Adversarial sample generation method and system based on deep neural network

Abstract

The present application belongs to the technical field of computer vision processing, and particularly relates to a kind of method and system for generating adversarial samples based on deep neural network, first, the original image in sample data is converted into saliency map;The saliency map is used to circle the salient region in the original image of sample data for adding disturbance, and the saliency mask is obtained by binary processing of saliency image pixel value;The original image in sample data is input into image classification model, and the gradient information in the reverse transmission process of Nadam optimization algorithm and convolutional neural network is used to iteratively generate global disturbance adversarial sample;The difference between adversarial sample and original image is obtained, and global adversarial noise is obtained;The Hadamard product of global adversarial noise and saliency mask is used to obtain adversarial noise in salient region, and the final output salient region adversarial sample is obtained by combining adversarial noise and original image.The present application can improve the quality of generated samples, facilitate testing and improve the security and robustness of image classification model.

Description

Technical Field

[0001] This invention belongs to the field of computer vision processing technology, and specifically relates to a method and system for generating adversarial examples based on deep neural networks. Background Technology

[0002] In image classification tasks, convolutional neural network (CNN)-based image classification models have reached or even surpassed the capabilities of the human eye. However, research shows that when specific perturbations are added to the original image, CNNs will misclassify with a high probability. More importantly, these perturbations are difficult for both the human eye and machines to detect. The existence of adversarial examples poses a significant challenge to the security of deep neural networks, severely hindering the practical deployment and application of these models. At the same time, adversarial examples, as a technical detection method, also provide a valuable tool for testing and improving the security and robustness of image classification models.

[0003] The attack performance of adversarial examples is mainly reflected in two aspects: first, they can deceive models, causing even high-performing image classification models to misclassify; second, they can deceive the human eye, making it difficult for the human eye to effectively distinguish between adversarial examples and the original image. Based on the attacker's understanding of the model, adversarial example attacks can be divided into white-box attacks and black-box attacks. White-box attacks require the attacker to understand the model's structure and parameters, but due to the usual protective mechanisms in actual model deployments, attackers often find it difficult to obtain the model's internal information. Therefore, black-box attacks utilize the transferability of adversarial examples to perform black-box attacks; there is also MI-FGSM (Momentum Iterative Fast Gradient Sign Method), which introduces a momentum term into the adversarial example generation process to stabilize the update direction of the loss function during backpropagation, improving the success rate of black-box attacks. However, since these methods add adversarial noise to the original image through global perturbation, the generated adversarial examples have significant visual differences from the original image, making them easily detectable by the human eye due to excessive adversarial texture features. As research on adversarial examples deepens, simply increasing the success rate of adversarial attacks is no longer sufficient to meet the requirements of adversarial attack testing. It is also necessary to consider the reduced stealth of adversarial attacks due to excessive adversarial perturbations. Summary of the Invention

[0004] To address this, the present invention provides a method and system for generating adversarial examples based on deep neural networks. By considering the concealment of adversarial attacks, while maintaining a high success rate of black-box attacks on adversarial examples, the method reduces the area for adding adversarial perturbations, decreases the possibility of adversarial examples being discovered, improves the quality of generated samples, and facilitates testing and enhances the security and robustness of image classification models.

[0005] According to the design scheme provided by this invention, an adversarial example generation method based on deep neural networks is provided, comprising the following:

[0006] Based on the semantic information of the images in the sample data, the original images in the sample data are transformed into saliency maps; the saliency maps are used to delineate the salient regions in the original images of the sample data for adding perturbations, and the saliency mask is obtained by binarizing the pixel values ​​of the saliency maps.

[0007] The original images from the sample data are input into the image classification model, and the gradient information during the backpropagation process of the Nadam optimization algorithm and the convolutional neural network is used to iteratively generate adversarial examples with global perturbation.

[0008] The adversarial sample is subtracted from the original image to obtain global adversarial noise. The adversarial noise in the salient region is obtained by using the Hadamard product of the global adversarial noise and the salient mask. Finally, the salient region adversarial sample is obtained by combining the adversarial noise with the original image.

[0009] As an adversarial example generation method based on deep neural networks in this invention, the original image in the sample data is further transformed into a saliency map, which includes the following: the original image is transformed into a grayscale image with pixel values ​​between 0 and 255 using a trained variable convolution and feature attention DCFA network model, and the grayscale image is used as the saliency map. The DCFA network model extracts non-uniform contextual features from the low-level details and high-level semantics of the original image, and obtains the saliency map boundary by assigning adaptive feature weights in the spatial domain and channel domain.

[0010] As an adversarial example generation method based on deep neural networks in this invention, the process of binarizing the saliency map pixel values ​​is further represented as follows: Among them, s i,j Let m be the pixel value at position (i,j) of the saliency map S, φ be the corresponding pixel threshold, and m be the pixel value at position (i,j). i,j This is the value at position (i,j) corresponding to the salient mask M after binarization.

[0011] As a method for generating adversarial examples based on deep neural networks in this invention, further, in the iterative generation of adversarial examples with global perturbation, the gradient calculation of the loss function during the backpropagation process of the convolutional neural network is used to obtain the misclassified labels by gradually increasing the loss function value in the image classification process, and the update process of the loss function is integrated in the form of momentum accumulation to stabilize the update direction of the loss function.

[0012] As an adversarial example generation method based on deep neural networks in this invention, further, in the process of updating the loss function, the Nesterov algorithm for optimizing the update path and the RMSprop algorithm for optimizing the learning rate are introduced to form the Nadam algorithm. The Nadam algorithm is used to accumulate historical gradient data and predicted data, so as to simultaneously optimize the loss function update path and the learning rate.

[0013] As an adversarial example generation method based on deep neural networks in this invention, the Nesterov algorithm further assists in predicting gradient changes during the advancement of the loss function by gradient jumps in the adversarial example generation process, and incorporates the predicted gradient changes into the gradient accumulation process.

[0014] As an adversarial example generation method based on deep neural networks in this invention, the RMSprop algorithm further utilizes the gradient magnitude during the adversarial example generation process to dynamically adjust the learning rate during the loss function's advancement process, and avoids repeated oscillations near the final extreme point by adjusting the dynamic step size during the loss function update process.

[0015] Furthermore, the present invention also provides an adversarial example generation system based on a deep neural network, comprising: a sample data processing module, a first sample generation module, and a second sample generation module, wherein,

[0016] The sample data processing module is used to convert the original image in the sample data into a saliency map based on the image semantic information in the sample data; to use the saliency map to delineate the salient regions in the original image of the sample data for adding perturbation; and to obtain a saliency mask by binarizing the pixel values ​​of the saliency map.

[0017] The first sample generation module is used to input the original images in the sample data into the image classification model, and use the gradient information in the back-transmission process of the Nadam optimization algorithm and the convolutional neural network to iteratively generate adversarial samples with global perturbation.

[0018] The second sample generation module is used to subtract the adversarial sample from the original image to obtain global adversarial noise; the adversarial noise in the salient region is obtained by using the Hadamard product of the global adversarial noise and the salient mask; and the final output salient region adversarial sample is obtained by combining the adversarial noise with the original image.

[0019] The beneficial effects of this invention are:

[0020] This invention utilizes salient object detection technology to generate a salient map for each original image and binarizes it into a salient mask. This mask is then combined with adversarial perturbations to preserve the perturbations within salient regions, achieving localized addition of perturbations. By introducing the Nadam optimization algorithm, the update direction of the loss function is stabilized and the learning rate is dynamically adjusted, improving the convergence speed of the loss function. This effectively reduces the detectability of adversarial perturbations while maintaining a high success rate in black-box attacks. Furthermore, adversarial attack experiments were conducted on the ImageNet dataset in both single-model and ensemble model environments. The quality of adversarial sample images generated by each method was compared and analyzed, verifying the effectiveness of the proposed method. Compared to benchmark methods, this solution achieves a 27.2% performance improvement in the concealment metric during ensemble model attacks, and the black-box attack success rate reaches a maximum of 92.7%. This further verifies that the proposed solution can generate high-quality adversarial sample data, which is beneficial for testing and improving the security and robustness of image classification models, demonstrating promising application prospects. Attached image description:

[0021] Figure 1 This is a schematic diagram of the adversarial sample generation process based on deep neural networks in the embodiment;

[0022] Figure 2 This is an example of adversarial sample generation in the embodiments;

[0023] Figure 3 This is a schematic diagram of the optimization algorithm relationship in the embodiment;

[0024] Figure 4 This is a schematic diagram of the mask Nadam iterative fast gradient method in the embodiment;

[0025] Figure 5 This is a schematic diagram illustrating the comparison between the original image, Adv-SR, and Adv-non-SR in the embodiment.

[0026] Figure 6 This is a schematic diagram illustrating the comparison of classification accuracy of the original image, Adv-SR, and Adv-non-SR in the embodiment;

[0027] Figure 7 This is a schematic diagram illustrating the comparison of adversarial sample features in the embodiment;

[0028] Figure 8 This is a schematic diagram illustrating the comparison between the adversarial samples generated by each method in the embodiments and the original image;

[0029] Figure 9 This is a schematic diagram of the eye assessment results for Group A in the embodiment;

[0030] Figure 10 This is a schematic diagram of the eye assessment results for Group B in the embodiment. Detailed implementation method:

[0031] To make the objectives, technical solutions, and advantages of this invention clearer and more understandable, the invention will be further described in detail below with reference to the accompanying drawings and technical solutions.

[0032] In computer vision tasks, image classification models based on convolutional neural networks are widely used, but they are vulnerable to adversarial attacks due to their inherent fragility. Most current attack methods target the entire image, and the resulting global perturbation negatively impacts the visual quality of the adversarial example. Therefore, this case study provides an embodiment, see [link to embodiment]. Figure 1 As shown, an adversarial example generation method based on deep neural networks is provided, comprising:

[0033] S101. Based on the semantic information of the images in the sample data, the original images in the sample data are transformed into saliency maps; the saliency maps are used to delineate the salient regions in the original images of the sample data for adding perturbation, and the saliency mask is obtained by binarizing the pixel values ​​of the saliency maps.

[0034] S102. Input the original images from the sample data into the image classification model, and use the gradient information in the reverse transmission process of the Nadam optimization algorithm and the convolutional neural network to iteratively generate adversarial examples with global perturbation.

[0035] S103. Subtract the adversarial sample from the original image to obtain global adversarial noise; use the Hadamard product of the global adversarial noise and the salient mask to obtain adversarial noise in the salient region, and combine the adversarial noise with the original image to obtain the final output salient region adversarial sample.

[0036] Since different parts of the same image contain different semantic information, this embodiment selectively adds adversarial noise to key areas and adds less or no adversarial noise to non-key areas. The method of combining saliency maps with the adversarial example generation process achieves localized addition of adversarial perturbations. During the iterative generation of adversarial examples, a better-performing optimization algorithm is introduced, improving the convergence speed of the loss function in the adversarial example generation process, thereby enhancing the transfer attack capability of the adversarial examples.

[0037] Adversarial example generation typically modifies every pixel in the original image, ultimately increasing the loss function value in the image classification decision process and leading to classification errors. These methods treat all points in the image as pixels of equal value. However, this global perturbation adds unnecessary adversarial noise to the original image, making adversarial texture features more obvious and violating the requirement of imperceptible attacks, thus reducing the attack performance of the adversarial example. Furthermore, adversarial perturbations of the same size have different visual effects depending on their location. If added to a semantically rich and detailed image region, the adversarial perturbation is not very noticeable, while when added to the background region of the image, such as… Figure 2 As shown, adversarial perturbations are more noticeable and easier to detect in areas such as blue sky and grass, thus rendering the attack ineffective. Therefore, in this embodiment, adversarial noise is added to prominent areas of the image to reduce the perceptibility of the perturbation, thereby improving the attack concealment of the adversarial sample.

[0038] As a preferred embodiment, the original image in the sample data is further transformed into a saliency map, which includes the following: the original image is transformed into a grayscale image with pixel values ​​between 0 and 255 using a trained variable convolution and feature attention DCFA network model, and the grayscale image is used as the saliency map. The DCFA network model extracts non-uniform contextual features from the low-level details and high-level semantics of the original image, and obtains the saliency map boundary by assigning adaptive feature weights in the spatial domain and channel domain.

[0039] Based on the varying amounts of semantic information in an image, it can be divided into a subject and a background. The subject has a greater impact on image classification results; occlusion of this part significantly reduces the accuracy of the image classification model. Therefore, adding adversarial perturbations to the salient regions of the semantic subject can be considered.

[0040] Salient object detection technology can identify the most visually prominent objects or regions in an image, and these regions are almost identical to the information corresponding to the classification labels in the image. Therefore, in this embodiment, this technology can be used to extract the main body of the image and add adversarial perturbations to this region. A Deformable Convolution and FeatureAttention (DCFA) network model can be used to generate the saliency map of the image. This model extracts uneven contextual features from low-level details and high-level semantic information of the image, and assigns adaptive weights to the features in the spatial and channel domains, making the boundaries of the generated saliency map clearer and more accurate. The original image is converted into a grayscale image with pixel values ​​between 0 and 255, which serves as the saliency map S. In this saliency map, the semantically prominent main body is closer to white, while the background outside the main body is closer to black; the salient feature region of the image is the white region.

[0041] The saliency map can be used to delineate the salient regions in the original image, dividing the original image into regions with and without adversarial perturbation. Furthermore, the saliency map S can be converted into a binary saliency mask M, which can be expressed as formula (1).

[0042]

[0043] Among them, s i,j Here, φ is the pixel value at position (i,j) of the saliency map S, φ is the corresponding pixel threshold, and mi,j is the value at position (i,j) of the binarized saliency mask M. This step only binarizes the pixel values ​​of the saliency map, facilitating the addition or omission of perturbations when combined with adversarial perturbations, without changing the image size. At this point, the generated saliency mask map is a multidimensional array of 0s and 1s, with 1s corresponding to saliency map feature regions and 0s corresponding to non-feature regions.

[0044] Then, by combining the salient mask with the momentum method, adversarial examples can be generated iteratively. The iterative process can be expressed as shown in formulas (2)-(5).

[0045]

[0046]

[0047]

[0048] x adv =x + noise adv (5)

[0049] Where g0 = 0, μ = 1, The process of initializing parameters and images. The method involves subtracting the adversarial sample generated in the last iteration from the original image to obtain adversarial noise, and then performing a Hadamard product with the salient mask. This preserves the adversarial perturbations within salient regions while setting them to zero in non-salient regions. By restricting the adversarial perturbation addition process to salient regions through the salient mask, this method weakens the adversarial perturbation texture features in the background region, making the attack more covert.

[0050] As a preferred embodiment, further, in the iterative generation of adversarial examples with global perturbations, based on the gradient calculation of the loss function during the backpropagation process of the convolutional neural network, the misclassification labels are obtained by gradually increasing the loss function value in the image classification process, and the update process of the loss function is integrated in the form of momentum accumulation to stabilize the update direction of the loss function. During the update process of the loss function, the Nesterov algorithm for optimizing the update path and the RMSprop algorithm for optimizing the learning rate can be combined to form the Nadam algorithm. The Nadam algorithm is used to accumulate historical gradient data and predicted data to simultaneously optimize the loss function update path and the learning rate.

[0051] While adding adversarial perturbations only to significant regions effectively improves the stealth of adversarial attacks, it also reduces the success rate of black-box attacks by adversarial samples to some extent. Therefore, in this embodiment, the attack method is improved from an optimization perspective to ensure that the attack success rate remains at a high level while enhancing attack stealth.

[0052] The generation of adversarial examples is a constrained optimization process. This process relies on the gradient calculation of the loss function in the backpropagation algorithm, gradually increasing the loss function value during image classification to cause misclassification. In the momentum method, the update process of the loss function is integrated in the form of momentum accumulation, stabilizing the update direction and thus enabling the adversarial example generation process to have better convergence characteristics. While the momentum method for generating adversarial examples is highly aggressive, its success rate in black-box attacks is not very high due to noise solidification and a fixed learning rate. Therefore, in this embodiment, a more powerful optimizer can be introduced into the local optimization attack process of the adversarial examples, optimizing the generation process within salient regions of the image. There are two main approaches to finding a better optimizer: optimizing the learning path and optimizing the learning rate.

[0053] Most existing optimization algorithms used in adversarial attacks rely on gradient accumulation. For example, they might use the Momentum algorithm to accumulate historical gradient information or the Nesterov algorithm to accumulate predicted gradients, thereby dynamically adjusting the loss function update path and improving the success rate of black-box attacks. Besides adjusting the loss function update path, the optimization process can also dynamically adjust the update step size. When the loss function changes rapidly, a small step size is used; when it changes slowly, a large step size is used. Therefore, in this embodiment, the Nesterov and RMSprop algorithms can be improved and combined to form the Nadam algorithm. This allows for simultaneous dynamic adjustment of the loss function's learning path and learning step size, enabling the loss function to effectively avoid falling into local optima and reach its maximum value more quickly, thus improving the adversarial transfer attack capability.

[0054] The Nadam algorithm is a commonly used optimization algorithm in neural network training, characterized by its fast convergence speed and good convergence performance. This solution, taking into account the similarity between the adversarial example generation process and the neural network training process, applies Nadam to the adversarial example generation process to optimize it, thereby improving the performance of adversarial examples. Although the Nadam optimization algorithm exists and is used in neural network training, this solution is the first patent to apply it to the adversarial example generation process, demonstrating originality. Experimental results also prove the effectiveness of this method. In conclusion, applying Nadam to the adversarial example generation process to improve the attack performance of adversarial examples is innovative.

[0055] While masking methods have improved the stealth of adversarial examples, making them more deceptive to the human eye, the introduction of masks has also reduced the success rate of adversarial attacks to some extent. Therefore, how to balance attack power, stealth, and the efficiency of adversarial example generation is a challenge. This solution first focuses on stealth by masking the adversarial examples. However, since multiple masking operations significantly increase time costs while slightly improving the attack performance, this patent employs masking during the final iteration of the adversarial example generation process, balancing stealth and time efficiency. However, because the introduction of masks reduces the perturbation area, it somewhat reduces the attack performance (lower success rate). Therefore, this solution addresses the issue of reduced attack performance caused by masking operations by introducing the Nadam optimization algorithm into the adversarial example generation process.

[0056] In summary, the introduction of masking operations and the Nadam optimization algorithm balances the stealth and attack power of adversarial examples. The stealth lies in deceiving the human eye, while the attack power lies in deceiving neural network systems. Therefore, the adversarial examples generated by this solution are more suitable for practical attack and defense scenarios and have greater practical value. Specifically, the Nadam algorithm is formed by combining the Nesterov and RMSprop algorithms. Figure 3 As shown, this accelerates the convergence speed of the loss function update, reaches the maximum point of the loss function more quickly, and improves the transferability of adversarial examples.

[0057] Figure 3 The process can be seen as an improvement on the momentum method. Formulas (6) and (7) first introduce the Nesterov algorithm, which realizes gradient jump in the existing adversarial sample generation process, helps to predict gradient changes during the loss function's progress, and includes these changes in the gradient accumulation process, which helps the algorithm jump out of local extreme points more quickly.

[0058]

[0059]

[0060] Then, a second momentum is introduced through the RMSprop algorithm to achieve dynamic adjustment of the learning rate, as shown in formulas (8)-(11).

[0061] m i+1 =β1m i +(1-β1)g i (8)

[0062] v i+1 =β2v i +(1-β2)g i 2 (9)

[0063]

[0064]

[0065] In the formula, m i+1 The first momentum is used to accumulate the gradient, and β1 is its corresponding decay factor; v i+1 The second momentum is used to accumulate the squared gradient, with a decay factor of β2. The main function of the first momentum is to stabilize the direction of the loss function during its update process, while the second momentum is mainly used to dynamically adjust the learning rate of the loss function during its progress, preventing the function from getting trapped in local optima.

[0066] As can be seen from the above, the Nadam optimization algorithm integrates the advantages of the first momentum and the second momentum, enabling the accumulation of historical gradient data and predicted data, optimizing the loss function update path and learning, and effectively improving the generation efficiency of adversarial examples.

[0067] This optimization algorithm can be naturally combined with methods for generating significant region perturbations to form the Mask-based Nadam Iterative Fast Gradient Method (MA-NA-FGM), the process of which is as follows: Figure 4 As shown in the diagram, the process begins by inputting the original image into the DCFA model to obtain a saliency map, which is then binarized to obtain a saliency mask. Simultaneously, the original image is input into an image classification model, and adversarial examples are iteratively generated using the Nadam optimization algorithm and gradient information from the backpropagation process of the convolutional neural network. The difference between the obtained global perturbation adversarial examples and the original image yields the global adversarial noise. Then, the global noise is multiplied by the saliency mask using the Hadamard algorithm to obtain the adversarial noise within the salient region. This noise is then combined with the original image to obtain the final salient region adversarial example.

[0068] Based on the above scheme, the adversarial sample attack algorithm under the single-model condition can be designed as shown in Algorithm 1.

[0069] Algorithm 1: Single Classification Model Attack Algorithm (MA-NA-FGM)

[0070] Input: Original image x, corresponding correct label y true The salient mask M corresponding to the original image, a convolutional neural network f and the corresponding cross-entropy loss function L(x,y) true ;θ), total number of iterations T, current iteration step t, dimension D of the input image, size ε to resist perturbation, and decay factors β1 and β2.

[0071] Output: Adversarial example x adv , satisfying ||xx adv || ∞ ≤ε.

[0072]

[0073]

[0074] In the algorithm described above, step 1 determines the initial conditions for the adversarial attack process. Steps 4 and 5 optimize the learning path of the loss function, effectively incorporating historical and predicted gradient data to avoid local oscillations during the loss function optimization process. Step 6 introduces a second momentum, dynamically adjusting the learning rate based on the gradient magnitude, thus achieving dynamic step size adjustment during the loss function update process and preventing repeated oscillations near the final extreme point. Steps 11 and 12 add significant regions of adversarial perturbation, resulting in more aggressive adversarial examples.

[0075] After the final iteration, global perturbations are generated before calculating local perturbations using masks. Since only one Hadamard product operation is required, the computational workload is effectively reduced. This significantly improves the training efficiency of the adversarial example generation model and greatly shortens the training time for adversarial examples while maintaining the attack success rate without a significant decrease.

[0076] Furthermore, based on the above method, this embodiment of the invention also provides an adversarial example generation system based on a deep neural network, comprising: a sample data processing module, a first sample generation module, and a second sample generation module, wherein,

[0077] The sample data processing module is used to convert the original image in the sample data into a saliency map based on the image semantic information in the sample data; to use the saliency map to delineate the salient regions in the original image of the sample data for adding perturbation; and to obtain a saliency mask by binarizing the pixel values ​​of the saliency map.

[0078] The first sample generation module is used to input the original images in the sample data into the image classification model, and use the gradient information in the back-transmission process of the Nadam optimization algorithm and the convolutional neural network to iteratively generate adversarial samples with global perturbation.

[0079] The second sample generation module is used to subtract the adversarial sample from the original image to obtain global adversarial noise; the adversarial noise in the salient region is obtained by using the Hadamard product of the global adversarial noise and the salient mask; and the final output salient region adversarial sample is obtained by combining the adversarial noise with the original image.

[0080] To verify the effectiveness of this solution, the following explanation is based on experimental data:

[0081] Experimental Environment: Programming and experimental testing were conducted using Python 3.8.5 and the Tensorflow 1.14.0 deep learning framework. The server core was an Intel Core i9-10900K, with 64GB of memory and a clock speed of 3.7GHz. To achieve rapid generation of adversarial examples, an NVIDIA GeForce RTX 2080Ti GPU was used to accelerate the computation process.

[0082] Dataset and Network Model: 1000 images were randomly selected from the validation set of the ImageNet dataset, each belonging to a different category. These images were correctly classified on the relevant image classification models, ensuring that any misclassified images after adding adversarial perturbations are adversarial examples. During attack testing, four normally trained models and three adversarially trained models were used.

[0083] Evaluation indicators:

[0084] Attack Success Rate (ASR): This metric represents the ability of adversarial examples to deceive image classification models, causing them to misclassify, i.e., the classification error rate. In the experiment, generated adversarial examples were tested on different image classification models. Images that were misclassified were considered adversarial examples, and the proportion of these misclassified images in the total number of images represents the attack success rate. The attack success rate metric can be expressed by formula (12).

[0085]

[0086] Image feature difference index: By introducing image variance, the inter-row pixel information of the image is used as the feature value of the image.

[0087] The pixel variance of an image is calculated using formula (13).

[0088]

[0089] The distance between the original image and the adversarial example is evaluated using an eigenvalue similarity metric by calculating the variance of each pixel location in the original image and the adversarial example. Typically, the original image needs to be scaled when calculating the variance eigenvalues, where m is the scale of the scaled image. This represents the average pixel value of each row in the image. When measuring the difference between the variance features of the original image and the variance features of the adversarial example, a similarity metric is used to measure this difference. A confidence level is set to measure the number of changed pixels, specifically quantified using Variance Feature Similarity (VFS). This facilitates the measurement of the differences in the effectiveness of adversarial noise addition and the strength of the imperceptibility of perturbations under different adversarial example generation methods. This metric represents the proportion of unchanged pixels out of all pixels; therefore, a higher metric is better for finding more covert generation methods against perturbations.

[0090] Image structural similarity index: The structural similarity index (SSIM) is used to measure the difference between the original image and the adversarial sample. Compared with traditional indexes such as peak signal-to-noise ratio (PSNR), this index is more in line with the judgment criteria of the human eye. This index mainly compares three aspects: brightness, contrast and structure, as defined in formulas (14)-(17).

[0091] SSIM(x,x adv )=[l(x,x adv )] α [c(x,x adv )] β [s(x,x adv )] γ (14)

[0092]

[0093]

[0094] Where, l(x,x) adv The comparison is between the brightness information of the original image and the adversarial example, c(x,x) adv ) and s(x,x adv These correspond to contrast information and structural information, respectively. x and σ is the average value corresponding to the pixel information of the original image and the adversarial sample. x and The standard deviation of pixels. Let C1, C2, and C3 be the covariance between the original image and the adversarial example. C1, C2, and C3 are used to preserve l(x, x). adv c(x,x) adv ) and s(x,x advThe stability constant. This index is usually normalized to the range of [-1, 1]. The larger the value, the higher the structural similarity between the two images. The goal of this study is to make this index as large as possible.

[0095] 1. The impact of salient regions on classification results

[0096] In adversarial attacks, adversarial perturbations are primarily added within salient regions. Therefore, the impact of salient regions on classification results is first verified. In the experiment, two sets of samples were designed for comparative analysis. Based on salient and inverse salient masks, Hadamard products with the original image yield Adv-SR (image retaining only salient regions) and Adv-non-SR (image removing salient regions). A saliency map was generated using the DCFA model, followed by a saliency mask. The corresponding pixel threshold φ was set to 15; for pixels greater than 15, the mask value was set to 1. This was used to retain salient regions in Adv-SR and remove them in Adv-non-SR. A schematic diagram is shown below. Figure 5 As shown.

[0097] Then, classification tests were performed on six image classification models, and the results are as follows: Figure 6 As shown in the figure, both Adv-SR and Adv-non-SR showed a decrease in classification accuracy compared to the original image. Adv-SR's accuracy decreased by an average of 4.8 percentage points, while Adv-non-SR's decreased by an average of 73.3 percentage points. Therefore, salient regions play a greater role in image classification, and when these regions are attacked, the resulting adversarial examples are more effective in causing the model to misclassify.

[0098] 2. Model attack comparison test

[0099] Successful attack execution is fundamental to adversarial examples. The first step is to test the attack success rate of image classification models. In the experiment, adversarial examples were first generated on a normally trained model, and then attacks were tested on seven image classification models (four normally trained models and three adversarially trained models). The attack success rate under both white-box and black-box scenarios was used as an indicator to measure the attack performance of the adversarial examples. The experiment used MI-FGSM as the baseline method to verify the effectiveness of the proposed MA-MI-FGSM (Mask-based Momentum Iterative Fast Gradient Sign Method) and MA-NA-FGSM (Mask-based Nadam Iterative Fast Gradient Sign Method) methods. The hyperparameters involved were: maximum perturbation ε = 16 pixels, number of iterations T = 10, momentum decay factor μ = 1, Nadam decay factors β1 = 0.9, β2 = 0.999, and stability coefficient δ = 10. -14 The experimental results are shown in Table 1. The data shows that the adversarial example generation method for significant regions without optimization has a lower success rate for both white-box and black-box attacks compared to the adversarial example generation method with global perturbation. For example, when performing white-box attacks on adversarial examples generated on the Inc-v3 model, MA-MI-FGSM's success rate is 0.3 percentage points lower than MI-FGSM's, while in Inc-v3... ens3 When performing black-box attacks on the model, the success rate decreased by 1.7 percentage points, indicating that the background region also affects the image classification results to some extent, and the strength of the adversarial perturbation added to the key regions is insufficient. After introducing the Nadam optimization algorithm, the success rate of the corresponding black-box attack algorithm was significantly improved. When adversarial examples generated on Inc-v4 were used to perform transfer attacks on six other image classification models, the average black-box attack success rate increased by 7.55 percentage points, demonstrating the advantage of our attack algorithm.

[0100] Subsequently, experiments were designed to compare MA-DIM (Mask-based Diverse Input Method), MA-NA-DIM (Mask-based Nadam Diverse Input Method), and DIM, as shown in Table 2. The transformation range during scale variation is [299, 330) pixels, and other hyperparameters are as described above. Compared to the baseline method, the salient region optimization generation method is clearly more aggressive, achieving performance improvements in attack success rate and attack concealment. For example, in adversarial examples generated on IncRes-v2, the MA-NA-DIM method improved by 7.2 percentage points compared to the MA-MI-DIM method, and also further improved the average black-box attack success rate compared to the DIM method. It should be noted that adversarial noise is only added to the salient regions of the image, at which point the noise perceptibility is significantly reduced.

[0101] Table 1 Success rate of single-model attacks using methods such as MA-NA-FGSM, etc.

[0102]

[0103] Table 2 Success Rate of Single-Model Attacks Using Methods such as MA-NA-DIM

[0104]

[0105] Tables 1 and 2 show the white-box and black-box attack tests, respectively. The four models on the left side of the tables are the adversarial sample generation models, which are generated using Inc-v3, Inc-v4, IncRes-v2, and Res-101, respectively. Then, the adversarial samples generated on these known models are used to test on the four known models and the three unknown models (Inc-v3, Inc-v4, IncRes-v2, and Res-101). ens3 Inc-v3 ens4 and IncRes-v2 ens Attack tests were conducted on known models (white-box tests) and unknown defense models (black-box tests). Table 1 mainly compares and improves upon MI-FGSM. MA-MI-FGSM adds saliency masking to MI-FGSM, while MA-NA-FGSM optimizes the Nadam algorithm and adds saliency masking to MI-FGSM. Similarly, Table 2 mainly compares and improves upon DIM methods. MA-DIM adds saliency masking to DIM, while MA-NA-DIM optimizes the Nadam algorithm and adds saliency masking to DIM.

[0106] 3. Image quality comparison test

[0107] Feature Difference Index Comparison Experiment: First, the features of adversarial example images generated by different methods were compared and analyzed. In the experiment, the MI-FGSM method and the MA-MI-FGSM method in this solution were used to generate adversarial examples on 1000 images respectively. Then, for ease of calculation, the adversarial example images and the original images were scaled to 64×64 pixels, and the images were segmented into 64-dimensional tensors. The average value was calculated in row vector units, and the corresponding variance value was obtained. This variance value was used as the feature value of the image, and its similarity index was calculated, such as... Figure 7 As shown in the diagram. The star, triangle, and circle markers correspond to the pixel variance of the original image, the pixel variance of the adversarial example, and the difference in pixel variance, respectively. The longer the circle marker, the greater the difference between the original image and the adversarial example, indicating greater feature discriminability and a larger modification to the original image (i.e., the added adversarial perturbation) during adversarial example generation. Therefore, the purpose of this solution is to reduce the difference in pixel variance between the original image and the adversarial example. Since this difference is a reverse indicator, the concept of feature similarity is introduced to more intuitively measure it. This is the proportion of changed pixels to the total number of pixel values. Whether a change has occurred is represented by the variance confidence level. For example, setting the confidence level to 0.95 indicates that the change is within 5% of the original image's variance. With a confidence level of 0.95, we obtain the feature similarity between the adversarial example and the original image as shown below. Figure 7 As shown in columns 2 and 3, higher feature similarity indicates a closer resemblance between the adversarial example and the original image, resulting in better imperceptibility of the adversarial perturbation. Compared to adversarial example generation methods that use global perturbation, the adversarial examples generated using this approach exhibit higher feature similarity to the original image. This is primarily because adding adversarial perturbation to the entire image introduces more adversarial noise into the background, leading to greater feature differences between the adversarial example and the original image. Furthermore, this approach modifies the original image within a minimal scope by adding adversarial perturbation to the main semantic region of the image, thus achieving greater feature similarity between the adversarial example and the original image.

[0108] Subsequently, a comparative analysis of the various methods was conducted on the entire experimental dataset, and the experimental results are shown in Table 3. The data in the table shows that the feature similarity indices of MI-FGSM and DIM are not significantly different, with average values ​​of 0.534 and 0.546, respectively. In contrast, the average feature similarity indices of their corresponding salient region optimization methods, MA-NA-FGSM and MA-NA-DIM, are 0.697 and 0.693, respectively, representing performance improvements of 30.5% and 26.9%.

[0109] Table 3 Comparison of Feature Similarity Indicators

[0110]

[0111] Structural Similarity Comparison Experiment: To further compare the similarity between the original image and the adversarial sample in terms of brightness, contrast, and structure, the structural similarity of adversarial samples generated by different methods was compared with the original image. In the experiment, 1000 images from the ImageNet dataset were used to conduct attack experiments on four image classification models. The structural similarity indices of different methods are shown in Table 4. As can be seen from the table, compared to the benchmark methods MI-FGSM and DIM, the adversarial sample generation methods MA-MI-FGSM, MA-NA-FGSM, MA-DIM, and MA-NA-DIM in this proposal all achieved significant improvements in structural similarity indices. For example, on Inc-v3, the average SSIM value of adversarial samples generated using MI-FGSM was 0.574, while the average SSIM value of adversarial samples generated using the proposed attack method MA-MI-FGSM was 0.785, representing an improvement of 32.0%. This demonstrates that the proposed method can effectively improve the similarity between adversarial samples and the original image. Meanwhile, when the Nadam optimizer is introduced, the improvement in the structural similarity index between the adversarial example and the original image is not significant, which verifies that the optimizer's main role is to improve the success rate of black-box attacks on adversarial examples. In improving structural similarity, the method of adding adversarial perturbations to salient regions is primarily effective.

[0112] Table 4 Comparison of structural similarity indices for methods such as MA-NA-DIM

[0113]

[0114] Furthermore, to verify the attack performance of this method on ensemble models, attack experiments on ensemble models were also conducted using the logistic value ensemble method. The experimental results are shown in Table 5. In the experiments, adversarial examples were generated on four ordinary training models, and attack tests were performed on three adversarial training models. The SSIM metric was used to measure the stealth of the adversarial attack, and the ASR metric was used to measure the aggressiveness of the adversarial examples. It can be seen that MA-NA-SI-TI-DIM achieves a dual improvement in attack stealth and attack success rate compared to the benchmark SI-NI-TI-DIM method. Specifically, the significance index SSIM improved by 27.2%, and the black-box attack success rate remained at 92.7%, further demonstrating the advantages of the proposed solution.

[0115] Table 5 Comparison of attack performance of methods such as MA-NA-SI-TI-DIM

[0116]

[0117] Human Evaluation Test Experiment: To more clearly and intuitively demonstrate the pixel-level perturbation details of adversarial examples and effectively evaluate the effectiveness of this method in practical applications, this study generated adversarial examples on the ImageNet dataset and conducted human evaluation tests. Similar to the generation method of salient region optimization, the MI-FGSM method belongs to the category of methods that utilize gradient information during backpropagation to generate adversarial examples. Therefore, adversarial examples were generated using these two methods, and the imperceptibility of image adversarial perturbation was compared in a surveyed population. The experiment randomly selected 10 sets of images. Each set of evaluation images consisted of the original image, adversarial examples generated by MI-FGSM, and adversarial examples generated by MA-MI-FGSM. In each evaluation, the original image was fixed, while the evaluation images were randomized, including both the original image and adversarial examples generated using different methods. Figure 8 Examples of original images and adversarial sample images are shown: (a) is the original image, (b) is an adversarial sample generated using MI-FGSM, and (c) is an adversarial sample generated using MA-MI-FGSM.

[0118] The imperceptibility of adversarial perturbations refers to the perceptual feedback of the human eye to physical stimuli. Since the human eye system varies from person to person, and judgments about images are influenced by prior knowledge, this study conducted a categorized survey of different populations to more effectively assess the imperceptibility of adversarial perturbations. Two survey groups were established: Group A consisted of individuals exposed to adversarial examples, and Group B consisted of individuals not exposed to adversarial examples, with 50 participants in each group. During the experiment, 10 sets of images were randomly displayed. Participants were asked to rate the similarity between the original image and the corresponding random image, giving a score from 0 to 10 within 3 seconds. A higher score indicated a higher similarity, with 10 indicating that the adversarial example was completely identical to the original image. The specific results are as follows: Figure 9 and Figure 10 As shown.

[0119] Figure 9 The results show the scoring by a group of people with some understanding of adversarial examples. By comparing the various line graphs, it can be seen that when the randomly displayed image is the original image, the average score is the highest. However, when the displayed object is an adversarial example, the adversarial example generated using MA-MI-FGSM scores higher, indicating that it is more similar to the original image. This is mainly because this method restricts the adversarial perturbation to the salient region of the main image. The adversarial noise in this salient region is negligible to the evaluators due to its inherently more complex texture features. In contrast, the adversarial examples generated by the MI-FGSM method are more noticeable to the human eye due to the excessive texture features in the background region.

[0120] Figure 10 The survey results for a group of people unfamiliar with image adversarial examples are presented. As can be seen from the figures, adversarial examples generated using MA-MI-FGSM scored higher than those generated using MI-FGSM, with an average score of 8.88 compared to 8.16. It is also noted that in the ninth group of experiments, there were instances where adversarial examples generated by both methods scored the same. This is mainly due to the subject region of the image having a single color, while the background region is more complex, such as a white truck against a dark background. In this case, adding adversarial perturbations only to the subject region can affect people's judgment of image quality. However, from the overall evaluation results, the method based on salient region optimization generally has stronger concealment.

[0121] comprehensive Figure 9 and Figure 10 The evaluation results show that the adversarial examples generated based on the salient region optimization method achieve a higher similarity to the original images, proving the effectiveness of the method from a practical application perspective. At the same time, it can be seen that people with some knowledge of image adversarial examples tend to have a higher ability to identify adversarial examples generated by ordinary methods, which also illustrates the importance of popularizing knowledge about adversarial examples.

[0122] Furthermore, in this scheme, the local perturbation is calculated using a mask after the global perturbation is generated. Since only one Hadamard product operation is required, the computational workload can be effectively reduced. Regarding the attack success rate, performing salient mask operations in each iteration improves the success rate, but the improvement is limited. This is mainly because salient regions have a more significant impact on image classification results, thus mitigating the impact of noise selection in each iteration on the final adversarial example attack success rate. Experimental verification and comparative analysis were conducted for these two technical schemes. The experiments used MA(Sr)-MI-FGSM [Mask-based (Single round) Momentum Iterative Fast GradientSign Method, an adversarial example generation method using salient masks in a single round (the last round)] and MA(Nr)-MI-FGSM [Mask-based (N round) Momentum Iterative Fast Gradient Sign Method, an adversarial example generation method using salient masks in multiple rounds (N rounds)].

[0123] The experimental results are shown in Table 6 below. The data shows that compared to generating a global perturbation before saliency masking, performing saliency masking in each round improves the attack success rate, but the improvement is very limited. For example, when using Inc-v4 to generate adversarial examples to attack other models, the multi-round method improves the average success rate of black-box attacks compared to the single-round method, but the improvement is very limited, averaging only 0.52%.

[0124] Table 6 Comparison of experimental data between MA(Sr)-MI-FGSM and MA(Nr)-MI-FGSM

[0125]

[0126] In summary, different noise truncation schemes for saliency masks have their own advantages in different scenarios. When the success rate of the attack is the primary concern, the scheme of performing saliency mask calculations in each iteration can be used. However, when considering both the success rate of the attack and the training cost of adversarial examples, the scheme in this case, which generates a global perturbation and then performs calculations through a saliency mask, can achieve better overall results and has a better cost-performance ratio.

[0127] Unless otherwise specifically stated, the relative steps, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of the invention.

[0128] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0129] The units and method steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations are not considered to be beyond the scope of this invention.

[0130] Those skilled in the art will understand that all or part of the steps in the above methods can be implemented by a program instructing related hardware, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk. Optionally, all or part of the steps in the above embodiments can also be implemented using one or more integrated circuits. Accordingly, each module / unit in the above embodiments can be implemented in hardware or as a software functional module. This invention is not limited to any particular combination of hardware and software.

[0131] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for generating adversarial examples based on deep neural networks, characterized in that, Includes the following content: Based on the semantic information of the images in the sample data, the original images in the sample data are transformed into saliency maps; the saliency maps are used to delineate the salient regions in the original images of the sample data for adding perturbations, and the saliency mask is obtained by binarizing the pixel values ​​of the saliency maps. The original images from the sample data are input into the image classification model, and the gradient information during the backpropagation process of the Nadam optimization algorithm and the convolutional neural network is used to iteratively generate adversarial examples with global perturbation. The global adversarial noise is obtained by subtracting the adversarial sample from the original image. Adversarial noise within salient regions is obtained by utilizing the Hadamard product of global adversarial noise and salient mask, and the final output salient region adversarial sample is obtained by combining the adversarial noise with the original image. The process of converting the original image in the sample data into a saliency map includes the following: using a trained variable convolution and feature attention DCFA network model to convert the original image into a grayscale image with pixel values ​​between 0 and 255, and using this grayscale image as the saliency map. The DCFA network model extracts non-uniform contextual features from the low-level details and high-level semantics of the original image, and obtains the saliency map boundary by assigning adaptive feature weights in the spatial domain and channel domain. In the iterative generation of adversarial examples with global perturbation, the gradient calculation of the loss function during the backpropagation of the convolutional neural network is used to obtain the misclassification labels by gradually increasing the loss function value in the image classification process, and the update process of the loss function is integrated in the form of momentum accumulation to stabilize the update direction of the loss function. During the update process of the loss function, the Nesterov algorithm for optimizing the update path and the RMSprop algorithm for optimizing the learning rate are combined to form the Nadam algorithm. The Nadam algorithm is used to accumulate historical gradient data and predicted data, so as to simultaneously optimize the loss function update path and the learning rate.

2. The adversarial example generation method based on deep neural networks according to claim 1, characterized in that, The process of binarizing the pixel values ​​of the saliency map is represented as follows: Among them, s i,j Let m be the pixel value at position (i,j) of the saliency map S, φ be the corresponding pixel threshold, and m be the pixel value at position (i,j). i,j This is the value at position (i,j) corresponding to the salient mask M after binarization.

3. The adversarial example generation method based on deep neural networks according to claim 1, characterized in that, In the Nesterov algorithm, gradient jumps during the adversarial example generation process are used to help predict gradient changes as the loss function moves forward, and the predicted gradient changes are included in the gradient accumulation process.

4. The adversarial example generation method based on deep neural networks according to claim 1 or 2, characterized in that, In the RMSprop algorithm, the learning rate of the loss function is dynamically adjusted by using the gradient magnitude during the adversarial example generation process, and the dynamic step size during the loss function update process is adjusted to avoid repeated oscillations near the final extreme point.

5. An adversarial example generation system based on a deep neural network, characterized in that, It includes: a sample data processing module, a first sample generation module, and a second sample generation module, wherein, The sample data processing module is used to convert the original image in the sample data into a saliency map based on the image semantic information in the sample data; to use the saliency map to delineate the salient regions in the original image of the sample data for adding perturbation; and to obtain a saliency mask by binarizing the pixel values ​​of the saliency map. The first sample generation module is used to input the original images in the sample data into the image classification model, and use the gradient information in the back-transmission process of the Nadam optimization algorithm and the convolutional neural network to iteratively generate adversarial samples with global perturbation. The second sample generation module is used to subtract the adversarial sample from the original image to obtain global adversarial noise; the adversarial noise in the salient region is obtained by using the Hadamard product of the global adversarial noise and the salient mask; and the final output salient region adversarial sample is obtained by combining the adversarial noise with the original image. The process of converting the original image in the sample data into a saliency map includes the following: using a trained variable convolution and feature attention DCFA network model to convert the original image into a grayscale image with pixel values ​​between 0 and 255, and using this grayscale image as the saliency map. The DCFA network model extracts non-uniform contextual features from the low-level details and high-level semantics of the original image, and obtains the saliency map boundary by assigning adaptive feature weights in the spatial domain and channel domain. In the iterative generation of adversarial examples with global perturbation, the gradient calculation of the loss function during the backpropagation of the convolutional neural network is used to obtain the misclassification labels by gradually increasing the loss function value in the image classification process, and the update process of the loss function is integrated in the form of momentum accumulation to stabilize the update direction of the loss function. During the update process of the loss function, the Nesterov algorithm for optimizing the update path and the RMSprop algorithm for optimizing the learning rate are combined to form the Nadam algorithm. The Nadam algorithm is used to accumulate historical gradient data and predicted data, so as to simultaneously optimize the loss function update path and the learning rate.

6. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor is configured to execute a program stored in memory and, when the program is executed, implement the steps of the method described in any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the method described in any one of claims 1 to 4.

Images