A migration adversarial sample generation method and device for target attacks

Abstract

The application discloses a kind of migration adversarial sample generation methods and devices for target attack, the present application generates adversarial sample by original class image on white box model, extracts the feature map of original class image and target class image in intermediate layer of white box model, sorts all feature maps by the gradient of model back propagation, obtains the important feature of original class image and target class image, the screened feature map of both is driven by Euclidean distance, so that the feature extracted by adversarial sample is far away from original class image feature as far as possible, and simultaneously as far as possible close to target class image feature.The present application generates target attack adversarial sample by important feature of intermediate layer, avoids that the extracted feature excessively fits white box model, and the obtained adversarial sample has higher migration, can successfully let multiple black box models be misidentified as target class.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of artificial intelligence security, and particularly relates to a migration adversarial sample generation method and device for target attack. BACKGROUND

[0002] Research shows that a deep learning model can be successfully misled by adding imperceptible perturbations to an image, and an adversarial sample is an image after adding perturbations, and the migration of the adversarial sample is the ability of the adversarial sample to successfully attack multiple models at the same time, and the target attack refers to letting the deep learning model recognize the adversarial sample as a category specified by the attacker. The existing target attack method is mainly based on white box and black box. For white box attack, the attacker can access all information of the attacked model, including model architecture and parameters, so the update direction of the adversarial sample is accurate, and the white box model has very good attack effect. However, in most cases, the attacked model is opaque, and the attacker only knows the input and output of the attacked model. Although there has been great progress in non-target attack against black box at the present stage, there are few related works on black box target attack, and how to improve the success rate of black box target attack and the migration of adversarial samples still has challenges.

[0003] Deep learning models of different architectures have similar decision boundaries, and all deep learning models need to extract features from input data before making decisions, and then assign attention to all features to fit the specific task of the model. Specifically, for deep learning models of classification tasks, the front layers are mainly responsible for constructing a specific feature set of input data. If the feature construction is complete, the back layers will perform additional processing to fit the classification function of the model. This additional processing will cause the features of the back layers to overfit the classification model, with lower transferability. The first use of the intermediate layer feature space for target attack is Inkawhich et al. [Inkawhich, Nathan, et al. "Feature space perturbations yield more transferable adversarial examples." Proceedings of the IEEE / CVF Conference on Computer Vision and Pattern Recognition. 2019], who used the Euclidean distance between the intermediate layer feature representations of the original class image and the target class image to drive the target attack adversarial samples, and achieved a significant increase in the success rate of target attack. Later, they proposed a new improvement work [Inkawhich, Nathan, et al. "Transferable perturbations of deep feature distributions." arXiv preprint arXiv:2004.12519 (2020)] for this method, that is, adding a classifier to the intermediate layer, which is mainly responsible for distinguishing which class the intermediate layer feature space belongs to. When performing target attack, only the probability of the intermediate layer feature space of the adversarial sample being identified as the target class by the classifier needs to be improved. The first use of feature importance ranking for adversarial sample generation is in the non-target attack work of Wu et al. [Wu, Weibin, et al. "Boosting the transferability of adversarial samples via attention." Proceedings of the IEEE / CVF Conference on Computer Vision and Pattern Recognition. 2020], who ranked all feature maps in the feature space of the original image, added noise to the feature maps with higher importance, and the higher the importance, the more obvious the noise. This makes it difficult for the black box model to identify the features, and thus makes an incorrect judgment, with good transferability.

[0004] Firstly, the first work of Inkawhich et al. uses the entire feature space including important features and non-important features, which may cause redundancy and reduce the success rate, although it is driven by the intermediate layer feature space like the present application. Secondly, their improved work needs to train a classifier on each layer, which requires a large amount of computing power and is too low in efficiency. The work of Wu et al. sorts the importance of features, but it is not targeted, which cannot meet the needs of the actual environment. SUMMARY

[0005] The present application aims to provide a migration adversarial sample generation method and device for target attacks to overcome the shortcomings in the prior art.

[0006] To achieve the above-mentioned purpose, the present application provides the following technical scheme:

[0007] The present application discloses a migration adversarial sample generation method for target attacks, which specifically comprises the following steps:

[0008] S1, obtaining the feature map and gradient of the original category image and the target category image in the intermediate layer of the deep learning model, and sorting the importance of the feature map;

[0009] S2, calculating the Euclidean distance between the feature map of the original category image and the feature map of the target category image based on the importance sorted feature map in step S1;

[0010] S3, updating the gradient direction using the momentum method based on the Euclidean distance obtained in step S3, generating adversarial noise, and obtaining an iterative adversarial sample;

[0011] S4, taking the iterative adversarial sample as an input image, obtaining its feature map and gradient in the intermediate layer of the deep learning model, and sorting the importance of the feature map of the iterative adversarial sample;

[0012] S5, calculating the Euclidean distance between the feature map of the iterative adversarial sample and the feature map of the target category image based on the importance sorted feature map in step S4;

[0013] S6, updating the gradient direction using the momentum method based on the Euclidean distance obtained in S7, generating adversarial noise, and obtaining a new iterative adversarial sample;

[0014] S7, determining whether the preset number of iterations is reached; if not, taking the new iterative adversarial sample obtained in S6 as an input image and returning to step S4; if the preset number of iterations is reached, obtaining the final black box target attack adversarial sample.

[0015] As a preferred, step S1 specifically comprises the following sub-steps:

[0016] S11, input the original category image and the target category image into the deep learning model respectively to obtain feature maps of the original category image and the target category image in an intermediate layer of the deep learning model respectively;

[0017] S12, based on the final decision of the deep learning model, gradients of the original category image and the target category image in the intermediate layer of the deep learning model are obtained respectively;

[0018] S13, based on the feature maps in S11 and the gradients in S12, the feature maps of the original category image and the target category image are sorted in importance.

[0019] As a preferred, the sorting in importance is specifically operated as follows: the feature maps are sorted in descending order according to the weights of the feature maps.

[0020] As a preferred, the step S2 specifically includes the following sub-operation: based on the feature maps sorted in importance in the step S1, the feature maps of the original category image and the target category image with the same proportion from high to low in importance are selected, and the Euclidean distance is calculated.

[0021] As a preferred, the step S5 specifically includes the following sub-operation: based on the feature maps sorted in importance in the step S4, the feature maps of the original category image and the target category image with the same proportion from high to low in importance are selected in the iterative adversarial sample and the feature maps of the target category image, and the Euclidean distance is calculated.

[0022] The application further discloses a device for generating a transfer adversarial sample against a target attack, comprising a memory and one or more processors, the memory stores executable code, and the one or more processors execute the executable code to implement the method for generating a transfer adversarial sample against a target attack.

[0023] The application further discloses a computer readable storage medium having a program stored thereon, and the program is executed by a processor to implement the method for generating a transfer adversarial sample against a target attack.

[0024] The application has the following beneficial effects:

[0025] 1. The application generates an adversarial sample through an original category image on a white box model, extracts feature maps of the original category image and a target category image in an intermediate layer of the white box model, sorts all the feature maps through gradients of model back propagation, obtains important features of the original category image and the target category image, and drives the screened feature maps of the original category image and the target category image through Euclidean distance, so that the features of the adversarial sample are as far as possible from the features of the original category image and as close as possible to the features of the target category image.

[0026] 2. This invention generates adversarial examples of target attacks through important features of the intermediate layer, avoiding overfitting of the extracted features to the white-box model. The resulting adversarial examples have high transferability and can successfully cause multiple black-box models to misidentify them as the target category.

[0027] The features and advantages of the present invention will be described in detail through embodiments and in conjunction with the accompanying drawings. Attached Figure Description

[0028] Figure 1 This is a flowchart illustrating a method for generating adversarial samples for targeted attacks according to the present invention.

[0029] Figure 2 This is a schematic diagram of the structure of a migration adversarial sample generation device for target attacks according to the present invention. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. However, it should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of the invention. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concept of the invention.

[0031] This invention provides a method for generating adversarial samples for targeted attacks, comprising the following steps:

[0032] Step 1: Obtain the intermediate layer feature values ​​and gradients of the original category image and the target category image, and sort all feature maps;

[0033] Step 2: Obtain the Euclidean distance (Loss) between the selected feature maps of the original category image and the target category image;

[0034] Step 3: Iteratively generate black-box target attack adversarial samples using the momentum method.

[0035] like Figure 1 As shown, the specific implementation of the present invention can be divided into the following steps S1-S9:

[0036] S1. Input the original category image and the target category image, and obtain the feature map of the intermediate layer;

[0037] S2. Based on the model's final decision, obtain the intermediate layer gradients of the original category image and the target category image;

[0038] S3. Based on the feature values ​​and gradients of the intermediate layers of S1 and S2, the feature maps of the original category image and the target category image are ranked in terms of importance.

[0039] The importance ranking formula is:

[0040]

[0041]

[0042] wherein, is the weight of the feature map c extracted for the input x of the class t at the kth layer, Z is a constant that makes , is the score of the input x of the class t by the white-box deep learning model, is the gradient of each point on the kth layer feature map c, is the gradient of each point on the feature map c according to the score of the class t. is the selected feature map, is sorted in descending order;

[0043] S4, based on the sorted feature map in S3, the original class image and the target class image, the feature map with the same proportion from high to low importance is selected to calculate the Euclidean distance, and the result is taken as the Loss;

[0044] The Euclidean distance formula is:

[0045]

[0046] wherein, is the Euclidean distance Loss value, is the target class input picture, is the original class input picture, is the selected feature map for the target class picture at the kth layer, is the selected feature map for the original class picture at the kth layer, is the two-norm operation;

[0047] S5, based on the Loss obtained in S4, the gradient direction is updated by using the momentum method to generate the adversarial noise, and the first iteration of the adversarial sample is obtained; the momentum method formula is:

[0048]

[0049]

[0050] wherein, m is the weighted accumulation of the gradient, is the weighted accumulation of the gradient of the kth iteration, is the weighted accumulation of the gradient of the kth+1 iteration, is the perturbed image generated by the kth iteration, is the perturbed image generated by the kth+1 iteration, when k=0, , , that is is the original class input image, is a norm operation, is to crop the perturbation image to , is the iteration step, The expression of is: , wherein is ;

[0051] S6, the obtained adversarial sample is taken as an input image to obtain the feature value and gradient of the intermediate layer, and the adversarial sample feature map is sorted according to importance;

[0052] S7, the adversarial sample feature map with the same proportion of importance from high to low as S4 is selected, the Euclidean distance between the adversarial sample feature map and the S4 target class image feature map is calculated, and the obtained result is taken as Loss;

[0053] S8, the gradient direction is updated by using a momentum method based on the Loss obtained in S7, an adversarial noise is generated, and a new iteration of the adversarial sample is obtained;

[0054] S9, S5-S8 are continuously cycled until a specified iteration number is reached, and a final black box target attack adversarial sample is obtained; the constraint of the target attack is:

[0055]

[0056] wherein, is an adversarial sample generated by an original class image, is the class of a target image, that is, the classification result of the model on the adversarial sample, is a loss function, is an infinite norm.

[0057] An embodiment of the application can be applied to any device with data processing capability, which can be a device or apparatus such as a computer. The device embodiment can be realized by software, or by hardware or a combination of software and hardware. Taking software realization as an example, as a logical device, it is formed by reading the corresponding computer program instructions in the non-volatile memory into the memory and running by the processor of the device with data processing capability. From the hardware level, as shown in Figure 2 , it is a hardware structure diagram of the device with data processing capability of the application, in addition to Figure 2In addition to the processor, the memory, the network interface, and the nonvolatile memory, any data processing capable device in which the apparatus in the embodiments is located can also include other hardware according to the actual functions of the data processing capable device, and details are not described herein.

[0058] For the apparatus embodiments, since they basically correspond to the method embodiments, the relevant parts are described in the part of the method embodiments. The apparatus embodiments described above are merely illustrative, and the units described as separate components can or can not be physically separated, and the components displayed as units can or can not be physical units, that is, they can be located in one place or distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the present application. Those skilled in the art can understand and implement without creative labor.

[0059] The embodiments of the present application also provide a computer readable storage medium, which stores a program, and the program is executed by a processor to realize the apparatus for generating a migration adversarial sample against a target attack in the above embodiments.

[0060] The computer readable storage medium can be an internal storage unit of any data processing capable device, such as a hard disk or a memory. The computer readable storage medium can also be an external storage device of any data processing capable device, such as a plug-in hard disk, a smart media card (SMC), an SD card, a flash card, etc. Further, the computer readable storage medium can include both an internal storage unit and an external storage device of any data processing capable device. The computer readable storage medium is used to store the computer program and other programs and data required by the data processing capable device, and can also be used to temporarily store data that has been output or will be output.

[0061] The above description is merely the preferred embodiments of the present application, and is not intended to limit the present application. Any modification, equivalent replacement, or improvement made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for generating a migration adversarial sample against a target attack, characterized in that, Specifically comprising the following steps: S1, obtaining the feature maps and gradients of the original category image and the target category image in the intermediate layer of the deep learning model, and performing importance sorting on the feature maps; S2, based on the importance sorted feature maps in step S1, calculating the Euclidean distance between the feature maps of the original category image and the target category image; the Euclidean distance formula is: wherein, is the Euclidean distance Loss value, is the target class input picture, is the original class input picture, is the selected feature map for the target class picture at the kth layer, is the selected feature map for the original class picture at the kth layer, is the two-norm operation; S3, based on the Euclidean distance obtained in step S2, updating the gradient direction using the momentum method to generate adversarial noise and obtain an iterative adversarial sample; the momentum method iteration formula is: where m is the weighted accumulation of gradients, is the weighted accumulation of gradients at the kth iteration, is the weighted accumulation of gradients at the k+1th iteration, denotes the perturbed image generated at the kth iteration, denotes the perturbed image generated at the k+1th iteration, when k = 0, , i.e. is the original class input image, is a norm operation, is the cropped perturbed image to , is the iteration step size, The expression of is: , where is ; S4, taking the iterative adversarial sample as an input image, obtaining its feature maps and gradients in the intermediate layer of the deep learning model, and performing importance sorting on the feature maps of the iterative adversarial sample; S5, based on the importance sorted feature maps in step S4, calculating the Euclidean distance between the feature maps of the iterative adversarial sample and the target category image; S6, based on the Euclidean distance obtained in S2, updating the gradient direction using the momentum method to generate adversarial noise and obtain a new iterative adversarial sample; S7, determining whether the preset iteration number is reached; if not, taking the new iterative adversarial sample obtained in S6 as an input image and returning to step S4; if the preset iteration number is reached, obtaining the final black box target attack adversarial sample.

2. The method of claim 1, wherein the method is characterized by: Step S1 specifically comprises the following sub-steps: S11, inputting the original category image and the target category image into the deep learning model respectively to obtain the feature maps of the original category image and the target category image in the intermediate layer of the deep learning model; S12, based on the final decision of the deep learning model, obtaining the gradients of the original category image and the target category image in the intermediate layer of the deep learning model; S13, based on the feature maps in S11 and the gradients in S12, performing importance sorting on the feature maps of the original category image and the target category image.

3. The method of claim 2, wherein the method further comprises: The importance sorting specifically operates as follows: descending order sorting according to the weights of the feature maps.

4. The method of claim 1, wherein the method is characterized by: Step S2 specifically comprises the following sub-operations: based on the importance sorted feature maps in step S1, selecting the same proportion of feature maps from high to low importance in the feature maps of the original category image and the target category image, and calculating the Euclidean distance.

5. The method of claim 1, wherein the method is characterized by: Step S5 specifically comprises the following sub-operations: based on the importance sorted feature maps in step S4, selecting the same proportion of feature maps from high to low importance in the feature maps of the iterative adversarial sample and the target category image, and calculating the Euclidean distance.

6. A device for generating a migration adversarial sample against a target attack, characterized in that: The memory and one or more processors, the memory has stored executable code, the one or more processors execute the executable code, and the executable code is used to implement the migration adversarial sample generation method for target attack in any one of claims 1-4.

7. A computer-readable storage medium, characterized in that: A program is stored thereon, which is executed by a processor to implement the migration adversarial sample generation method for target attack in any one of claims 1-4.

Images