Unrestricted adversarial sample generation method and device, electronic equipment and storage medium

Abstract

Embodiments of the present application provide a method and device for generating unrestricted adversarial samples, electronic equipment and storage medium, which relate to the technical field of adversarial sample generation. The method comprises: obtaining a denoised image and a corresponding predicted image at the current time based on the backward process of a diffusion model; generating a perturbation between the predicted image and its adversarial sample through adversarial attack on the predicted image; migrating the perturbation to the denoised image at the current time, and denoising the migrated denoised image at the current time through the backward process of the diffusion model until an unrestricted adversarial sample is generated. Embodiments of the present application solve the problems that the unrestricted adversarial samples generated in the related art are distorted in shape, do not conform to the real distribution, the semantic information of the region used for artificial discrimination is blurred, and it is difficult to distinguish.

Description

Technical Field

[0001] This application relates to the field of adversarial sample generation technology, and more specifically, to an unrestricted adversarial sample generation method, apparatus, electronic device, and storage medium. Background Technology

[0002] Neural networks are used in many fields, including credit scoring in banks, pedestrian recognition in autonomous driving, intruder detection in security systems, and risk operation identification in high-risk jobs. Therefore, ensuring the security of neural networks is crucial. Currently, one method of attacking neural networks is called adversarial examples. The method of generating adversarial examples is called an adversarial attack. An adversarial attack modifies the data before it is input into the neural network, making the modified image appear indistinguishable from the original to the human eye, or even conforming to the true image distribution, but causing the neural network to misidentify it. To improve the robustness of neural networks, more and more research is being conducted on how to generate adversarial examples and how to implement adversarial defenses. More powerful and transferable attack examples can make the adversarially trained model more robust. Furthermore, as research on adversarial examples deepens, its study of model interpretability and the transferability of adversarial examples provides more evidence-based guidance for the design and training of neural networks in deep learning.

[0003] However, existing technologies suffer from problems such as distorted shapes in the generated unrestricted adversarial examples, inconsistent with the true distribution, and ambiguous semantic information in the regions used for manual discrimination, making them difficult to distinguish.

[0004] As can be seen from the above, the problem of how to generate high-quality unrestricted adversarial sample images while preserving key semantics remains to be solved. Summary of the Invention

[0005] This application provides a method, apparatus, electronic device, and storage medium for generating unrestricted adversarial examples, which can solve the problems in related technologies such as distorted adversarial example shapes, non-consistency with real distribution, and ambiguous semantic information in regions used for manual judgment, making them difficult to distinguish. The technical solution is as follows:

[0006] According to one aspect of the embodiments of this application, an unrestricted adversarial example generation method is provided. The method includes: obtaining a denoised image and a corresponding predicted image at a current time based on a backward process of a diffusion model; generating a perturbation between the predicted image and its adversarial example by performing an adversarial attack on the predicted image; transferring the perturbation to the denoised image at the current time, and denoising the transferred denoised image at the current time through the backward process of the diffusion model, until unrestricted adversarial examples are generated.

[0007] According to one aspect of the embodiments of this application, an apparatus for generating unrestricted adversarial examples includes: an image denoising module for obtaining a denoised image and a corresponding predicted image at a current time based on a backward process of a diffusion model; a perturbation generation module for generating a perturbation between the predicted image and its adversarial examples through an adversarial attack on the predicted image; and a sample generation module for transferring the perturbation to the denoised image at the current time and denoising the transferred denoised image at the current time through a backward process of a diffusion model until unrestricted adversarial examples are generated.

[0008] According to one aspect of the embodiments of this application, an electronic device includes: at least one processor, at least one memory, and at least one communication bus, wherein a computer program is stored in the memory, and the processor reads the computer program from the memory through the communication bus; when the computer program is executed by the processor, it implements the unrestricted adversarial sample generation method as described above.

[0009] According to one aspect of the embodiments of this application, a storage medium stores a computer program thereon, which, when executed by a processor, implements the unrestricted adversarial sample generation method as described above.

[0010] According to one aspect of the embodiments of this application, a computer program product includes a computer program stored in a storage medium, a processor of a computer device reads the computer program from the storage medium, and the processor executes the computer program, causing the computer device to implement the unrestricted adversarial sample generation method as described above when executed.

[0011] The beneficial effects of the technical solution provided in this application are:

[0012] In the above technical solution, the powerful denoising capability of the diffusion model is utilized to remove disturbances that do not conform to the true distribution, resulting in high-quality generated images where objects conform to the true distribution. Furthermore, by combining warm-start and low-frequency guidance techniques, the diffusion model can generate samples that are similar to the original image but also have a certain degree of sample diversity. At the same time, feature visualization is used to identify important features in the original image and retain them in the generated adversarial examples, effectively solving the problems of low image quality and ambiguous key semantics in the unrestricted adversarial examples generated in the prior art. Attached Figure Description

[0013] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments of this application will be briefly introduced below.

[0014] Figure 1 This is a flowchart illustrating an unrestricted adversarial sample generation method according to an exemplary embodiment;

[0015] Figure 2 This is a schematic diagram illustrating the generation of samples using a diffusion model according to an exemplary embodiment;

[0016] Figure 3 This is based on the flowchart of step 110 shown in the embodiment by Shi Lixin;

[0017] Figure 4 This is a sample system diagram generated according to a diffusion model illustrated in an exemplary embodiment;

[0018] Figure 5 These are predicted images at different times during the backward process of a diffusion model, as illustrated in an exemplary embodiment.

[0019] Figure 6 This is a flowchart illustrating low-frequency guidance according to an exemplary embodiment;

[0020] Figure 7 This is a flowchart illustrating an exemplary embodiment for preserving important features in a test sample;

[0021] Figure 8 A schematic diagram of a category activation map (CAM) according to an exemplary embodiment;

[0022] Figure 9 This is a flowchart illustrating another way of preserving important features in a test sample, according to an exemplary embodiment;

[0023] Figure 10 This is a flowchart illustrating the robustness of a method for generating adversarial examples according to an exemplary embodiment;

[0024] Figure 11 This is a structural block diagram of an unrestricted adversarial sample generation apparatus according to an exemplary embodiment;

[0025] Figure 12 This is a hardware structure diagram of an electronic device according to an exemplary embodiment;

[0026] Figure 13 This is a structural block diagram of an electronic device according to an exemplary embodiment. Detailed Implementation

[0027] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain this application, and should not be construed as limiting this application.

[0028] Those skilled in the art will understand that, unless specifically stated otherwise, the singular forms “a,” “an,” “the,” and “the” used herein may also include the plural forms. It should be further understood that the term “comprising” as used in this application means the presence of the stated features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof. It should be understood that when we say an element is “connected” or “coupled” to another element, it can be directly connected or coupled to the other element, or there may be intermediate elements. Furthermore, “connected” or “coupled” as used herein can include wireless connections or wireless coupling. The term “and / or” as used herein includes all or any units and all combinations of one or more associated listed items.

[0029] As mentioned earlier, in order to improve the robustness of neural networks, more and more work is beginning to study how to generate adversarial examples and how to implement adversarial defense. More powerful and transferable attack examples can make the model more robust after adversarial training. Furthermore, with the deepening of adversarial example research, its study on model interpretability and the transferability of adversarial examples provides more evidence-based guidance for the design and training of neural networks in deep learning.

[0030] Adversarial examples under the Lp norm are common examples. The Lp norm means that the size of the perturbation is limited to a certain range of L1, L2, and Linf. After obtaining the transmitted information, attackers can modify it at the data level. Since the perturbation is very small, it is no different from the original image to the naked eye, but it can cause the neural network to misclassify with a high probability. In real-world scenarios, attackers can launch unlimited attacks on images, as long as the attack does not interfere with normal recognition and can be classified normally by humans but misclassified by the neural network. For example, placing black and white blocks on road signs that do not affect human judgment.

[0031] Since the discovery of adversarial examples, the security issues of artificial intelligence algorithms have received widespread attention from industry and academia. Traditional adversarial example generation methods limit the modeling of perturbations to a certain range within the Lp norm, failing to model the true perceptual distance of perturbations to humans. Therefore, more and more researchers are turning their attention to unrestricted adversarial examples. Unrestricted adversarial examples have no norm limit on the perturbation range, but it is necessary to ensure that the generated sample appears semantically similar to the original image to the human eye. This type of attack, with its perturbation range encompassing the Lp norm, represents a further refinement and supplement to adversarial examples based on the Lp norm.

[0032] Most existing technologies for generating unrestricted adversarial examples are based on encoder-decoder networks and generative adversarial networks (GANs). The encoder network is modified during the training of the generative model to make the output images adversarial examples. This method modifies the network's loss function by adding a loss that limits the distance between the generated adversarial example and the original image. This causes the target attack network to classify the adversarial example into the wrong category or the target category, resulting in an adversarial attack loss. The trained generative model can directly generate adversarial examples. GANs, on the other hand, modify the generative model during the inference phase after normal training without modification, making the output images adversarial examples.

[0033] However, the above methods also have shortcomings. When the models based on encoder networks and generative adversarial networks are used to generate unrestricted adversarial examples, they mostly perturb the latent variables. Therefore, the generated samples have problems such as poor image quality, semantic ambiguity of key objects, and the edges or shapes of objects not conforming to the true distribution.

[0034] It is evident that the generated adversarial examples still suffer from distorted shapes, inconsistent with the true distribution, and ambiguous semantic information in regions used for manual discrimination, making them difficult to distinguish.

[0035] Therefore, the unrestricted adversarial example generation method provided in this application can effectively improve the image quality of the generated samples while preserving key semantics. Accordingly, the unrestricted adversarial example generation method is applicable to an unrestricted adversarial example generation device, which can be deployed on an electronic device, such as a computer device deploying a von Neumann architecture, for example, a desktop computer, a laptop computer, a server, etc.

[0036] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0037] Please see Figure 1 This application provides an unrestricted adversarial sample generation method, which is applicable to electronic devices, such as computer devices.

[0038] In the following method embodiments, for ease of description, the execution subject of each step of the method is an electronic device, but this does not constitute a specific limitation.

[0039] like Figure 1 As shown, the method may include the following steps:

[0040] Step 110: Based on the backward process of the diffusion model, obtain the denoised image and the corresponding predicted image at the current time.

[0041] Specifically, such as Figure 2 The diagram illustrates the generation of image samples using a diffusion model, where the backward process is from left to right and the forward process is from right to left. The diffusion model is a generative model, capable of generating image samples. Its core idea is to first define a forward process q that progressively adds noise to the image under the true distribution, ultimately transforming it into standard Gaussian noise. The image generation task is then described as a series of denoising processes, i.e., a backward process p. θ The diffusion model adds noise in the forward process and uses a neural network to learn how to remove noise in the backward process, thus gradually removing noise from Gaussian noise to obtain an image that conforms to the distribution.

[0042] In one possible implementation, the noisy image is denoised using a backward process of a diffusion model to obtain the denoised image and the corresponding predicted image at the current time step. The backward denoising process of the diffusion model is an iterative process; depending on the number of iterations, denoised images can be obtained at different times, and the image obtained after the final iteration is the predicted image.

[0043] The inventors discovered that if the predicted image can closely approximate a reference image, making their semantic information identical, it will facilitate the acceleration of the backward process in the diffusion model. Therefore, this application employs a hot-start approach to guide the adversarial process of generating unrestricted adversarial examples. That is, a hot-start refers to starting the backward process of the diffusion model from a certain point in the forward process, rather than starting the backward process of the diffusion model from standard Gaussian noise. One possible implementation is as follows: Figure 3 The above step 110 also includes the following steps:

[0044] Step 1110: Obtain test samples from the test dataset.

[0045] The test sample can be considered as a reference image used to provide a similarity to the predicted image, or it can be understood as the original image.

[0046] Step 1130: Noise is added to the test sample through the forward process of the diffusion model to obtain the noisy image at the target time.

[0047] Step 1150: Denoise the noisy image at the target time by using the backward process of the diffusion model to obtain the denoised image at the current time and the corresponding predicted image.

[0048] Specifically, after obtaining test samples from the test set, this application introduces a warm-start method in the forward noise addition process, that is, starting the backward process at a certain iteration t in the forward process, such as... Figure 4 As shown, the initial image used for inverse denoising at this point is not standard Gaussian noise X. TInstead, the noisy image is obtained by passing the test sample through the forward process of the diffusion model and adding noise for the tth time. The value of t is generally between 500 and 700 times. At this time, the noisy image retains the structural information of the test sample, but loses the detailed information. Using it as the initial image for the denoising process, the final generated prediction image can still be similar to the structure of the test sample and can accelerate the backward process.

[0049] Step 130: By performing an adversarial attack on the predicted image, a perturbation between the predicted image and its adversarial sample is generated.

[0050] In the process of generating unrestricted adversarial examples, in order to make the generated results as close as possible to the target label, it is necessary to perform adversarial attacks on the predicted image and use the attacked model to classify the generated predicted image, thereby generating adversarial examples that are imperceptible to the human eye but will be misclassified by the attacked model.

[0051] In one possible implementation, this application provides two different classifiers to generate predicted images and perturbations between them and adversarial examples at different stages based on the different classifiers. These two different classifiers include a real classifier and a natural classifier trained with added noise. Specifically, the real classifier refers to the classifier in the attacked model, while the natural classifier refers to the classifier trained with added noise.

[0052] The first stage refers to the situation where the predicted category of the image belongs to the same category as the true category, and the second stage refers to the situation where the predicted category of the image belongs to a different category than the true category. For example... Figure 5 As shown, we can see that in the early stage when t>700, the approximate tone information appears, and then the outline information is gradually added. When t=300, the outline information is roughly completed, until the detailed texture information is finally added. Therefore, the second stage can be roughly considered to be in the range of t>400, while the first stage is in the range of t<=400.

[0053] Specifically, the predicted image is input into the attacked model for classification prediction. Different classifiers are selected to generate perturbations based on the attacked model's recognition capabilities. In the first stage, when the predicted category of the image belongs to the same category as the true category (indicating the attacked model can still recognize the noisy predicted image), perturbations are generated using the true classifier. In the second stage, when the predicted category of the image belongs to a different category than the true category (indicating the attacked model can no longer recognize the noisy predicted image), perturbations are generated using a natural classifier trained with added noise.

[0054] In one possible implementation, a perturbation between the predicted image and its adversarial example is generated based on the difference between the adversarial example and the predicted image. Alternatively, the perturbation can be viewed as essentially reflecting the difference between the predicted class to which the adversarial example is predicted and the true class to which the predicted image belongs.

[0055] Step 150: Transfer the perturbation to the denoised image at the current time, and denoise the transferred denoised image at the current time through the backward process of the diffusion model until an unrestricted adversarial example is generated.

[0056] In this embodiment, the disturbance migration is achieved according to the following calculation formula:

[0057]

[0058] Among them, X t-1 Let denoise the denoised image at the current time, u denote the mean of the Gaussian distribution at the current time, ∑ denote the variance of the Gaussian distribution at the current time, g denote the predicted image obtained by optimizing the adversarial loss function C and the perturbation between it and the adversarial samples, and s denote the pre-configured hyperparameters used to control the intensity of the added perturbation.

[0059] It should be noted that C can be represented by the cross-entropy loss SCE in the PGD attack. The formulas for calculating C and SCE are as follows:

[0060] C = SCE(y) p ,y)or-SCE(y p ,y')

[0061] SCE(p,q)=-∑p i log(g i )

[0062] Among them, y p y represents the one-hot vector of the predicted class, y represents the one-hot vector of the true class, and y' represents the one-hot vector of the misclassified class that we hope will be misclassified when attacked.

[0063] The inventors realized that in the aforementioned hot-start process, if t is too large, it may not guarantee that the predicted image and the reference image are close, while if t is too small, the diversity of adversarial examples will decrease due to insufficient iterations. Therefore, this application incorporates low-frequency guidance during the generation of unrestricted adversarial examples to ensure that the predicted image is closer to the test sample. In one possible implementation, such as... Figure 6 As shown, prior to step 150 above, the method further includes the following steps:

[0064] Step 210: Based on the forward process of the diffusion model, determine the noisy image of the test sample at the current time.

[0065] Step 230: Compare the low-frequency information in the denoised image and the denoised image at the current time to obtain the corresponding error.

[0066] Step 250: Based on the distribution area of ​​the error on the test sample, the low-frequency information in the denoised image at the current moment is supplemented to transfer the perturbation based on the supplemented denoised image.

[0067] Specifically, low-frequency guidance is added to the backward propagation process of the diffusion model. First, the noisy images of the test samples at different times during the forward propagation process are determined. To ensure that the predicted image is as close as possible to the test sample during the backward pass, the denoised image x at the same time step is used. t and noisy images The comparison of low-frequency information is performed, and the low-frequency information is determined by formula. The result is obtained where φ represents low-frequency filtering (downsampling) and linear interpolation (upsampling), with the goal of acquiring low-frequency information with the same resolution as the test image. After acquiring low-frequency information with the same resolution as the test image, it is added to the denoised image at the current time step, and the process continues iteratively to obtain the final predicted image.

[0068] It ensures the completeness of semantic information in the generated adversarial examples as much as possible, and by limiting the size of the filter and the time period for low-frequency information filling in the low-frequency filtering process, it is possible to freely control the similarity of low-frequency information between the predicted image and the test sample, as well as the diversity of the generated samples.

[0069] Furthermore, the inventors discovered that during the generation of unrestricted adversarial examples, the semantics used for image classification gradually become blurred, making it difficult for even humans to distinguish between them. To ensure that important information in the image is not lost, it is first necessary to identify the important regions as perceived by the human eye or the classifier, thereby preserving these important regions as much as possible in the generated adversarial examples. Since important regions may change during the generation process, the unrestricted adversarial example generation method proposed in this application uses salient regions in the test samples to control the generation process.

[0070] In one possible implementation, such as Figure 7 As shown, this application provides a method for preserving important features in test samples.

[0071] Step 310: Obtain the category mapping activation map (CAM) corresponding to the test sample, and determine the salient regions in the test sample based on the pixel values ​​of the category mapping activation map;

[0072] Among them, CAM (Class Activation Mapping) is also known as a class heatmap or saliency map. For example... Figure 8As shown, the left side is the test sample, and the right side is the test sample + heatmap constructed using CAM technology, i.e., the category activation map. The size of the category activation map is the same as that of the test sample. The pixel value represents the degree of influence of the corresponding area of ​​the test sample on the predicted output. The larger the pixel value, the greater the influence and the more it contributes to the subsequent classification decision.

[0073] Step 330: Adversarial guidance is provided for the generation process of unrestricted adversarial examples based on salient regions.

[0074] Specifically, feature visualization technology is used to obtain the class mapping activation map (CAM) of the test samples. The larger the pixel value in the CAM, the greater its contribution to the final classification decision. Based on the pixel value of the CAM, adversarial guidance is used for the salient regions that need to be retained. That is, to ensure that the salient regions are retained as much as possible, while avoiding the introduction of unnecessary regions due to the use of large strides.

[0075] In another possible implementation, such as Figure 9 As shown, this application provides another method for preserving important features in test samples.

[0076] Step 410: Through semantic segmentation, the denoised image at the current moment is segmented into a main mask region and a background mask region.

[0077] The background mask region is considered to be the mask region outside the main mask region in the denoised image.

[0078] Step 430: Based on the noisy image of the test sample at the current moment, determine the corresponding region of the subject mask in the noisy image at the current moment.

[0079] Step 450: In the denoised image at the current moment, replace the main mask region with the corresponding region determined in the denoised image at the current moment.

[0080] In other words, the main mask region is the salient region in the test sample, while the background mask region is the region outside the salient region. During the forward noise addition process on the test sample, for the location of the salient region, the image information in the test sample can be directly selected without any noise addition. This ensures that the salient region in the final predicted image is exactly the same as the test sample, thus preserving the salient region in the test sample. For the background mask region, a backward process is used to generate it, ensuring that the noise intensity in both the main and background mask regions meets the requirements of the backward process. Finally, the main and background mask regions are added together, and through iteration, the final predicted image is obtained. This not only ensures that the final predicted image is consistent with the test sample in the main body but also produces diverse results in the background, demonstrating the diversity of adversarial examples.

[0081] Specifically, the key features in the test samples are retained through the following calculation formula:

[0082]

[0083]

[0084]

[0085] Here, 1mask represents the main mask area, and 0mask represents the background mask area.

[0086] Through the above process, the diffusion model's powerful denoising capabilities are utilized to remove disturbances that do not conform to the true distribution, resulting in high-quality generated images where objects conform to the true distribution. Furthermore, by combining warm-start and low-frequency guidance techniques, the diffusion model can generate samples that are similar to the original image but also have a certain degree of sample diversity. At the same time, feature visualization is used to identify important features in the original image and retain them in the generated adversarial examples, effectively solving the problems of low-quality and ambiguous key semantics in the unrestricted adversarial example images generated in existing technologies.

[0087] Please see Figure 10 This application provides a method for testing the robustness of a model under unrestricted adversarial examples, which may include the following steps:

[0088] Step 510: Input the unrestricted adversarial sample into the attacked model for classification prediction to obtain the classification result of the unrestricted adversarial sample; the classification result is used to indicate the predicted category to which the unrestricted adversarial sample belongs.

[0089] Step 530: Calculate the classification accuracy of the attacked model based on the difference between the predicted category of the unrestricted adversarial sample and the true category indicated by the label carried by the test sample.

[0090] Specifically, after obtaining unrestricted adversarial samples using the unrestricted adversarial sample generation method provided in this application, the attacked model is used to classify and predict them to obtain classification results. The attacked model can be determined based on the neural network model in the actual application scenario, and no special restrictions are imposed here. Based on the classification difference between the adversarial samples and the test samples under the same attacked model, the classification accuracy of the adversarial samples and the test samples in the attacked model is calculated.

[0091] With the cooperation of the above embodiments, the robustness of the attacked model can be evaluated. The better the robustness, the more it reflects the advantages of the adversarial examples generated by the unrestricted adversarial example generation method provided in this application, such as high image quality, clear key semantics, and conformity to the real distribution.

[0092] The following are embodiments of the apparatus described in this application, which can be used to execute the unrestricted adversarial sample generation method involved in this application. For details not disclosed in the apparatus embodiments of this application, please refer to the method embodiments of the unrestricted adversarial sample generation method involved in this application.

[0093] Please see Figure 11 This application provides an unrestricted adversarial sample generation device 800, including but not limited to: an image denoising module 810, a perturbation generation module 830, and a sample generation module 850.

[0094] The image denoising module 810 is used for a backward process based on a diffusion model to obtain the denoised image and the corresponding predicted image at the current time.

[0095] The perturbation generation module 830 is used to generate perturbations between the predicted image and its adversarial samples through an adversarial attack on the predicted image.

[0096] The sample generation module 850 is used to transfer the perturbation to the denoised image at the current time and denoise the transferred denoised image at the current time through the backward process of the diffusion model until unrestricted adversarial samples are generated.

[0097] It should be noted that the above embodiments of the unrestricted adversarial sample generation device are only illustrated by the division of the above functional modules when generating unrestricted adversarial samples. In actual applications, the above functions can be assigned to different functional modules as needed. That is, the internal structure of the unrestricted adversarial sample generation device will be divided into different functional modules to complete all or part of the functions described above.

[0098] Furthermore, the embodiments of the unrestricted adversarial sample generation device and the unrestricted adversarial sample generation device method provided in the above embodiments belong to the same concept, and the specific way in which each module performs its operation has been described in detail in the method embodiments, and will not be repeated here.

[0099] Figure 12 A schematic diagram of the structure of an electronic device according to an exemplary embodiment is shown.

[0100] It should be noted that this electronic device is merely an example adapted to this application and should not be construed as providing any limitation on the scope of use of this application. Furthermore, this electronic device should not be interpreted as requiring or depending on any specific feature. Figure 12 One or more components of the exemplary electronic device 2000 shown.

[0101] The hardware structure of electronic devices 2000 can vary significantly due to differences in configuration or performance, such as... Figure 12As shown, the electronic device 2000 includes: a power supply 210, an interface 230, at least one memory 250, and at least one central processing unit (CPU) 270.

[0102] Specifically, power supply 210 is used to provide operating voltage for various hardware devices on electronic device 2000.

[0103] Interface 230 includes at least one wired or wireless network interface 231 for interacting with external devices.

[0104] Of course, in other examples adapted in this application, interface 230 may further include at least one serial-to-parallel conversion interface 233, at least one input / output interface 235, and at least one USB interface 237, etc. Figure 12 As shown, this does not constitute a specific limitation.

[0105] The memory 250 serves as a carrier for resource storage and can be a read-only memory, random access memory, disk, or optical disk, etc. The resources stored on it include the operating system 251, application programs 253, and data 255, etc., and the storage method can be temporary storage or permanent storage.

[0106] The operating system 251 is used to manage and control the various hardware devices and application programs 253 on the electronic device 2000, so as to enable the central processing unit 270 to perform calculations and processing on the massive data 255 in the memory 250. It can be Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0107] Application 253 is a computer program that performs at least one specific task based on operating system 251, and may include at least one module ( Figure 12 (Not shown), each module may contain a computer program for the electronic device 2000. For example, the unrestricted adversarial example generation method apparatus can be considered as an application program 253 deployed on the electronic device 2000.

[0108] Data 255 can be photos, images, etc. stored on a disk, or unrestricted adversarial examples, etc., stored in memory 250.

[0109] The central processing unit 270 may include one or more processors and is configured to communicate with the memory 250 via at least one communication bus to read computer programs stored in the memory 250, thereby performing operations and processing on massive amounts of data 255 stored in the memory 250. For example, an unrestricted adversarial example generation method may be implemented by the central processing unit 270 reading a series of computer programs stored in the memory 250.

[0110] Furthermore, this application can also be implemented through hardware circuits or a combination of hardware circuits and software. Therefore, the implementation of this application is not limited to any specific hardware circuit, software, or combination thereof.

[0111] Please see Figure 13 This application provides an electronic device 4000, which may be a desktop computer, a laptop computer, a server, etc.

[0112] exist Figure 13 The electronic device 4000 includes at least one processor 4001, at least one communication bus 4002, and at least one memory 4003.

[0113] The processor 4001 and memory 4003 are connected, for example, via a communication bus 4002. Optionally, the electronic device 4000 may also include a transceiver 4004, which can be used for data interaction between the electronic device and other electronic devices, such as sending and / or receiving data. It should be noted that in practical applications, the transceiver 4004 is not limited to one, and the structure of the electronic device 4000 does not constitute a limitation on the embodiments of this application.

[0114] Processor 4001 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 4001 may also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0115] The communication bus 4002 may include a path for transmitting information between the aforementioned components. The communication bus 4002 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. The communication bus 4002 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 13The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0116] The memory 4003 may be ROM (Read Only Memory) or other types of static storage devices capable of storing static information and instructions, RAM (Random Access Memory) or other types of dynamic storage devices capable of storing information and instructions, or EEPROM (Electrically Erasable Programmable Read Only Memory), CD-ROM (Compact Disc Read Only Memory) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto.

[0117] The memory 4003 stores a computer program, and the processor 4001 reads the computer program stored in the memory 4003 through the communication bus 4002.

[0118] When the computer program is executed by the processor 4001, it implements the unrestricted adversarial sample generation method in the above embodiments.

[0119] Furthermore, this application provides a storage medium storing a computer program, which, when executed by a processor, implements the unrestricted adversarial sample generation method described in the above embodiments.

[0120] This application provides a computer program product comprising a computer program stored in a storage medium. A processor of a computer device reads the computer program from the storage medium and executes the computer program, causing the computer device to perform the unrestricted adversarial example generation method described in the above embodiments.

[0121] Compared with related technologies, the unrestricted adversarial example generation method based on the diffusion model provided in this application utilizes the powerful denoising capability of the diffusion model to remove perturbations that do not conform to the true distribution, resulting in higher image quality of the generated unrestricted adversarial examples and objects in the images that are more consistent with the true distribution. By combining warm start and low-frequency guidance techniques, the diffusion model can generate samples that are similar to the original image but also have a certain degree of sample diversity. Controlling the generation process ensures that the image semantics are similar to the original image, so that the generated unrestricted adversarial examples maintain consistency in semantic distribution. Feature visualization is used to determine important features in the original image and retain them in the generated adversarial examples, reducing the impact of perturbations on the human eye's region of interest (i.e., salient region), effectively solving the problems of low image quality and ambiguous key semantics in the unrestricted adversarial examples generated in the prior art.

[0122] It should be understood that although the steps in the flowcharts of the accompanying figures are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the accompanying figures may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0123] The above description is only a partial embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for generating unrestricted adversarial examples, characterized in that, The method includes: Based on the backward process of the diffusion model, the denoised image and the corresponding predicted image at the current time are obtained; The predicted image is input into the attacked model for classification prediction. In the first stage, a perturbation is generated using the real classifier in the attacked model. The first stage means that the predicted category of the predicted image predicted by the real classifier is consistent with the real category. Based on the difference between the adversarial sample and the predicted image, a perturbation between the predicted image and the adversarial sample is generated; In the second stage, a perturbation is generated using a natural classifier trained with added noise; the second stage refers to the situation where the predicted category of the predicted image is inconsistent with the true category; The perturbation is transferred to the denoised image at the current time, and the transferred denoised image at the current time is denoised through the backward process of the diffusion model until an unrestricted adversarial sample is generated.

2. The method as described in claim 1, characterized in that, The backward process based on the diffusion model, which yields the denoised image and the corresponding predicted image at the current time, includes: Obtain test samples from the test dataset; The test sample is denoised by the forward process of the diffusion model to obtain a denoised image at the target time. The denoised image at the target time is denoised through the backward process of the diffusion model to obtain the denoised image at the current time and the corresponding predicted image.

3. The method as described in claim 1, characterized in that, After obtaining the denoised image and the corresponding predicted image at the current time through the backward process based on the diffusion model, the method further includes: Based on the forward process of the diffusion model, the noisy image of the test sample at the current moment is determined; The low-frequency information in the denoised image and the denoised image at the current time are compared to obtain the corresponding error. Based on the distribution area of ​​the error on the test sample, the low-frequency information in the denoised image at the current moment is supplemented, so as to transfer the disturbance based on the supplemented denoised image.

4. The method as described in claim 1, characterized in that, The method further includes: Obtain the category activation map (CAM) corresponding to the test sample, and determine the salient regions in the test sample based on the pixel values ​​of the category activation map; Based on the salient region, the generation process of the unrestricted adversarial sample is adversarially guided.

5. The method as described in claim 1, characterized in that, After obtaining the denoised image and the corresponding predicted image at the current time through the backward process based on the diffusion model, the method further includes: Semantic segmentation is used to divide the denoised image at the current moment into a subject mask region and a background mask region; Based on the noisy image of the test sample at the current moment, determine the corresponding region of the subject mask in the noisy image at the current moment; In the denoised image at the current moment, the main mask region is replaced with the corresponding region determined in the denoised image at the current moment.

6. The method according to any one of claims 1 to 5, characterized in that, After generating the unrestricted adversarial examples, the method further includes: The unrestricted adversarial sample is input into the attacked model for classification and prediction to obtain the classification result of the unrestricted adversarial sample; the classification result is used to indicate the predicted category to which the unrestricted adversarial sample belongs; The classification accuracy of the attacked model is calculated based on the difference between the predicted category of the unrestricted adversarial sample and the true category indicated by the label carried by the test sample.

7. An unrestricted adversarial sample generation apparatus, using the method as described in any one of claims 1 to 6, characterized in that, The device includes: The image denoising module is used for the backward process based on the diffusion model to obtain the denoised image and the corresponding predicted image at the current time. A perturbation generation module is used to input the predicted image into the attacked model for classification prediction. In the first stage, perturbations are generated using the real classifier in the attacked model; the first stage means that the predicted category of the predicted image predicted by the real classifier is consistent with the real category; based on the difference between the adversarial sample and the predicted image, perturbations between the predicted image and the adversarial sample are generated; in the second stage, perturbations are generated using a natural classifier trained with added noise; the second stage means that the predicted category of the predicted image predicted by the real classifier is inconsistent with the real category. The sample generation module is used to transfer the perturbation to the denoised image at the current time step, and to denoise the transferred denoised image at the current time step through the backward process of the diffusion model until unrestricted adversarial samples are generated.

8. An electronic device, characterized in that, include: The system includes at least one processor, at least one memory, and at least one communication bus, wherein the memory stores a computer program, and the processor reads the computer program from the memory via the communication bus. When the computer program is executed by the processor, it implements the unrestricted adversarial sample generation method according to any one of claims 1 to 6.

Images