A lightweight and high-concealment black-box cracking method for an NLP model

Abstract

The application discloses a kind of light and high concealment's black box attack method for NLP model.The steps of the present application are: 1, according to victim sample set, target model, classification label, attack ratio call word importance calculation algorithm, determine victim word;2, according to victim word, word historical information table, classification label, candidate word table budget, call construction candidate word table algorithm, determine the candidate word table of victim word candidate word table;3, calculate the confidence score difference of victim word and corresponding candidate word in victim text, update the historical information table of the victim word;While calling text similarity function and confidence score calculation algorithm, determine the adversarial sample.The present application reduces the size of candidate word table by optimizing and improving the method of word conversion stage, uses historical attack information and carries out statistical test simultaneously, thereby reduces the number of target model query bag, enhances the concealment of attack, reduces the detection risk of security system.

Description

TECHNICAL FIELD

[0001] The application provides a black-box adversarial sample generation method for an NLP model. BACKGROUND

[0002] In various natural language processing (NLP) applications, deep neural networks have been proven to be effective, but deep neural networks are vulnerable to adversarial samples, which are malicious samples formed by deliberately adding subtle interference in the dataset, causing the model to give a wrong output with high confidence. In many cases, the original sample and the adversarial sample are very similar, and a human observer cannot perceive the difference between the original sample and the adversarial sample, but the target model will make very different predictions. For NLP models, the existing adversarial cracking method is mainly black-box cracking. The existing black-box cracking method mainly includes two stages. The first stage is to calculate the importance score of the words in the victim sample, then the words are sorted according to the importance score, the victim words are selected and sent to the second stage; in the second stage, for each victim word, use its entire bag of synonyms as a candidate word table, then the target model needs to be queried to determine whether it constitutes an adversarial sample. In the word importance calculation stage and the word conversion stage, the target model needs to be queried a lot, and the results of the target model processing are used to construct adversarial samples. Therefore, the existing black-box cracking method is not suitable for large-scale complex NLP models, which is reflected in:

[0003] (1) The existing black-box cracking method for NLP rarely optimizes the query efficiency of the model. Only a few methods focus on the optimization of the first stage. These methods are very sensitive to the selection of data and the quality of model training, which limits the universality of these methods. Among them, black-box cracking refers to a cracking scenario where the cracker only knows the input and output information of the target model, and knows nothing about other information of the target model; among them, the query efficiency refers to the number of input samples that need to be processed by the target model in the process of generating adversarial samples, that is, the fewer the number of samples that need to be processed, the higher the efficiency, and the cracking also has higher concealment.

[0004] (2) The second stage of the existing black box cracking method mainly uses the entire synonym bag of the victim word as the candidate word list of the victim word. This conversion method requires the target model to query each word in the candidate word list, which will result in a high number of queries. Among them, the victim word refers to the relatively important word in the sample, and the effect will be better if the cracking of such words is carried out; the synonym bag refers to the synonym set obtained for a single victim word through a synonym knowledge base or an algorithm; and the synonym knowledge base includes but is not limited to Harbin Institute of Technology Cilin, HowNet, etc., and the related algorithm includes but is not limited to similarity measurement, mutual ranking method, Word2Vec (an effective method for learning distributed low-dimensional word-level representation (called word vector or word embedding)), etc. SUMMARY

[0005] The purpose of the present application is to provide a lightweight and high-concealment black box adversarial sample generation method for NLP models. The present application improves the method of the word conversion stage by studying the optimization strategy for the second stage of black box cracking, improves the query efficiency of the model, and also proves that the method has good universality. At the same time, in the word conversion stage, the present application uses historical cracking information and performs statistical testing to reduce the size of the candidate word list, thereby reducing the number of target model query bags and enhancing the concealment of the cracking. The cracking method provided by the present application for reducing the number of model queries is suitable for various NLP model architectures, and can have better cracking performance compared to other existing cracking methods.

[0006] The technical solution adopted by the present application to solve its technical problems is as follows:

[0007] Step 1, calling a word importance calculation algorithm according to the victim sample set, the target model, the classification label and the cracking ratio to determine the victim word.

[0008] Step 2, calling a candidate word list construction algorithm according to the victim word, the word historical information table, the classification label and the candidate word list budget to determine the candidate word list of the victim word.

[0009] Step 3, according to the candidate word list, the victim word, the word historical information table, the text similarity function, the target model and the classification label, first calculating the confidence score difference of the victim word and the corresponding candidate word in the victim text, updating the historical information table of the victim word, and simultaneously calling a text similarity function and a confidence score calculation algorithm to determine the adversarial sample.

[0010] Victim word determination: calling a word importance calculation algorithm according to the victim sample set, the target model, the classification label and the cracking ratio to determine the victim word.

[0011] The victim sample set refers to a data set that needs to be processed by the target model, and the types of the victim sample set include but are not limited to: text classification (for example: MR data set, IMDB data set, etc. The MR data set refers to Movie Review Data, which contains 5331 positive movie review texts and 5331 negative movie review texts; the IMDB data set refers to 50,000 seriously polarized reviews from the Internet Movie Database (IMDB).), sentiment analysis (for example: Yelp data set, etc. The Yelp data set is composed of about 160,000 merchants, 8.63 million reviews and 20,000 picture data from 8 metropolitan areas, mainly the user's rating of the merchant.), etc.

[0012] The target model refers to an NLP model that completes various NLP tasks, and the NLP tasks include but are not limited to text binary classification, text entailment and topic model, etc. The text classification refers to automatic classification of documents according to certain classification standards (for example, according to topics or content division, etc.), and the text binary classification is a special case of text classification when the number of categories is equal to two; the text entailment refers to inferring the relationship between the hypothesis text and the premise according to the premise given, which is generally divided into entailment and contradiction, the entailment means that the hypothesis can be inferred from the premise; the contradiction means that the hypothesis is contradictory to the premise, and the result of the text entailment is the probability value of the inference; the topic model refers to a statistical model for finding abstract topics in a series of documents. Intuitively, if an article has a central idea, some specific words will appear more frequently. The target model types include but are not limited to: WordCNN, WordLSTM, BERT, LDA, etc. The WordCNN is a model that applies the convolutional neural network CNN to text processing, mainly used for text classification; the WordSTM is a model that applies the LSTM (Long Short Term Memory) to text processing, and the LSTM is a neural network with the ability to remember long and short term information; the BERT (Bidirectional Encoder Representation from Transformers) is a pre-trained language representation model, which is a model for converting text into corresponding text vectors; the LDA (Latent Dirichlet Allocation) is a document topic generation model, also known as a three-layer Bayesian probability model, which contains three layers of word, topic and document structure.

[0013] The classification label refers to the classification result of the data sample after being processed by the target model in theory.

[0014] The cracking ratio refers to the proportion of the number of victim words obtained from the victim sample in the entire sample set.

[0015] Further, the determination of the victim word in step 1 mainly includes two steps: calculation of word importance score and determination of victim word.

[0016] (1) Calculation of word importance score: according to the victim sample, the classification label and the target model, the importance score is calculated to determine the importance score table. The specific steps include but are not limited to: first, using the target model, the difference between the confidence score before and after the word in the victim sample is deleted is calculated as the importance score of the word; wherein the confidence score refers to the confidence degree of the target model to the current sample, which is generally a real number between 0 and 1, indicating the probability that the sample belongs to this category. The formula for calculating the importance score is as follows:

[0017] When the predicted label of the target model after processing is the same as the classification label Y X ,

[0018]

[0019] When the predicted label of the target model after processing is different from the classification label Y X ,

[0020]

[0021] Wherein, I(w i ) represents the importance score of the word w i in the sample X; X / {w i} represents the new sample after removing the word w i from the sample X; represents the confidence score of the original victim sample X processed by the target model M in theory, represents the confidence score of the new sample X / {w i} processed by the target model M in practice. The importance score of each word in the sample is calculated according to the above method. Finally, after processing all the words in the victim sample, the importance score of each word in the victim sample is determined, and the importance score table is obtained.

[0022] (2) Determination of victim word: according to the importance score table in (1) and the cracking ratio to determine the victim word. The specific steps include but are not limited to: using the importance score to sort the words in the victim sample, and selecting a certain number of words by setting the cracking ratio to determine the victim word.

[0023] Further, the determination of the candidate word list of the victim word in step 2 is implemented as follows:

[0024] According to the victim word, the historical information table of the word, the classification label, and the candidate word list budget, a candidate word construction algorithm is called to determine the candidate word list of the victim word. The historical information table of the word refers to a table for storing historical candidate word information of the victim word, and each victim word has a unique historical candidate word table. The historical candidate word refers to a word that has been used to replace the victim word in the previous stage. The information of the historical candidate word includes but is not limited to the confidence score difference caused by using the candidate word for replacement, the mean and variance of the score of the entire candidate word list, the size of the entire candidate word list, etc. The candidate word list budget refers to the number of main candidate words selected from the initial candidate word list in the candidate word construction algorithm, wherein the main candidate word refers to a word used for subsequent hypothesis testing. The initial candidate word list refers to a word list composed of the candidate words corresponding to the victim word in the historical information table when the victim word appears again, and the specific process is as follows Figure 2 .

[0025] The determination of the candidate word list of the victim word mainly includes three steps: determining the initial candidate word list, determining the main candidate word, and determining the final candidate word list of the victim word.

[0026] (1) Determination of the initial candidate word list: according to the victim word, the synonym bag of the victim word, the historical information table, and the classification label, the initial candidate word list is determined. The specific steps include but are not limited to: first, it is judged whether the corresponding historical information table of the victim word is empty, if yes, the entire synonym bag of the victim word is directly assigned to the initial candidate word list, which is also the final candidate word list; if not, the candidate words in the historical information table are assigned to the initial candidate word list.

[0027] (2) Determination of the main candidate word: according to the initial candidate word list in (1), the historical information table, and the candidate word list budget, the main candidate word is determined. The specific steps include but are not limited to: first, the confidence score difference of each word in the initial candidate word list is obtained; finally, the main candidate word is determined by sorting according to the confidence score information of the initial candidate word list and the candidate word list budget.

[0028] (3) Determination of the final candidate word list of the victim word: according to the main candidate word in (2), the t-distribution hypothesis testing is used to determine the final candidate word list. The specific steps include but are not limited to: first, hypothesis testing is performed on each word in the initial candidate word list and the main candidate word, and the specific formula of hypothesis testing is as follows:

[0029] null: μ c ≤ μ pivot vs. alternative: μ c > μ pivot(3)

[0030] wherein μ c and respectively represent the confidence score of the model after replacing the victim word with the candidate word c pivot in the initial candidate word list.

[0031]

[0032] wherein, and represent the mean and variance estimator of the confidence score difference caused by replacing the word w with the word c in the history information table; and represent the mean and variance estimator of the confidence score difference caused by replacing the word w with the word c pivot in the history information table; given a specified significance level a, calculate the 1-a quantile of the t-distribution, which corresponds to the degrees of freedom in the variance estimator, denoted as Next, if we reject the null hypothesis, then the candidate word c is included in the candidate word list. If we accept the null hypothesis, then the candidate word c is not included in the candidate word list. According to the above formula, the specific steps are as follows: for each word c in the initial candidate word list, perform hypothesis testing to update the candidate word list until all words are processed to determine the final candidate word list.

[0033] Further, the specific implementation of the pair of adversarial samples determined in step 3 is as follows:

[0034] The determination of the adversarial sample mainly includes two steps: updating the history information table and determining the adversarial sample.

[0035] (1) Update the history information table: according to the victim sample, the victim word, the classification label, the final candidate word list, and the history information table, calculate the confidence score difference, and update the history information table of the victim word with the confidence score difference. The specific steps include but are not limited to: first, replace the corresponding victim word in the victim sample with the candidate word in the final candidate word list to generate the corresponding candidate sample of the victim sample; then, calculate the confidence score difference of the candidate sample and the victim sample using the target model, and finally update the history information table of the victim word with the confidence score difference.

[0036] (2) determining the adversarial sample: according to the candidate sample, the victim sample, the target model, the victim word, the classification label, the candidate word table of (1), determining the optimal candidate sample, thereby determining the adversarial sample. The specific steps include but are not limited to: first, if the replaced candidate sample can successfully crack the target model (i.e. make the target model make wrong prediction), select the most similar candidate sample to the victim sample through text similarity, as the optimal candidate sample; Otherwise, calculate the confidence score difference of the candidate sample and the victim sample, select the candidate sample with the maximum difference value, as the optimal candidate sample, update the adversarial sample. If there is only one candidate sample that can successfully crack the target model after replacement, it is selected as the optimal candidate sample.

[0037] Finally, repeat the above steps until all victim samples are processed, and finally determine the final adversarial sample set.

[0038] The beneficial effects of the present application are as follows:

[0039] 1. By first considering the research on the second stage of black box cracking, the method of improving the synonym bag-of-words based on the victim word for word conversion is determined, which improves the query efficiency of the model, and also proves that the method has good universality.

[0040] 2. By using historical cracking information and statistical test method, the size of the candidate word table is reduced, so the number of target model query word bags is reduced, and the concealment of cracking is enhanced. BRIEF DESCRIPTION OF DRAWINGS

[0041] Figure 1 The flow chart of black box cracking;

[0042] Figure 2 The flow chart of candidate table determination. DETAILED DESCRIPTION

[0043]

Example 1

[0044] In this embodiment, the target model uses a text convolution model (hereinafter referred to as WordCNN), the data set is a movie review data set (hereinafter referred to as MR), the corresponding NLP task is text binary classification, the word embedding data set is glove, which is used to fill the samples in the MR data set, so that the dimensions of the processed samples are the same, the cracking rate is 1.0, the number of words in the synonym bag-of-words is 50, the candidate word table budget is 0.5, and the size of each batch processing is 32.

[0045] Further, the symbols required in this example and their meanings are as follows.

[0046] M represents the target model, X represents the victim sample, represents the victim sample removing the word w ithe predicted label (0 or 1) of the victim sample after processing by the target model, Y X the classification label (0 or 1) corresponding to the victim sample, I(w i ) the importance score of the word w i in the sample, X / {w i} the new sample after removing the word w i from the sample X, the confidence score of the target model M processing the original victim sample X in theory, the confidence score of the target model M processing the new sample X / {w i} in practice, ε the cracking rate, W * the victim word list, c i the i-th candidate word of a victim word, H(w, c i ) the historical information generated when the victim word w is replaced by c i in the victim sample, C initial the initial candidate word list, γ the candidate word list budget, μ c the impact of the candidate word c replacing the victim word on the model in the initial candidate word list, μ pivot the impact of the main candidate word c pivot replacing the victim word on the model in the initial candidate word list.

[0047] 3. Victim word determination: according to the victim sample set, the target model, the classification label, and the cracking rate, call the word importance calculation algorithm to determine the victim word.

[0048] (1) Calculation of word importance score: In this example, the target model uses WordCNN, and the victim sample set is processed MR. The corresponding NLP task is text binary classification, so the classification label is 1 or 0. The formula for calculating the importance score is as follows:

[0049] When the predicted label Y of the target model after processing is the same as the classification label Y X

[0050]

[0051] When the predicted label Y of the target model after processing is different from the classification label Y X

[0052]

[0053] where I(w i ) represents the importance score of the word w i in the sample X; X / {w i ​​} represents the sample X removing the word w i new sample; represents the confidence score of the target model M processing the original victim sample X, represents the confidence score of the target model M processing the new sample X / {w i The importance score of each word in the sample is calculated according to the method described above.

[0054] Here, taking WordCNN as an example, the steps of calculating the word importance score are as follows: according to the above formula, the WordCNN model is used to process the victim sample X, and the confidence scores before and after deleting the word w i are calculated, and the difference between the two is calculated to calculate the importance score I(w i ).

[0055] (2) Victim word determination

[0056] First, according to the importance score I(w i ) of each word in the sample calculated in (1), the words that do not need to be processed are removed through the importance score threshold and the stop word bag.

[0057] Second, the importance score I(w i ) of the word processed in the first step is sorted, the length of the current victim sample is calculated, and the cracking ratio ε is used to determine the top words as victim words w, where |X| represents the length of the victim sample, and the final victim word table W * is determined.

[0058] 4. Determination of the candidate word table of the victim word: The determination of the candidate word table of the victim word needs a historical information table, in the WordCNN instance, the historical information table mainly stores the historical information of the victim word and its corresponding candidate word, and the specific situation is as follows:

[0059] Table 1 Historical information table

[0060] Victim word Candidate word list Confidence score difference Classification label w1 (c1,c2,c3...) [CDATA[H(w1,c i ) i=1,2,3...]] 1 or 0 w2 (c1, c2, c3,...) H(w2, c i ) i=1,2,3... 1 or 0 ... ...... ...... ...

[0061] (1) Determination of the initial candidate word table: First, the synonym bag of the victim word w needs to be determined, in this instance, the cosine similarity is used to obtain the synonyms of the victim word, and the size of each synonym bag is fixed at 50 words. The steps of determining the initial candidate word table are as follows: judge whether there is related information of the word in the word historical information table, if not, directly assign the entire synonym bag to the initial candidate word table, and at the same time, it is used as the last candidate word table of the word. Otherwise, assign the synonyms corresponding to the victim word w in the historical information table to the initial candidate word table C initial .

[0062] (2) The determination of the main candidate word: according to the initial candidate word table in the last step, in the instance of WordCNN, the candidate word table budget γ is 0.5, which is used to determine the main candidate word. The specific steps are as follows:

[0063] First, according to the historical information in the initial candidate word table, each word in the candidate word table is sorted.

[0064] Second, according to the length of the initial candidate word table and the candidate word table budget γ, the first word is determined as the main candidate word c pivot , where |C initial | represents the length of the initial candidate word table.

[0065] (3) The determination of the candidate word table of the victim word: according to the initial candidate word table and the main candidate word, the final candidate word table is determined by using hypothesis testing. The specific formula of hypothesis testing is as follows:

[0066] null: μ c ≤ μ pivot vs. alternative: μ c > μ pivot (7)

[0067] μ c and μ pivot represent the influence of the candidate word c in the initial candidate word table on the model after replacing the victim word with the main candidate word c pivot .

[0068]

[0069] and represent the average and variance estimates of the confidence score difference caused by replacing the word w with the word c in the historical information table; and represent the average and variance estimates of the confidence score difference caused by replacing the word w with the word c pivot in the historical information table; given a specified significance level α, calculate the 1-α quantile of the t distribution, which corresponds to the degrees of freedom in the variance estimator, denoted as Next, if we reject the null hypothesis, then the candidate word c is included in the candidate word table. If we accept the null hypothesis, then the candidate word c is not included in the candidate word table. According to the above formula, the specific steps are as follows: for each word c in the initial candidate word table, perform hypothesis testing to update the candidate word table until all words are processed to determine the final candidate word table.

[0070] 5. The determination of the adversarial sample:

[0071] (1) Update the history information table: After determining the candidate word table corresponding to the victim word, the specific history information table of the victim word needs to be updated. The specific steps include but are not limited to: first, replace the corresponding victim word in the victim sample with the candidate word in the candidate word table to generate the corresponding candidate sample; then, calculate the confidence score of the candidate sample and the victim sample using the target model; finally, update the candidate word and its confidence score difference to the history information table of the victim word.

[0072] (2) Determine the adversarial sample: When determining the adversarial sample, there are two cases. If the candidate sample obtained by replacing the victim sample with the candidate word can successfully make the WordCNN make an incorrect prediction, the candidate sample most similar to the victim sample is selected as the adversarial sample of the sample. If it cannot successfully crack the target model, the optimal candidate word is calculated using the following formula to obtain the corresponding candidate sample as the adversarial cracking sample:

[0073]

[0074] The specific steps include but are not limited to: first, if the replaced candidate sample can successfully crack the target model (i.e. make the target model make an incorrect prediction), select the candidate sample most similar to the victim sample as the optimal candidate sample; otherwise, calculate the confidence score of the candidate sample and the victim sample, select the candidate sample with the largest score as the optimal candidate sample, and update the adversarial sample. Finally, repeat the above steps until all victim samples are processed, and the final adversarial sample can be determined.

[0075] The following table shows the comparison between the adversarial sample and the original sample.

[0076] Table 2 Comparison table

[0077] Dataset MR Original accuracy 78％ Cracked accuracy 1.5％ Candidate word list budget (word confusion ratio) 12.7％ Semantic similarity 95.7％ Average query number 52.3 Text average length 20 .

Claims

1. A lightweight and high-concealment black-box cracking method for an NLP model, characterized in that, By optimizing the second stage of black box cracking, improving the method of word conversion stage, and improving the query efficiency of the model; At the same time, in the word conversion stage, use the historical cracking information and carry out statistical test, reduce the size of the candidate word table, so as to reduce the number of target model query word bag, enhance the concealment of cracking, reduce the risk of security system detection; The specific implementation steps are as follows: Step 1, according to the victim sample set, target model, classification label, cracking ratio, calling word importance calculation algorithm, determine the victim word; Determine the victim word includes two steps: word importance score calculation, victim word determination; 1-1. Calculation of word importance score: First, use the target model to calculate the confidence score difference of the words in the victim sample before and after the word is deleted as the importance score of the word; Secondly, after processing all the words in the victim sample, the importance score of each word in the victim sample is determined, and the importance score table is obtained; 1-2. According to the importance score table in step 1-1, the cracking ratio is used to determine the victim word: the importance score of the word in the victim sample is sorted, and the specified number of words is selected by setting the cracking ratio to determine the victim word; Step 2, according to the victim word, the word history information table, the classification label, the candidate word table budget, calling the candidate word table construction algorithm, determining the candidate word table of the victim word; The candidate word table of the victim word includes three steps: determining the initial candidate word table, determining the main candidate word, and determining the final candidate word table of the victim word; 2-1. Determination of initial candidate word table: according to the victim word, the synonym bag of the victim word, the history information table, and the classification label, the initial candidate word table is determined; The specific steps include but are not limited to: first, judge whether the corresponding history information table of the victim word is empty, if yes, directly assign the entire synonym bag of the victim word to the initial candidate word table, which is also the final candidate word table; If not, assign the candidate words in the history information table to the initial candidate word table; 2-2. Determination of main candidate word: First, obtain the confidence score difference of each word in the initial candidate word table; Finally, sort according to the confidence score information of the initial candidate word table, and determine the main candidate word by the candidate word table budget; 2-3. Determination of the final candidate word table of the victim word; Based on the main candidate word, the t-distribution hypothesis test is used to determine the final candidate word table; Step 3, according to the candidate word table, the victim word, the word history information table, the text similarity function, the target model, and the classification label, first calculate the confidence score difference of the victim word and the corresponding candidate word in the victim text, update the history information table of the victim word, and call the text similarity function and the confidence score calculation algorithm to determine the adversarial sample; Adversarial sample determination includes two steps: updating the history information table and determining the adversarial sample; 3-1. Update the history information table: according to the victim sample, the victim word, the classification label, the final candidate word table, and the history information table, calculate the confidence score difference, and update the history information table of the victim word with the confidence score difference; Specifically: first, replace the corresponding victim word in the victim sample with the candidate word in the final candidate word table to generate the corresponding candidate sample of the victim sample; then calculate the confidence score difference between the candidate sample and the victim sample using the target model; finally, update the history information table of the victim word using the confidence score difference; 3-2. Determine the adversarial sample: according to the candidate sample, victim sample, target model, victim word, classification label, and candidate word table in step 3-1, determine the optimal candidate sample and thus determine the adversarial sample.

2. The method of claim 1, wherein the method is characterized by The victim word determination in step 1 is implemented as follows: The victim sample set refers to the data set that the target model needs to process; The target model refers to an NLP model that completes various NLP tasks; The classification label refers to the classification result of the data sample after being processed by the target model in theory; The cracking rate refers to the proportion of the number of victim words obtained from the victim sample to the entire sample set.

3. The method of claim 2, wherein the method is characterized by The determination of the candidate word table of the victim word in step 2 is implemented as follows: The history information table of the word refers to a table used to store the historical candidate word information of the victim word, and each victim word has a unique history candidate word table; the historical candidate word refers to a word that has been used to replace the victim word in the previous stage; the information of the historical candidate word includes but is not limited to the confidence score difference caused by using the candidate word for replacement, the mean and variance of the score of the entire candidate word table, and the size of the entire candidate word table; The candidate word table budget refers to the number of main candidate words selected from the initial candidate word table in the candidate word table construction algorithm, where the main candidate word refers to a word used for subsequent hypothesis testing; The initial candidate word table refers to a word table composed of candidate words corresponding to the victim word in the history information table when the victim word appears again.

4. The method of claim 3, wherein the method is characterized by Step 3-2 is implemented as follows: First, if the replaced candidate sample can successfully crack the target model, select the candidate sample most similar to the victim sample through text similarity as the optimal candidate sample; otherwise, calculate the confidence score difference between the candidate sample and the victim sample, select the candidate sample with the largest difference as the optimal candidate sample, and update the adversarial sample; if there is only one candidate sample that can successfully crack the target model after replacement, it is selected as the optimal candidate sample; Finally, repeat the above steps until all victim samples are processed to determine the final adversarial sample set.

Images