[0024] 2) Generation process

[0025] Use different objective functions for different attack tasks;

[0026] 2.1) Generation of adversarial examples;

[0027] Without accessing the internal information of the attacked classification model, the adversarial sample is generated by continuously reducing the value of the objective function by estimating the gradient and adjusting the adversarial perturbation. The perturbation vector added to the original digital image appears as a black rectangular block on the image, and its size and color are continuously reduced in subsequent iterative calculations to improve the quality of the adversarial sample. The calculation steps are as follows:

[0028] Initialize the following parameters: the target function for the corresponding attack task; the original digital image x0; let the adversarial perturbation δ be a 0 vector with the same dimension as the initial sample point; select the true classification category t when there is no target attack task; select the target category i when there is a target attack task;

[0029] The objective function formula loss is estimated at point δ by the following formula k The gradient at:

[0030]

[0031] Among them, k is the number of iterations, d is the image dimension, Q is the number of queries, v is the small step size, and u j ,j=1…Q are unit vectors that are orthogonal to each other;

[0032] Get the δth k The gradient at , the gradient information of the comprehensive historical process is used to calculate the basic perturbation vector δ′:

[0033]

[0034] Where k is the number of iterations, and β is the parameter that coordinates the historical gradient information and the gradient information estimated in this iteration;

[0035] This basic perturbation vector combines the gradient information in the historical iteration process, making δ′ closer to δ k The true gradient at

[0036] The basic perturbation vector δ′ is a vector of the same dimension as the original digital image. The basic perturbation vector is converted into an RGB representation corresponding to the original digital image. The numerical center of gravity of the three-dimensional matrix is calculated by the triple integral method:

[0037]

[0038] Where (x', y', z') is the center of gravity of the original digital image, x, y, z are the subscripts of the width, height, and channel dimensions of the original digital image, respectively; W is the width of the original digital image, H is the height of the original digital image, and C is the number of channels of the original digital image;

[0039] Using the numerical center of gravity of δ′ as the center, the Anchor generate algorithm is used to generate a set of rectangular boxes with different shapes as the candidate shapes of the perturbation vector;

[0040] The Anchor generation algorithm is to transform the pre-given basic parameters and use them as the length and width of the generated rectangle;

[0041] Let the transformation ratio be ratio, the basic parameter be ρ, and the length and width transformed on it be:

[0042]

[0043] Among them, h″, w″ are the length and width of the generated rectangle; ratio and ρ are hyperparameters;

[0044] Each basic parameter ρ i A set of length and width will be generated, corresponding to two rectangles, and ρ i Directly use the side length to correspond to a square; finally generate a rectangle candidate set;

[0045] According to the centroid of the feature map, that is, the numerical centroid of the three-dimensional matrix and the set of rectangle candidates, start from the rectangle with the smallest area in sequence, set the color of the rectangle to black and align its center with the centroid of the basic perturbation vector δ′ and attach it to the corresponding position of the original digital image to generate a sticker until the sticker with the smallest area that causes the target classification model to misjudge is found; when the iteration condition is not met, the basic perturbation vector is used as the initialization for the next iteration to continue the calculation; when the iteration condition is met, the adversarial sample with the smallest sticker area in the historical process is output.

[0046] The general idea adopted by existing score-based black-box attack algorithms is to use the initial point of the image as the iteration starting point, calculate the gradient of the point to the objective function, and then update the iteration point along the gradient direction in a certain update method. Through continuous iterative calculation, the iteration point is finally moved outside the model decision boundary, and the arithmetic distance between the point and the original point is constrained so that the perturbation is not abrupt to the human eye. The present invention only controls the number of perturbed pixels without controlling the degree of perturbation on these pixels. It uses rectangular perturbation as the perturbation unit and continuously iterates to optimize the area and position of the perturbation rectangle, where the pixel color in the generated rectangle is set to black. The present invention can ensure that there is at least one available adversarial image in each iteration process, and as the number of iterations increases, the quality of the adversarial sample will also get better and better.

[0047] In addition, existing score-based attack methods all use the original image point as the starting point and continuously move it outside the decision boundary through an optimization algorithm. This method may cause the optimization algorithm to not find the optimal solution, which leads to a low attack success rate of existing methods. Unlike other methods, the general idea of generating adversarial samples in the present invention is to continuously search for the minimum perturbation point with adversarial properties between the iteration point and a point outside the decision boundary. Specifically, at the beginning of each iteration, the gradient of the iteration point with respect to the objective function is first calculated, and several candidate rectangles are generated with the numerical center of gravity of the gradient as the center. The area range of these rectangles is sufficient to cover both sides of the decision boundary. The algorithm will select rectangles one by one in order of area from small to large as black stickers to be added to the image until a sticker with adversarial properties and the smallest area is found. Finally, the previously calculated gradient is used to update the iteration point and enter the next iteration. This update scheme ensures that the algorithm has at least one available adversarial sample in each iteration, thereby improving the success rate.

[0048] Furthermore, in existing score-based black-box attack algorithms, the accuracy of gradient estimation and the number of queries consumed are key to improving the algorithm's effectiveness. This paper uses a gradient estimation method optimized with a time prior to accelerate the algorithm's convergence and attack effectiveness.

[0049] Based on the existing technology, the beneficial effects of the present invention are as follows: the method proposed by the present invention has the characteristics of high query efficiency and high attack success rate; the generated adversarial samples have a high attack success rate and good quality, and are not easily discovered by the attacked model. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 Flowchart of a score-based sticker adversarial attack method;

[0051] Figure 2 This diagram shows the effect of generating rectangles using the Anchor generate algorithm. DETAILED DESCRIPTION

[0052] The implementation of the present invention can be divided into two parts: task abstraction and generation process.

[0053] The task abstraction part is to abstract the specific attack task into an objective function, with the adversarial perturbation as input. By continuously reducing the value of the optimized objective function, the perturbation corresponding to the optimal value can be solved to generate adversarial samples.

[0054] The generation process is the process of continuously reducing the objective function value under the black box setting conditions, which is the optimization algorithm.

[0055] 1. Task abstraction

[0056] First, the objective function requires a digital original image x0 and the target classification model f(·) as input. The classification model f(·) accepts the digital matrix of the digital original image as input and outputs a classification probability vector P corresponding to each category of the digital original image. Generally speaking, the category corresponding to the subscript corresponding to the largest value in the vector is taken as the final classification result.

[0057] This method then abstracts these into two objective functions, targeting and untargeted attacks, to meet different attack requirements. The targeted attack involves generating adversarial examples that cause the target classification model to misclassify them. The untargeted attack, on the other hand, involves generating adversarial examples that cause the target model to classify them as a specific class. The objective functions for the targeted and untargeted attacks are as follows:

[0058] (1) Untargeted attack

[0059]

[0060] Among them, δ is the adversarial disturbance, P t is the classification probability of the true class corresponding to the digital original image x0; P_{dodg} is the probability that the digital original image x0 is classified as a non-original true class t;

[0061] This loss function abstracts the task of untargeted attack. Specifically, when the probability of an image being classified as the true class is maximized, the corresponding loss value is positive; when the probability of classification for another class is maximized, the loss function becomes negative, and the input at this point also becomes an adversarial example. Furthermore, thanks to the continuity of the loss value, its derivative with respect to any input point in image space is meaningful and easy to estimate.

[0062] Well-trained classifiers often output a score vector for a given image where the true class scores much higher than other classes, which is detrimental to the generation of adversarial examples. This formula mitigates this effect by taking the logarithm of the classification probability, making the objective function easier to optimize.

[0063] (2) Target Attack

[0064] The target formula for a targeted attack can be obtained by transforming the target formula for an untargeted attack, as follows:

[0065]

[0066] Among them, δ is the adversarial disturbance, P i is the probability that the original digital image x0 is classified into the target category i;

[0067] P_{imper} is the probability that the original digital image x0 is classified as non-target class i.

[0068] In a targeted attack, when the score of the image classified as the target category is not the largest, the loss value is positive; when the classification score of the target category becomes the largest, the loss value is negative, which also means that the targeted attack adversarial sample is successfully generated.

[0069] 2. Generation process

[0070] The difference between the targeted attack and non-targeted attack tasks in this invention lies only in the objective function, which is used for different attack tasks. Targeted attack is used as an example to demonstrate how to generate adversarial samples.

[0071] The general idea of this algorithm is to not access internal model information, but to continuously reduce the value of the objective function by estimating the gradient and adjusting the adversarial perturbation to generate adversarial examples. Specifically, the perturbation vector added to the original image appears as a black rectangular block on the image, and its size and color are continuously reduced in subsequent iterative calculations to improve the quality of the adversarial example. The detailed calculation steps are as follows:

[0072] Initialization: The objective function corresponding to the attack task; the original digital image x0; the real classification category t is selected for the non-targeted attack task; the target category i is selected for the targeted attack task; let the adversarial perturbation δ be a 0 vector with the same dimension as the initial sample.

[0073] First, the target formula loss is estimated at point δ by the following formula k The gradient at:

[0074]

[0075] Where k is the number of iterations, d is the image dimension, Q is the number of queries, v is the small step size, and uj ,j=1…Q are unit vectors that are orthogonal to each other.

[0076] In getting the δ k After the gradient at , the gradient information of the historical process is integrated to calculate the basic perturbation vector δ′:

[0077]

[0078] Where k is the number of iterations, and β is the parameter that coordinates the historical gradient information and the gradient information estimated in this iteration.

[0079] This basic perturbation vector combines the gradient information in the historical iteration process, making δ′ closer to δ k The true gradient at .

[0080] Here, the calculated δ′ is a vector of the same dimension as the original digital image, so it can be converted into an RGB three-dimensional matrix representation corresponding to the original image. The numerical center of gravity of the three-dimensional matrix is then calculated using the triple integral method:

[0081]

[0082] Afterwards, the algorithm uses the Anchor generate algorithm to generate a set of rectangular boxes with different shapes centered on the numerical center of gravity of δ′, which serve as the candidate shapes for the subsequent perturbation vector.

[0083] The general process of the Anchor generation algorithm is that the algorithm transforms the pre-given basic parameters and uses them as the length and width of the generated rectangle. The details are as follows:

[0084] Assume that the transformation ratio is ratio and the basic parameter is ρ, then the length and width transformed on it are:

[0085]

[0086] Where h″, w″ are the length and width of the generated rectangle.

[0087] Then for each basic parameter ρ i A set of length and width will be generated, corresponding to two rectangles, and ρ i Directly using it as the side length also corresponds to a square. Finally, a large number of rectangle candidate sets can be generated by a small number of basic parameters, such as Figure 2 As shown:

[0088] At this point, the centroid of the feature map and the set of candidate rectangles are ready. Next, the algorithm sequentially starts with the smallest anchor, sets its color to black, aligns its center with the centroid of the basic perturbation vector δ′, and attaches it to the corresponding position in the original image to generate a sticker, until it finds the sticker with the smallest area that can cause the target classifier to misclassify. If the iteration conditions are not met, the calculation continues with the basic perturbation vector as the initialization for the next iteration; if they are met, the adversarial example with the smallest sticker area in the history is output. The classification model selected for attack is the densenet deep learning network, and the dataset is a human face dataset with 1,000 images and 225 categories. The classification probabilities of correct classification before the attack and incorrect classification probabilities after the attack are annotated. The results show that the confidence probability of the true class in the original digital image is 97-99%, while the confidence probability of the perturbation class drops to 40%-70% after the attack.

Claims

1. A score-based sticker counterattack method, characterized in that: The score-based sticker adversarial attack algorithm includes task abstraction and generation processes. Task abstraction is to abstract the specific attack task into an objective function, with the adversarial perturbation as input. By continuously reducing the value of the optimized objective function, the corresponding perturbation is obtained when the optimal value is obtained, and the adversarial sample is generated. The generation process is the process of continuously reducing the objective function value under the black box setting conditions, which is the optimization algorithm. The specific steps are as follows: 1) Task abstraction Input a digital original image x0 and the target classification model f(·) to be attacked into the objective function; input the digital matrix of the digital original image x0 into the target classification model f(·), output the classification probability vector P corresponding to the digital original image x0, and take the category corresponding to the maximum value subscript in the classification probability vector P as the final classification result; According to different attack requirements, there are two abstract objective functions: targeted attack and untargeted attack. The content of targeted attack is to generate adversarial samples to make the target classification model misjudge; the content of untargeted attack is to generate adversarial samples to make the target model classify them as a specified class. 1.1) The objective function of untargeted attack is as follows: Among them, δ is the adversarial disturbance, P t is the classification probability of the true class corresponding to the digital original image x0; P_{dodg} is the probability that the digital original image x0 is classified as a non-original true class t; 1.2) Targeted Attacks The objective function of the targeted attack is obtained by transforming the objective formula of the untargeted attack as follows: Among them, δ is the adversarial disturbance, P i is the probability that the original digital image x0 is classified into the target category i; P_{imper} is the probability that the original digital image x0 is classified as non-target class i; In a targeted attack, when the score of the original digital image classified as the target category after the adversarial perturbation is added is not the largest, the loss value is positive; when the classification score of the target category is the largest, the loss value is negative, indicating that the targeted attack adversarial sample has been successfully generated; 2) Generation process Use different objective functions for different attack tasks; 2.1) Generation of adversarial examples; Without accessing the internal information of the attacked classification model, the adversarial sample is generated by continuously reducing the value of the objective function by estimating the gradient and adjusting the adversarial perturbation. The perturbation vector added to the original digital image appears as a black rectangular block on the image, and its size and color are continuously reduced in subsequent iterative calculations to improve the quality of the adversarial sample. The calculation steps are as follows: Initialize the following parameters: the target function for the corresponding attack task; the original digital image x0; let the adversarial perturbation δ be a 0 vector with the same dimension as the initial sample point; select the true classification category t when there is no target attack task; select the target category i when there is a target attack task; The objective function formula loss is estimated at point δ by the following formula k The gradient at: Among them, k is the number of iterations, d is the image dimension, Q is the number of queries, v is the small step size, and u j ,j=1…Q are unit vectors that are orthogonal to each other; Get the δth k The gradient at , the gradient information of the comprehensive historical process is used to calculate the basic perturbation vector δ′: Where k is the number of iterations, and β is the parameter that coordinates the historical gradient information and the gradient information estimated in this iteration; This basic perturbation vector combines the gradient information in the historical iteration process, making δ′ closer to δ k The true gradient at The basic perturbation vector δ′ is a vector of the same dimension as the original digital image. The basic perturbation vector is converted into an RGB representation corresponding to the original digital image. The numerical center of gravity of the three-dimensional matrix is calculated by the triple integral method: Where (x', y', z') is the center of gravity of the original digital image, x, y, z are the subscripts of the width, height, and channel dimensions of the original digital image, respectively; W is the width of the original digital image, H is the height of the original digital image, and C is the number of channels of the original digital image; Using the numerical center of gravity of δ′ as the center, the Anchor generate algorithm is used to generate a set of rectangular boxes with different shapes as the candidate shapes of the perturbation vector; The Anchor generation algorithm is to transform the pre-given basic parameters and use them as the length and width of the generated rectangle; Let the transformation ratio be ratio, the basic parameter be ρ, and the length and width transformed on it be: Among them, h″, w″ are the length and width of the generated rectangle; ratio and ρ are hyperparameters; Each basic parameter ρ i A set of length and width will be generated, corresponding to two rectangles, and ρ i Directly use the side length to correspond to a square; finally generate a rectangle candidate set; According to the centroid of the feature map, that is, the numerical centroid of the three-dimensional matrix and the set of rectangle candidates, start from the rectangle with the smallest area in sequence, set the color of the rectangle to black and align its center with the centroid of the basic perturbation vector δ′ and attach it to the corresponding position of the original digital image to generate a sticker until the sticker with the smallest area that causes the target classification model to misjudge is found; when the iteration condition is not met, the basic perturbation vector is used as the initialization for the next iteration to continue the calculation; when the iteration condition is met, the adversarial sample with the smallest sticker area in the historical process is output.

Images