A method for improving the transferability of adversarial examples based on empirically accurate Nesterov momentum

Abstract

The present invention discloses a method for improving the transferability of adversarial samples based on empirical precise Nesterov momentum, which belongs to the field of artificial intelligence security. The method comprises: S1, obtaining empirical momentum and obtaining pre-trained empirical momentum through iterative training; S2, obtaining precise Nesterov momentum; S3, combining the pre-trained empirical momentum with the precise Nesterov momentum and applying them to adversarial attacks to improve the transferability of adversarial samples.

Description

Technical Field

[0001] The present invention belongs to the field of artificial intelligence security, and specifically relates to a method for improving the transferability of adversarial samples based on empirical precise Nesterov momentum. Background Art

[0002] Deep neural networks have been widely used in computer vision applications such as autonomous driving, facial recognition, and medical image analysis. However, Szegedy et al. discovered that adding certain imperceptible perturbations to images can cause deep neural networks to misclassify them. These perturbed images are called adversarial examples. Adversarial examples pose a significant threat to the security of deep neural networks, attracting widespread attention from researchers.

[0003] Given a target model f'(x;θ'), where x represents the input image and θ' is the parameter of f'. Let J(·,y) represent a loss function (e.g., cross entropy loss), where y represents the true label of x. adv -x|| p Under the constraint of ≤∈, there is no target adversarial sample x adv satisfy f'(x;θ')≠f'(x adv ;θ'), where ||·|| p express Norm, p is generally 0, 1, 2, ∞. Generating untargeted adversarial samples can be described as solving the following optimization problem:

[0004]

[0005] Many gradient-based white-box methods have been proposed to solve equation (1), such as FGSM, I-FGSM, and PGD. However, for black-box attacks, the parameters θ' of the target model f' are not available, which makes equation (1) impossible to solve directly by the above white-box methods. Therefore, the target model f' in equation (1) is usually replaced by a model f (i.e., the source model) with known parameters θ, so that equation (1) can be solved by white-box methods. In order for the adversarial samples generated on the source model f to effectively attack the target model f', the adversarial samples need to have high transferability. Summary of the Invention

[0006] In view of the shortcomings of the existing technology, the purpose of the present invention is to provide a method for improving the transferability of adversarial samples based on empirical precise Nesterov momentum.

[0007] The purpose of the present invention can be achieved through the following technical solutions:

[0008] The method for improving the transferability of adversarial examples based on empirically accurate Nesterov momentum includes the following steps:

[0009] S1, obtains the experience momentum and obtains the pre-trained experience momentum through iterative training;

[0010] S2, obtain accurate Nesterov momentum;

[0011] S3 combines the pre-trained empirical momentum with the exact Nesterov momentum and applies it to adversarial attacks to improve the transferability of adversarial samples.

[0012] Furthermore, in S1, the steps for obtaining the empirical momentum are:

[0013] S11, perform random channel swap operation on the input image x; the input image x is represented as an RGB triplet (R, G, B), where each element of the triplet represents the corresponding channel. The image after random channel swap is represented as S(x), then S(x)∈{(R, G, B),(R, BG),(G, R, B),(G, B, R),(B, R, G),(B, G, R)};

[0014] S12, input S(x) to the source model f to derive the model f(S(·); θ);

[0015] S13, pre-perturbs the input image x on the derived model f(S(·); θ) through a gradient-based attack; accumulates gradients during the pre-perturbation process to obtain empirical momentum.

[0016] Furthermore, steps S11-S13 are repeated, and the experience momentum is iteratively trained to obtain pre-trained experience momentum.

[0017] Furthermore, the steps to obtain the accurate Nesterov momentum are:

[0018] S21, let the current data point be x' and the current precise Nesterov momentum be g, then we can get a more detailed pre-update point by following the gradient direction and momentum direction of the current data point x':

[0019]

[0020] Where λ and ξ are hyperparameters, and grad(·) represents the gradient function;

[0021] S22, calculate the gradient of the pre-update point to correct the pre-update, and use the corrected pre-update vector as the new exact Nesterov momentum:

[0022]

[0023] Among them, β and γ are hyperparameters.

[0024] Furthermore, taking the iterative fast gradient sign method based on exact Nesterov momentum as an example, its t-th iteration process can be described as (2), (3), and (4):

[0025]

[0026]

[0027]

[0028] where g t represents the momentum after t iterations, and g0 = 0, μ represents the attenuation factor, α represents the step size, represents the gradient operator, J represents the loss function, f represents the source model with parameter θ, y represents the true label, ||·||1 represents the L1 norm, Represents the adversarial sample at the tth iteration, Clip (x,∈) {x} means truncating x to the range [x-∈, x+∈], and sign(·) represents the sign function.

[0029] Furthermore, the specific steps of S3 include:

[0030] S31, initialize the step size α to The empirical momentum g exp Initialized to 0;

[0031] S32, the sample Initialize to clean sample x;

[0032] S33, for samples Perform random channel swap operation; It is represented as an RGB triplet (R, G, B), where each element of the triplet represents the corresponding channel. The image after random channel swapping is represented as

[0033] S34, will Input to the source model f to derive the model f(S(·);θ);

[0034] S35, for samples Perform pre-update to get pre-update point

[0035]

[0036] S36, update the experience momentum g exp :

[0037]

[0038] S37, to the sample Add adversarial perturbations:

[0039]

[0040] S38, repeat steps S33-S37 T times;

[0041] S39, repeat steps S32-S38 until training epochs times to obtain a pre-trained experience momentum;

[0042] S310, will be adversarial sample Initialize to clean sample x, and set momentum g t-1 Initialized to empirical momentum;

[0043] S311, execute equations (2), (3), and (4) to update g t-1 and Get g t and

[0044] S312, execute step S311 T times;

[0045] S313, output adversarial samples

[0046] A system for improving the transferability of adversarial examples based on empirical precise Nesterov momentum, including: an empirical momentum training module, a precise Nesterov momentum acquisition module, and a combined application module;

[0047] The experience momentum training module is used to obtain experience momentum and obtain pre-trained experience momentum through iterative training;

[0048] Accurate Nesterov momentum acquisition module, used to obtain accurate Nesterov momentum;

[0049] Combined with the application module, it is used to combine the pre-trained empirical momentum with the precise Nesterov momentum and apply it to adversarial attacks to improve the transferability of adversarial samples.

[0050] A computer storage medium stores a readable program, and when the program is run, the above method is executed.

[0051] A device comprising: one or more processors, a memory for storing one or more programs;

[0052] When the one or more programs are executed by the one or more processors, the one or more processors are caused to perform the above method.

[0053] Beneficial effects of the present invention:

[0054] 1) Empirical momentum is a pre-training momentum that accumulates a large amount of gradients in advance to help traditional momentum accelerate rapidly in the early stages of optimization;

[0055] 2) To address the problem that the pre-update process of the traditional Nesterov momentum is relatively rough, the present invention proposes a precise Nesterov momentum. The precise Nesterov momentum additionally considers the gradient of the current data point to guide the pre-update, making the pre-update process more accurate.

[0056] 3) This paper combines empirical momentum with exact Nesterov momentum and applies it to adversarial attacks to improve the transferability of adversarial samples. Extensive experiments on normally trained models and defense models demonstrate that empirical exact Nesterov momentum is more effective than traditional momentum in improving transferability. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0058] Figure 1 Schematic diagram of the training experience momentum during each iteration of the present invention. DETAILED DESCRIPTION

[0059] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative efforts shall fall within the scope of protection of the present invention.

[0060] The method for improving the transferability of adversarial examples based on empirically accurate Nesterov momentum includes the following steps:

[0061] S1, training experience momentum, and obtaining a pre-trained experience momentum;

[0062] Momentum-based attacks initialize momentum to zero, resulting in inefficient momentum acceleration in the early stages of optimization. Therefore, this paper proposes a pre-trained empirical momentum (EM). Using EM as the initial value for momentum can effectively accelerate optimization early on. To prevent overfitting when training EM, a set of models is derived through random channel swapping (RCS), and empirical momentum is trained on this set of models. Performing random channel swapping on the input image is equivalent to randomly swapping the block dimensions of the original model.

[0063] The specific steps for training empirical momentum are as follows:

[0064] S11, perform random channel swap operation on the input image x; the input image x is represented as an RGB triplet (R, G, B), where each element of the triplet represents the corresponding channel. The image after random channel swap is represented as S(x), then S(x)∈{(R, G, B),(R, BG),(G, R, B),(G, B, R),(B, R, G),(B, G, R)};

[0065] S12, input S(x) to the source model f to derive the model f(S(·); θ);

[0066] S13, pre-perturbs the input image x on the derived model f(S(·); θ) through a gradient-based attack; in the process of pre-perturbation, the gradient is accumulated to obtain the empirical momentum, as shown in Figure 1 As shown;

[0067] S14, repeat steps S11-S13 until training epochs times to obtain a pre-trained empirical momentum; initializing the momentum to the empirical momentum can effectively accelerate optimization in the early stage; in addition, the termination condition of the training is set to stop at the iterative epochs; epochs is a hyperparameter, as the number of epochs increases, the performance will gradually improve and eventually converge, but the larger the number of epochs, the higher the training time cost; the specific number of epochs depends on the trade-off between performance and time cost.

[0068] S2, obtain accurate Nesterov momentum;

[0069] The traditional Nesterov momentum-based attack only performs a rough pre-update along the direction of momentum, which directly leads to inaccurate positions of the pre-update points. To address this shortcoming, the precise Nesterov momentum (PN) is proposed. The precise Nesterov momentum takes into account the gradient of the current data point to refine the pre-update. Generally speaking, let the current data point be x' and the current precise Nesterov momentum be g. Then, by successively following the gradient direction and momentum direction of the current data point x', a more detailed pre-update point can be obtained:

[0070]

[0071] Among them, λ and ξ are hyperparameters, and grad(·) represents the gradient function. Then, the gradient of the pre-update point is calculated to correct the pre-update, and the corrected pre-update vector is used as the new exact Nesterov momentum:

[0072]

[0073] Among them, β and γ are hyperparameters.

[0074] Taking the Iterative Fast Gradient Sign Method (I-FGSM) based on exact Nesterov momentum as an example, its t-th iteration process can be described as:

[0075]

[0076]

[0077]

[0078] where g t represents the momentum after t iterations, and g0 = 0, μ represents the attenuation factor, α represents the step size, represents the gradient operator, J represents the loss function, f represents the source model with parameter θ, y represents the true label, ||·||1 represents the L1 norm, Represents the adversarial sample at the tth iteration, Clip (x,∈) {x} means truncating x to the range [x-∈, x+∈], and sign(·) represents the sign function.

[0079] S3, combines the pre-trained empirical momentum obtained in S14 with the exact Nesterov momentum and applies it to adversarial attacks to improve the transferability of adversarial examples; the specific steps include:

[0080] S31, initialize the step size α to The empirical momentum gexp Initialized to 0;

[0081] S32, the sample Initialize to clean sample x;

[0082] S33, for samples Perform random channel swap operation; It is represented as an RGB triplet (R, G, B), where each element of the triplet represents the corresponding channel. The image after random channel swapping is represented as So

[0083] S34, will Input to the source model f to derive the model f(S(·);θ);

[0084] S35, for samples Perform pre-update to get pre-update point

[0085]

[0086] S36, update the experience momentum g exp :

[0087]

[0088] S37, to the sample Add adversarial perturbations:

[0089]

[0090] S38, repeat steps S33-S37 T times;

[0091] S39, repeat steps S32-S38 until training epochs times to obtain a pre-trained empirical momentum. Initializing the momentum to the empirical momentum can effectively accelerate optimization in the early stage;

[0092] S310, will be adversarial sample Initialize to clean sample x, and set momentum g t-1 Initialized to empirical momentum;

[0093] S311, execute equations (2), (3), and (4) to update g t-1 and Get g t and

[0094] S312, execute step S311 T times;

[0095] S313, output adversarial samples

[0096] In addition, the empirical exact Nesterov momentum (the momentum obtained by combining the empirical momentum with the exact Nesterov momentum) is applied to the gradient-based attack to improve its transferability. The algorithm of I-FGSM based on the empirical exact Nesterov momentum is:

[0097]

[0098] It should be noted that if the above algorithm If the term is 0, the I-FGSM based on the empirical exact Nesterov momentum degenerates into the I-FGSM based on the empirical Polyak momentum; if If the term is 0, the I-FGSM based on the empirical exact Nesterov momentum degenerates to the I-FGSM based on the empirical Nesterov momentum; if epochs=0, the I-FGSM based on the empirical exact Nesterov momentum degenerates to the I-FGSM based on the exact Nesterov momentum.

[0099] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code. The scheme in the embodiment of the present application can be implemented in various computer languages, for example, object-oriented programming language Java and literal translation scripting language JavaScript, etc.

[0100] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0101] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0102] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The steps for the function specified in one or more boxes.

[0103] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application.

[0104] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A method for improving the transferability of adversarial examples based on empirically accurate Nesterov momentum, characterized by: The following steps are involved: S1, obtains the experience momentum and obtains the pre-trained experience momentum through iterative training; S2, obtain accurate Nesterov momentum; S3, combines the pre-trained empirical momentum with the exact Nesterov momentum and applies it to adversarial attacks to improve the transferability of adversarial examples; In S1, the steps to obtain the experience momentum are: S11, perform random channel swap operation on the input image x; the input image x is represented as an RGB triplet (R, G, B), where each element of the triplet represents the corresponding channel. The image after random channel swap is represented as S(x), then S(x)∈{(R, G, B),(R, BG),(G, R, B),(G, B, R),(B, R, G),(B, G, R)}; S12, input S(x) to the source model f to derive the model f(S(·); θ); S13, pre-perturbs the input image x on the derived model f(S(·); θ) through a gradient-based attack; accumulates gradients during the pre-perturbation process to obtain empirical momentum; The steps to obtain the exact Nesterov momentum are: S21, let the current data point be x ' , the current precise Nesterov momentum is g, then successively along the current data point x ' The gradient direction and momentum direction can be used to obtain more detailed pre-update points: Where λ and ξ are hyperparameters, and grad(·) represents the gradient function; S22, calculate the gradient of the pre-update point to correct the pre-update, and use the corrected pre-update vector as the new exact Nesterov momentum: Among them, β and γ are hyperparameters; Taking the iterative fast gradient sign method based on exact Nesterov momentum as an example, its t-th iteration process can be described as (2), (3), and (4): where g t represents the momentum after t iterations, and g0 = 0, μ represents the attenuation factor, α represents the step size, represents the gradient operator, J represents the loss function, f represents the source model with parameter θ, y represents the true label, ||·||1 represents the L1 norm, Represents the adversarial sample at the tth iteration, Clip (x,∈) {x} means truncating x to [x-∈, x+∈], sign(·) means the sign function; The specific steps of S3 include: S31, initialize the step size α to The empirical momentum g exp Initialized to 0; S32, the sample Initialize to clean sample x; S33, for samples Perform random channel swap operation; It is represented as an RGB triplet (R, G, B), where each element of the triplet represents the corresponding channel. The image after random channel swapping is represented as So S34, will Input to the source model f to derive the model f(S(·);θ); S35, for samples Perform pre-update to get pre-update point S36, update the experience momentum g exp : S37, to the sample Add adversarial perturbations: S38, repeat steps S33-S37 T times; S39, repeat steps S32-S38 until training epochs times to obtain a pre-trained experience momentum; S310, will be adversarial sample Initialize to clean sample x, and set momentum g t-1 Initialized to empirical momentum; S311, execute equations (2), (3), and (4) to update g t-1 and Get g t and S312, execute step S311 T times; S313, output adversarial samples 2. The method for improving the transferability of adversarial examples based on empirically accurate Nesterov momentum according to claim 1, characterized in that Repeat steps S11-S13 and iteratively train the experience momentum to obtain pre-trained experience momentum.

3. A system for improving the transferability of adversarial examples based on empirically accurate Nesterov momentum, characterized by: Executing the method according to claim 1 or 2, comprising: an empirical momentum training module, an accurate Nesterov momentum acquisition module, and a combined application module; The experience momentum training module is used to obtain experience momentum and obtain pre-trained experience momentum through iterative training; Accurate Nesterov momentum acquisition module, used to obtain accurate Nesterov momentum; Combined with the application module, it is used to combine the pre-trained empirical momentum with the precise Nesterov momentum and apply it to adversarial attacks to improve the transferability of adversarial samples.

4. A computer storage medium storing a readable program, characterized in that: When the program is run, the method according to any one of claims 1 to 2 is executed.

5. A device, characterized in that include: One or more processors, a memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors are enabled to perform the method according to any one of claims 1 to 2.

Images