A method and system for generating adversarial samples based on WGAN-Unet

Abstract

This invention discloses an adversarial example generation method and system based on WGAN-Unet, comprising at least an adversarial attack network model module. The module includes an adversarial generation network (PGN) based on the WGAN structure and a target network model. The generator of the GPN is based on the Unet architecture, constructed from original sample data, and outputs adversarial perturbations corresponding to the original samples to generate adversarial examples. The discriminator is based on the Critic architecture in WGAN, constructed using a convolutional network structure, removing the final sigmoid layer, and outputting scores for the adversarial examples and the original samples. The target network model is obtained by training a convolutional neural network using the original sample dataset. In this system, the GPN model module is trained using a training dataset, and the generator is optimized through backpropagation. Only samples need to be input into the generator to generate corresponding perturbations, enabling stable and large-scale generation of adversarial examples from input images without requiring specific structural information of the target network, thus exhibiting high efficiency and good concealment.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, specifically relating to a method and system for generating adversarial samples based on WGAN-Unet. Background Technology

[0002] Since its inception, the concept of artificial intelligence (AI) has permeated all aspects of modern society, production, and daily life. AI technology has played a crucial role in numerous fields, including intelligent transportation, industrial manufacturing, and healthcare. Deep learning, as an important branch of AI, has achieved remarkable results and widespread application in image processing, speech recognition, and object detection after years of development. However, the security of deep neural networks (DNNs), a key technology in deep learning, has also attracted considerable attention.

[0003] In 2013, Szegedy discovered in his research on adversarial examples (Intriguing properties of neural networks. Szegedy Christian, Zaremba Wojciech, Sutskever Ilya. arXiv e-prints. 2013.: 1312-6199.) that adding carefully designed small perturbations to images can affect the results of neural networks. Subsequent research by Goodfellow, Carlini, and others has proposed various methods for generating adversarial examples, such as gradient-based FGSM (Explaining and Harnessing Adversarial Examples. Goodfellow Ian J. arXive-prints. 2014.: 1421-6572), JSMA (The Limitations of Deep Learning in Adversarial Settings. Paper not Nicolas, McDaniel Patrick, Jha Somesh, et al. arXiv e-prints. 2015.: 1511-7528.), and optimization-based C&W (Towards Evaluating the Robustness of Neural Networks. Carlini Nicholas, Wagner David. arXiv e-prints. 2016.: 1608-4644.), etc. Current research on adversarial examples mainly focuses on gradient-based and optimization-based approaches. However, traditional methods often require structural information of the target network during generation and also suffer from drawbacks such as high computational cost, slow generation speed, and poor transferability.

[0004] Following Goodfellow's introduction of the concept of Generative Adversarial Networks (GANs) (Goodfellow Ian J., Pouget-Abadie Jean, Mirza Mehdi, et al. arXive-prints. 2014.: 1406-2661.), other scholars have introduced GANs into the construction of adversarial examples, improving their performance to varying degrees. Xiao's AdvGAN (Generating Adversarial Examples with Adversarial Networks. arXive-prints. Xiao Chaowei, Li Bo, Zhu Jun-Yan, et al. 2018.: 1801-2610.) can efficiently generate adversarial examples with a high success rate after its GAN network is trained. However, due to the instability and convergence difficulties of GAN networks, gradient vanishing occurs during training, and the generated adversarial examples suffer from poor image quality. Therefore, constructing a high-performance and stable GAN-based adversarial example generation method is of great significance. Summary of the Invention

[0005] This invention addresses the shortcomings of existing adversarial example generation methods by providing a WGAN-Unet-based adversarial example generation method and system. The system includes at least an adversarial attack network model module, comprising a generator, a discriminator, and a target network model. The generator, based on the Unet architecture, is constructed from original sample data, extracting features from the input samples, pooling, and upsampling, outputting adversarial perturbations corresponding to the original samples to generate adversarial examples. The discriminator, based on the Critic architecture in WGAN, is constructed using a convolutional network structure, removing the final sigmoid layer, and distinguishes between the original and adversarial examples, outputting scores for both. The target network model is obtained by training a convolutional neural network using the original sample dataset, and its classification accuracy is obtained using a test set. In this system, the adversarial attack network model module is trained using a training dataset, and the generator is optimized through backpropagation. Simply inputting samples into the generator generates corresponding perturbations, which are then added to the original image to generate adversarial examples. This method can stably generate adversarial examples on a large scale from input images without requiring specific structural information of the target network, exhibiting high efficiency and good concealment.

[0006] To achieve the above objectives, the technical solution adopted by this invention is: an adversarial sample generation system based on WGAN-Unet, comprising at least an adversarial attack network model module, wherein the module includes a generator, a discriminator, and a target network model.

[0007] The generator is based on the Unet architecture, constructed from the original sample data, and performs feature extraction, pooling, and upsampling on the input samples. It outputs adversarial perturbations corresponding to the original samples to generate adversarial examples.

[0008] The discriminator is based on the Critic architecture in WGAN, constructed using a convolutional network structure, with the last sigmoid layer removed, to distinguish between original samples and adversarial samples, and output scores for adversarial and original samples.

[0009] The target network model is obtained by training a convolutional neural network using the original sample dataset, and the classification accuracy of the target network model is obtained using a test set.

[0010] In the system, the adversarial attack network model module is trained using a training dataset, and the generator is optimized through backpropagation to generate adversarial examples.

[0011] As an improvement of the present invention, the generator includes an encoder and a decoder. The encoder encodes the input image using three convolutional layers and three batch normalization layers, and the convolutional layers are activated using the ReLU function. The decoder completes the decoding using two upsampling layers, one convolutional layer and two batch normalization layers. The upsampling layers are activated using the ReLU function, and finally the last convolutional layer is activated using Tanh.

[0012] As an improvement of the present invention, there are 9 residual blocks between the encoder and decoder in the generator.

[0013] As another improvement of the present invention, the first layer of the discriminator is a convolutional layer with a (4,4) kernel, a stride of 2, and padding of 1, and is activated by the LeakyReLU function. The above structure is repeated twice, and a batchnorm layer is added before the activation of the last two convolutional layers. Finally, the output is produced by a convolutional layer with a (3,3) kernel, a stride of 1, and padding of 0.

[0014] To achieve the above objectives, the present invention also adopts the following technical solution: a method for generating adversarial examples based on WGAN-Unet, comprising the following steps:

[0015] S1, Obtain the original sample dataset: Batch obtain images, preprocess the images and use them as the original sample dataset, and randomly divide the original sample dataset into training dataset and test dataset;

[0016] S2, Training the target network: Build a convolutional neural network, train the convolutional neural network using the original sample dataset from step S1 to obtain the target network model, and use the test dataset to obtain the classification accuracy of the target network model;

[0017] S3, Construct an adversarial attack network model based on WGAN-Unet: The adversarial attack network model consists of a generator, a discriminator, and the target network model obtained in step S2. The generator is based on the Unet architecture, constructed from the original sample data, and performs feature extraction, pooling, and upsampling on the input samples, outputting adversarial perturbations corresponding to the original samples. The discriminator is based on the Critic architecture in WGAN, constructed using a convolutional network structure, removing the last sigmoid layer, and outputting scores for adversarial samples and original samples.

[0018] S4, Model Training: Train the adversarial attack network model using the training dataset from step S1. Input the original samples into the generator to generate adversarial samples. Then, input the adversarial samples and the original samples into the discriminator and the target network model. Backpropagate to optimize the generator. When the training reaches a specified number of iterations or the GAN network converges, record the network parameter information of the generator to obtain the trained generator.

[0019] S5, Sample Generation: Input the original sample test dataset from step S1 into the generator obtained in step S4 to directly generate adversarial samples.

[0020] As an improvement of the present invention, step S6 is also included: testing and verification: the time spent generating adversarial samples is recorded and compared with the traditional method, and the adversarial samples generated by the above method are input into the target model, and the classification accuracy of the target model for the adversarial samples is recorded; the peak signal-to-noise ratio and structural similarity of the adversarial samples obtained in step S5 and the corresponding original samples are calculated to obtain the degree of change of the adversarial samples compared with the original samples.

[0021] As a further improvement of the present invention, step S4 specifically includes:

[0022] S41: Input the original sample x into the generator G to obtain the adversarial perturbation G(x), and generate adversarial samples.

[0023] S42: Combine the original sample x and the adversarial sample Input the discriminator D, and calculate based on the output of discriminator D. and loss D_WGAN Feedback is given to the discriminator D for optimization, where D(x) and These are the discriminator D's interactions with the original sample x and the adversarial sample, respectively. The rating.

[0024] S43: Combine the original sample x and the adversarial sample Input the target model T to obtain the classification results of the target model for the samples. t o =T(x), calculate the adversarial loss based on cosine similarity. adv =CosineSimilarity(t,t o );

[0025] S44: Calculate the disturbance loss

[0026] S45: Based on the above losses, calculate the total loss L = loss G_WGAN +αloss adv +βloss pert And use backpropagation to optimize the generator G.

[0027] Compared with the prior art, the technical advantages of this invention are:

[0028] 1. The adversarial examples are generated quickly and require less information about the target network model. Compared with traditional gradient-based and optimization-based generation methods, which require knowledge of some gradient or structural information of the target network, this invention only requires the classification results of the target network when training the generator. After training, there is no need to access the target network again. Just input the image into the generator to quickly generate adversarial examples in large quantities.

[0029] 2. The network model used adopts the architectures of WGAN and Unet. This method is more stable during training and can effectively reduce phenomena such as gradient vanishing and mode collapse during training. The Unet architecture used in the generator enables the network to be effectively trained even on image datasets with large size and small number of images.

[0030] 3. The adversarial attack network uses both adversarial loss based on cosine similarity and perturbation loss during training. The resulting adversarial examples can attack the target model with a high success rate, while also perturbing the image as little as possible, making the image less distorted and more covert. Attached Figure Description

[0031] Figure 1 This is a schematic diagram of an adversarial sample generation system based on WGAN-Unet according to the present invention.

[0032] Figure 2 This is a flowchart illustrating the steps of an adversarial example generation method based on WGAN-Unet according to the present invention.

[0033] Figure 3 A schematic diagram of the generator network structure in Embodiment 1 of this invention;

[0034] Figure 4 A schematic diagram of the discriminator network structure in Embodiment 1 of the present invention;

[0035] Figure 5 This is a schematic diagram of the original image and the adversarial sample generated by the present invention in Embodiment 3 of the present invention. Detailed Implementation

[0036] The present invention will be further illustrated below with reference to the accompanying drawings and specific embodiments. It should be understood that the following specific embodiments are for illustrative purposes only and are not intended to limit the scope of the invention.

[0037] Example 1

[0038] An adversarial example generation system based on WGAN-Unet includes at least an adversarial attack network model module, wherein the module comprises a generator, a discriminator, and a target network model, such as... Figure 1 As shown, the generator G is based on the Unet architecture and is constructed from the original sample data. It performs feature extraction, pooling, and upsampling on the input samples, outputting adversarial perturbations corresponding to the original samples to generate adversarial examples. Unlike typical GAN ​​networks where the input is random noise, the generator G of this invention takes the original sample data as its input. Therefore, the overall network architecture consists of an encoder and a decoder, structurally referencing the Unet architecture. Figure 4 As shown, the encoder network is similar to the down phase in UNet, using three convolutional layers and three batch normalization layers to encode the input image. ReLU activation is used between the convolutional layers. The decoder references the up structure in UNet, using two upsampling layers, one convolutional layer, and two batch normalization layers for decoding. The upsampling layers are also activated using ReLU. Finally, Tanh activation is applied to the last convolutional layer, resulting in an adversarial perturbation output with the same size as the original data. Nine residual blocks are added between the encoder and decoder to ensure training stability and network performance.

[0039] The discriminator D is based on the Critic architecture in WGAN, constructed using a convolutional network structure, with the final sigmoid layer removed, to distinguish between original samples and adversarial samples, outputting scores for both adversarial and original samples; Figure 3As shown, the discriminator D mainly references the design of the critic network in WGAN, accepting both original samples and adversarial samples as network input. The first layer is a convolutional layer using a (4,4) kernel, a stride of 2, and padding of 1, activated by the LeakyReLU function. This structure is repeated twice, with a batchnorm layer added before the activation of the last two convolutional layers to ensure network performance stability. Finally, the output is obtained through a convolutional layer with a (3,3) kernel, a stride of 1, and padding of 0. The final Sigmoid layer in the CNN network is removed, and the final output is a score for the input image.

[0040] The target network model is obtained by training a convolutional neural network using the original sample dataset, and the classification accuracy of the target network model is obtained using a test set. In this system, the adversarial attack network model module is trained using the training dataset, and the generator is optimized through backpropagation to generate adversarial examples. During the training phase, this system can jointly train the generator and discriminator without requiring information about the internal structure of the target network. After training, simply save the generator, input the original image, and the corresponding adversarial examples will be generated. This invention, by establishing an adversarial attack network model, can stably generate adversarial examples from input images in large batches without requiring specific structural information about the target network, exhibiting high efficiency and good concealment.

[0041] Example 2

[0042] An adversarial example generation method based on WGAN-Unet, such as Figure 2 As shown, it includes the following steps:

[0043] S1, Obtain the original sample dataset: Batch obtain images, preprocess the images, and use them as the original sample dataset. Randomly divide the original sample dataset into training dataset and test dataset for subsequent training of the target network model and the adversarial generative network model;

[0044] S2, Training the target network: Build a convolutional neural network, train the convolutional neural network using the original sample dataset from step S1 to obtain the target network model, and use the test dataset to obtain the classification accuracy of the target network model;

[0045] S3, Construct an adversarial attack network model based on WGAN-Unet: The adversarial attack network model consists of a generator, a discriminator, and the target network model obtained in step S2. First, a generator G is constructed based on the width, height, and number of channels of the original sample data in step S1. The generator adopts the Unet architecture to extract features, pool, and upsample the input samples, and finally outputs the adversarial perturbation corresponding to the original samples. Then, a discriminator D is constructed using a convolutional network structure based on the image size. The discriminator adopts the Critic architecture in WGAN, removes the last sigmoid layer, and outputs the discriminator's score for the adversarial samples and the original samples.

[0046] S4, Model Training: The adversarial attack network model is trained using the training dataset from step S1. The original samples are input into the generator to generate adversarial samples. The adversarial samples and the original samples are then input into the discriminator and the target network model. Backpropagation optimizes the generator. When the training reaches a specified number of iterations or the GAN network converges, the network parameter information of the generator is recorded, resulting in a fully trained generator. This step further includes:

[0047] S41: Input the original sample x into the generator G to obtain the adversarial perturbation G(x), and generate adversarial samples.

[0048] S42: Combine the original sample x and the adversarial sample Input the discriminator D, and calculate based on the output of discriminator D. and loss D_WGAN Feedback is given to the discriminator D for optimization, where D(x) and These are the discriminator D's interactions with the original sample x and the adversarial sample, respectively. The rating;

[0049] S43: Combine the original sample x and the adversarial sample Input the target model T to obtain the classification results of the target model for the samples. t o =T(x), calculate the adversarial loss based on cosine similarity. adv =CosineSimilarity(t,t o );

[0050] S44: Calculate the disturbance loss

[0051] S45: Based on the above losses, calculate the total loss L = loss G_WGAN +αloss adv +βloss pert And optimize the generator G using backpropagation;

[0052] S5, Sample Generation: Input the original sample test dataset from step S1 into the generator obtained in step S4 to directly generate adversarial samples.

[0053] During the training phase of this invention, the original clean samples are input into the generator to generate adversarial perturbations. After the perturbations are added to the clean samples, they are input into the discriminator and the target network respectively to obtain the corresponding losses, which are then fed back to the generator and discriminator for optimization. After training, the samples only need to be input into the generator to generate the corresponding perturbations, which are then added to the original image to generate adversarial samples. During training, the adversarial attack network uses both adversarial loss based on cosine similarity and perturbation loss. The generated adversarial samples can attack the target model with a high success rate while perturbing the image as little as possible, resulting in less image distortion and greater concealment.

[0054] Example 3

[0055] This embodiment uses the MNIST dataset as an example. The MNIST dataset, provided by the National Institute of Standards and Technology (NIST), is a widely used handwritten digit dataset in the field of deep learning. This dataset contains 60,000 training samples and 10,000 test samples. Each image is 1*28*28 pixels in size, with pixel values ​​between [0,1]. This embodiment uses this dataset to train a target network model and an adversarial example generation model.

[0056] Regarding the performance of adversarial examples, the Fast Signed Gradient Method (FGSM) and the optimized C&W algorithm were used as comparison methods to compare the adversarial examples generated by the method of this invention. FGSM generates adversarial examples by quickly finding the perturbation direction of a given image through gradient calculation, and its principle is as follows:

[0057]

[0058] Where L is the loss function of the target network, and the sign vector sign is the first derivative of the loss function L with respect to the input image x.

[0059] The C&W algorithm is a highly aggressive and complex adversarial attack method. It is an optimization-based algorithm proposed by Carlini N, Wagner D, and others. Its principle is briefly described below:

[0060]

[0061]

[0062] Where x is a clean sample, x′ is an adversarial sample, c is a linear coefficient, and the loss function f(x′,t) will cause the label originally classified as class i to be predicted as class t, Z(x′). i Let represent the classifier prediction result of the i-th component in x′, where t is the target label;

[0063] like Figure 2 As shown, an adversarial example generation method based on WGAN-Unet is implemented through the following steps:

[0064] S1, Obtain the original sample dataset: Batch obtain images, preprocess the images, and use them as the original sample dataset. Randomly divide the dataset into training and test sets for subsequent training of the target model and the adversarial generative network model.

[0065] The MNIST dataset uses a training set of 50,000 images and a test set of 10,000 images. Each image has a size of 1*28*28 pixels and a corresponding label y of a single digit from 0 to 9.

[0066] S2, Training the target network: Build a convolutional neural network and train it using the original sample dataset in S1 to obtain the target model in the adversarial attack model. Use the test set to obtain the classification accuracy of the target model.

[0067] In this embodiment, a target network model is constructed with a 1*28*28 image as input and 10 categories as output. This classifier is defined as T, therefore to = T(x), where x is the original sample image data in S1, and t o Let T be the classification result of image x.

[0068] The target classifier in this step is not specifically defined, as long as it is based on a convolutional neural network and the constructed model can classify data. In this embodiment, a model is constructed consisting of four convolutional layers, two max-pooling layers, three fully connected layers, and two dropout layers. The convolutional and fully connected layers are activated using the ReLU function. During training, the Adam optimizer with a learning rate of 0.001 is used for optimization. The trained target network is tested using the test set in S1, and the classification accuracy p1 of the target network on the test set is recorded.

[0069] S3. Construct an adversarial attack network model based on WGAN-Unet: The overall network model consists of a generator G, a discriminator D, and the target network model T obtained in S2.

[0070] S4, using the training dataset from S1 to train the adversarial attack network model from S3:

[0071] In this embodiment, the MNIST training set is input into the adversarial attack network model constructed in S3 for training. When training each batch of samples, the discriminator D is first optimized, and the loss is calculated using the mean function. D_WGAN The parameters of D were optimized using the Adam optimizer with a learning rate of 0.0001.

[0072] After training D twice, the generator G is optimized by combining the original sample x with the adversarial sample. In the target model T, the Argmax function is used to calculate the classification of T for the input image. t o =T(x), calculate the adversarial loss based on cosine similarity. adv Then use the MSE function to calculate the disturbance loss. Then calculate the total loss L = loss G_WGAN +αloss adv +βloss pert Similarly, the Adam optimizer with a learning rate of 0.0001 is used for parameter updates.

[0073] Furthermore, in this example, α = 10, β = 5, and the number of training epochs is set to 120 for network training. After 80 training epochs, the learner rate of the generator and discriminator optimizers is reduced to 0.00001.

[0074] S5 uses the trained generator to generate adversarial examples, demonstrating the success of the attack: After training in S4 reaches a specified number of iterations or the WGAN network converges, the network parameter information of generator G is recorded. Adversarial examples are generated using generator G and the test dataset from S1. The time spent generating adversarial examples is recorded and compared with the traditional method. This time is then input into the target model T, and the classification accuracy of the target model for the adversarial examples is recorded. Compared with the results in S2, the accuracy is significantly reduced, demonstrating the efficiency and effectiveness of the adversarial examples generated by this invention.

[0075] Generate using the MNIST test set, such as Figure 5 After generating adversarial examples, the label information of the original image and its corresponding adversarial examples are combined. Input the target convolutional neural network and use the Argmax function to obtain the classification result. The two results are compared to calculate the target network's classification accuracy p2 and attack success rate s1 against adversarial examples. The calculation yields 2% ≈ p2 << p1 ≈ 98%.

[0076] When generating adversarial examples, record the time t1 consumed for generation. Use the FGSM algorithm and the C&W algorithm with ε = 0.1 to attack the target network, and record the attack time t2, t3 and the attack success rates s2, s3. The comparison results show that t1 < t2 << t3, s1 ≈ s3 >> s2. Thus, it can be proved that the adversarial example generation method used in the present invention has both high success rate and high efficiency. In a certain generation, the original image set and the example image set of the obtained adversarial examples are as Figure 5 shown.

[0077] Test the invisibility of the adversarial examples: Use S5 to obtain the adversarial examples and the corresponding original samples to calculate the PSNR (Peak Signal-to-Noise Ratio) and SSMI (Structural Similarity Index), and obtain the degree of change of the adversarial examples compared to the original samples, so as to test the image quality and visibility to the human eye of the adversarial examples.

[0078] In this embodiment, the PSNR function and the SSMI function are used to calculate the similarity between the generated adversarial examples and the original samples. The average PSNR obtained from the test set is close to 20, and the average SSMI is close to 0.8.

[0079] In summary, the adversarial examples generated by the present invention are more efficient compared to the traditional method, and have a high success rate for attacking the target network. At the same time, they have a high similarity to the original images both at the pixel level and the human eye perception level, and have good invisibility.

[0080] It should be noted that the above content only illustrates the technical idea of the present invention and cannot be used to limit the protection scope of the present invention. For those of ordinary skill in the art, without departing from the principle of the present invention, several improvements and refinements can be made, and these improvements and refinements all fall within the protection scope of the claims of the present invention.

Claims

1. A WGAN-Unet-based adversarial sample generation system, characterized in that, It includes at least an adversarial attack network model module, which comprises a generator, a discriminator, and a target network model. The generator, based on the Unet architecture, is constructed from the original sample data. It performs feature extraction, pooling, and upsampling on the input samples, and outputs adversarial perturbations corresponding to the original samples to generate adversarial examples. The generator includes an encoder and a decoder, with nine residual blocks between them. The encoder uses three convolutional layers and three batch normalization layers to encode the input image, and ReLU activation is used between the convolutional layers. The decoder uses two upsampling layers, one convolutional layer, and two batch normalization layers to complete the decoding. The upsampling layers are activated using the ReLU function, and Tanh activation is finally applied to the last convolutional layer. The discriminator is constructed using a convolutional network structure based on the Critic architecture in WGAN, with the final sigmoid layer removed. It distinguishes between original samples and adversarial samples, outputting scores for both. The first layer of the discriminator uses a (4,4) kernel, a stride of 2, and padding of 1, activated by the LeakyReLU function. This structure is repeated twice, with a batchnorm layer added before the activation of the last two convolutional layers. Finally, the output is obtained through a convolutional layer with a (3,3) kernel, a stride of 1, and padding of 0. The target network model is obtained by training a convolutional neural network using the original sample dataset. The accuracy of the target network model's classification is obtained using a test set. The loss in the model training includes WGAN loss, adversarial loss based on cosine similarity, and perturbation loss. In the system, the adversarial attack network model module is trained using a training dataset, and the generator is optimized through backpropagation to generate adversarial examples.

2. A WGAN-Unet-based adversarial sample generation method using the system according to claim 1, characterized in that, Includes the following steps: S1, Obtain the original sample dataset: Batch obtain images, preprocess the images and use them as the original sample dataset, and randomly divide the original sample dataset into training dataset and test dataset; S2, Training the target network: Build a convolutional neural network, train the convolutional neural network using the original sample dataset from step S1 to obtain the target network model, and use the test dataset to obtain the classification accuracy of the target network model; S3, Construct an adversarial attack network model based on WGAN-Unet: The adversarial attack network model consists of a generator, a discriminator, and the target network model obtained in step S2. The generator is based on the Unet architecture, constructed from the original sample data, and performs feature extraction, pooling, and upsampling on the input samples, outputting adversarial perturbations corresponding to the original samples. The discriminator is based on the Critic architecture in WGAN, constructed using a convolutional network structure, removing the last sigmoid layer, and outputting scores for adversarial samples and original samples. S4, Model Training: Train the adversarial attack network model using the training dataset from step S1. Input the original samples into the generator to generate adversarial samples. Then, input the adversarial samples and the original samples into the discriminator and the target network model. Perform backpropagation to optimize the generator. When the training reaches a specified number of iterations or the GAN network converges, record the network parameter information of the generator to obtain the trained generator. S5, Sample Generation: Input the original sample test dataset from step S1 into the generator obtained in step S4 to directly generate adversarial samples.

3. The method of claim 2, wherein the WGAN-Unet-based adversarial sample generation method is characterized by: The method also includes step S6, testing and verification: the time spent generating adversarial samples is recorded and compared with the traditional method, and the adversarial samples generated by the above method are input into the target model, and the classification accuracy of the target model for the adversarial samples is recorded; the peak signal-to-noise ratio and structural similarity of the adversarial samples obtained in step S5 and the corresponding original samples are calculated to obtain the degree of change of the adversarial samples compared with the original samples.

4. The WGAN-Unet-based adversarial sample generation method of claim 2 or 3, wherein: Step S4 specifically includes: S41: obtaining the original sample The input generator G obtains the adversarial perturbation G( ), and generates the adversarial sample ; S42: Combine the original sample x and the adversarial sample Input the discriminator D, and calculate based on the output of discriminator D. and ,Will The feedback is sent to the discriminator D for optimization, where... and The discriminator D is paired with the original sample. and adversarial examples The rating; S43: Transfer the original sample and adversarial examples Input the target model T to obtain the classification results of the target model for the samples. Calculate adversarial loss based on cosine similarity ; S44: Calculate the disturbance loss ; S45: Calculate the total loss based on the above losses. And use backpropagation to optimize the generator G.

Images