An image sparse adversarial sample generation method based on meta learning

Abstract

The application provides a kind of image sparse adversarial sample generation method based on meta learning, comprising the following steps: step 1, randomly sampling n models in the white box model set composed of image classification model;Step 2, meta training stage;Step 3, meta test stage;Step 4, for the current adversarial sample, sample projection strategy will global disturbance be sparse, obtain the adversarial sample with sparsity;Step 5, repeat step 1-4 T times, until the number of updates of adversarial sample reaches the predetermined iteration number, the obtained adversarial sample is used to attack the target black box model.The application can combine meta learning with gradient-based sparse attack method, fuse the gradient information of multiple models, and constrain the update direction of gradient in the simulation black box attack stage similar to white box attack, so that the updated adversarial sample will not overfit to a single model, effectively improving the success rate of adversarial sample attack on black box model.

Description

Technical Field

[0001] This invention relates to a method for generating sparse adversarial examples of images based on meta-learning. Background Technology

[0002] With the development of deep neural network (DNN) technology, DNNs have been widely used in image classification and have achieved significant breakthroughs. However, since Szegedy et al. first successfully constructed adversarial examples in image classification tasks in 2014, the vulnerability and security issues of deep neural networks have received widespread attention, and research on adversarial example generation methods has always been a hot topic in the field of deep neural network security. Image adversarial examples are adversarial samples generated by deliberately adding subtle perturbations to original image samples. These samples can cause image classification models to output incorrect labels, but the human eye cannot perceive the difference between them and the original samples.

[0003] Because the working principle of neural networks lacks interpretability, the study of adversarial examples is of great significance. On the one hand, the existence of adversarial examples reveals the weaknesses of deep neural networks, providing direction for exploring interpretable research on deep neural networks; on the other hand, the existence of adversarial examples provides a theoretical basis for further research on improving the robustness of deep neural networks, promoting the development of deep neural network security attack and defense technologies. Therefore, based on the above reasons, the field of adversarial attacks has developed rapidly, and numerous adversarial attack methods have been proposed.

[0004] Based on the size of the adversarial perturbation, adversarial attacks can be categorized into sparse attacks and global attacks. Sparse attacks involve attackers constructing adversarial examples that can only add perturbations to a subset of pixels; the location of the perturbations is constrained. To achieve good sparsity, sparse attacks typically require a trade-off in the perturbation priority of each pixel, making them more difficult than global attacks. However, the generated adversarial examples have a higher similarity to the original image samples, thus possessing greater research value. Furthermore, based on the amount of model information obtained, attacks can be divided into white-box attacks and black-box attacks. Black-box attacks involve attackers obtaining no information about the target model, only the model's output labels for the input samples. Compared to white-box attacks, black-box attacks, due to the limited available information, are closer to real-world scenarios and have become a research hotspot.

[0005] Black-box attacks are mainly divided into transfer-based black-box attacks and query-based black-box attacks. Transfer-based black-box attacks leverage the transferability of image adversarial examples; that is, image adversarial examples generated on the source model can attack not only their own model but also other models. Research has found a trade-off between the aggressiveness of adversarial attacks on the source model and their aggressiveness on the target model, especially for sparse attacks. This is because sparse adversarial perturbations generally overfit the source model severely, resulting in poor transferability. Therefore, improving the transferability of image adversarial examples has become a research focus. The MI-FGSM method proposes using a momentum term to accumulate the gradients obtained from iterative calculations, thereby stabilizing the update direction, alleviating overfitting, and enhancing transferability. Intermediate layer attack methods propose calculating the loss on the feature maps of intermediate layers of the source model and using the corresponding gradient information to generate adversarial examples. The DIM method combines data augmentation operations with MI-FGSM, aiming to obtain more diverse gradient information by increasing the complexity of the input. The methods mentioned above improve transferability to some extent, but cannot achieve sparsity. Therefore, a new method is needed to improve both the sparsity and transferability of adversarial examples in images, so as to achieve a high success rate in attacking black-box models in image classification and good quality adversarial example images.

[0006] Meta-learning, also known as "learning to learn," refers to using past knowledge and experience to guide the learning of new tasks, enabling the network to learn by doing. It is a common solution to the few-shot learning problem. In machine learning, obtaining a stable model with strong generalization performance generally requires a large amount of training data. However, few-shot learning is challenging due to the limited amount of training data. Therefore, the key is to leverage the learning processes of other similar tasks and increase the learner's generalization ability across multiple tasks through knowledge transfer. Meta-learning provides a new learning model that automatically learns knowledge from other tasks, allowing for rapid learning of new task knowledge using only a small amount of training data. Furthermore, the knowledge transfer capability of meta-learning can be used to improve the transferability of adversarial examples. Summary of the Invention

[0007] Purpose of the invention: The technical problem to be solved by the present invention is to provide a method for generating sparse adversarial examples of images based on meta-learning, which addresses the shortcomings of the existing technology. This method can achieve the effects of high success rate in attacking black-box models, good sparsity of adversarial examples, and high image quality.

[0008] Invention Steps: The main steps of this invention are divided into four parts: (1) Model sampling. (2) Meta-training stage: For a given image, a white-box model is used for attack. (3) Meta-testing stage: A black-box attack is simulated. (4) The global adversarial perturbation of the current adversarial sample is projected to obtain a sparsed adversarial sample. Specifically, the following steps are included:

[0009] Step 1: Randomly sample n models from the white-box model set composed of image classification models, where the first n-1 models are used for the meta-training stage and the nth model is used for the meta-testing stage;

[0010] Step 2, Meta-training Phase: White-box attacks are performed on the first n-1 models obtained from sampling to generate adversarial examples with transferability. The original image sample x, which is to be input into the classification model to obtain the classification label, is input into the first n-1 white-box classification models to obtain the model output logits value, and then weighted and fused. The cross-entropy loss function value of the current image is calculated based on the weighted and fused logits value, and a gradient-based attack method is adopted to update the adversarial attack sample using the gradient value of the cross-entropy loss function; the logits value represents the output class probability value.

[0011] Step 3, Meta-testing phase: Perform a simulated black-box attack using the nth model and update the adversarial samples; calculate the cross-entropy loss function value of the model with respect to the current adversarial samples, and update the adversarial samples according to the gradient;

[0012] Step 4: For the current adversarial example, the sampling projection strategy will sparsify the global perturbation to obtain an adversarial example with sparsity.

[0013] Step 5: Repeat steps 1 to 4T times until the number of times the adversarial sample is updated reaches the predetermined number of iterations, and then use the obtained adversarial sample to attack the target black-box model.

[0014] Step 1 includes: in a white-box model set M1, M2, ..., M with N models... N In the process, n models are obtained through random sampling. The first n-1 models are used as white-box models for white-box attacks in step 2, and the nth model is used as a black-box model for simulating black-box attacks in step 3. M N This represents the Nth model. This represents the nth model.

[0015] Step 2 includes:

[0016] Step 2-1: For the original image sample x that needs to be input into the classification model to obtain the classification label, set the starting point of the adversarial example update iteration process as x. i,jWhere the subscript i represents the number of times step 2 is executed in the outer loop, and the subscript j represents the number of times step 2 is executed in the inner loop; for n-1 randomly sampled models Calculate the logits output value obtained from the model output of the current adversarial example, and then perform weighted fusion:

[0017]

[0018] in Represents the s-th model For the current adversarial sample x i,j The output value of logits, l(x) i,j ) represents the output logits value after weighted fusion of n-1 models, w s This represents the weighting coefficients for each model, and w s ≥0,

[0019] Step 2-2: Based on the fused logits output value obtained in Step 2-1, calculate the loss function value of the current adversarial example using the cross-entropy loss function:

[0020]

[0021] Where y is the true label of the original sample. This represents the one-hot encoding of the real label, where softmax is the normalization function. This represents the cross-entropy loss function value of the current adversarial example on the first n-1 models;

[0022] Steps 2-3: Calculate the gradient with respect to the current adversarial example based on the loss function value, and update the current adversarial example using the fast gradient sign method:

[0023]

[0024] Where sign is the sign function, α is the step size for updating the adversarial sample each time, and x i,j+1 This represents the adversarial example after one iteration update;

[0025] Step 2-4: Repeat steps 2-1 to 2-3 K times, where K is a hyperparameter. In experiments, the value of K is generally 10, to obtain the final adversarial example x from step 2. i,K .

[0026] Step 3 includes:

[0027] Step 3-1: Meta-testing phase, using the last model obtained from sampling. Perform a simulated black-box attack based on the alignment; using the adversarial sample x obtained in step 2. i,KInput model Obtain the output logit value and calculate the cross-entropy loss function value.

[0028]

[0029] Step 3-2: Based on the loss function value Calculate the gradient with respect to the current adversarial example, and apply it to the initial adversarial example x using the fast gradient sign method. i Update:

[0030]

[0031] Where β is the step size for updating adversarial examples during the meta-testing phase, and x i+1 This is the final adversarial sample in the meta-testing phase.

[0032] Step 4 includes:

[0033] Step 4-1: For the current adversarial sample x adv =x i+1 Projecting it onto the L-0 norm space, we obtain the following minimization problem:

[0034]

[0035] Make -∈≤z mn -x mn ≤∈,m=1,…,d,n=1,…,3

[0036]

[0037] in This indicates that the difference between the image before and after projection is minimal; Let z represent a real space of dimension d×3, i.e., the size dimension of the image; z represents the final sparsed adversarial example; z mn The pixel value at coordinates (m,n) represents the sparsed adversarial sample. The value represents the pixel value at coordinates (m,n) of the current adversarial sample; k represents the sparsity, i.e., the number of pixels that can be added with adversarial perturbations; ∈ represents the maximum perturbation magnitude that can be added to a single pixel; i and j represent the x and y coordinates of the image sample pixel, respectively; max is the function for finding the maximum value.

[0038] Step 4-2: For the minimization problem in Step 4-1, first ignore the sparsity constraint, and solve for the pixel value of each pixel after projection as follows:

[0039]

[0040] Make -∈≤zmn -x mn ≤∈,m=1,…,d,n=1,…,3

[0041] Since the magnitude of the perturbation added to each pixel is different, pixels with relatively larger perturbation magnitudes generally contribute more to the generation of adversarial examples, thus affecting the pixel value of each pixel after projection. The calculation formula is as follows:

[0042]

[0043] Step 4-3: Sort the pixels in descending order based on the projected pixel values.

[0044] In step 4-3, sort in descending order according to the following formula:

[0045]

[0046] Where φ m This represents the contribution of the m-th pixel in the adversarial example to the generation of the adversarial example.

[0047] For the sorted pixel values, the top k pixel values ​​are selected based on their contribution to the generated adversarial examples to form the final sparse adversarial examples, while the values ​​of the remaining pixels are the same as those of the original sample pixels.

[0048]

[0049] Step 5 includes:

[0050] The sparse adversarial examples obtained in step 4-3 are used as the input x for the next iteration. i+1 =z, and repeat steps 2 to 4T times to obtain the final sparse adversarial sample, and use the obtained sparse adversarial sample to attack the target black box model.

[0051] The present invention also provides a storage medium storing a computer program or instructions, which, when the computer program or instructions are run, implement the aforementioned method for generating sparse adversarial examples of images based on meta-learning.

[0052] This invention combines meta-learning with gradient-based sparse attack methods. Leveraging the knowledge transfer capabilities of the meta-learning framework, it fuses gradient information from multiple models. Furthermore, during the meta-testing phase, it simulates black-box attacks to constrain the gradient update direction, similar to white-box attacks. This prevents the updated adversarial examples from overfitting to a single model, resulting in excellent transferability and significantly improving the success rate of adversarial attacks on black-box models. In addition, during adversarial example generation, sampling from different model sets allows the adversarial examples to access different model structures, enabling them to attack unknown models as well. The perturbation sparsity process employs a projection strategy, ensuring transferability while maintaining sparsity in the adversarial examples, thus increasing their similarity to the original samples and making the perturbations less noticeable. In practical applications, since it achieves the attack objective without requiring model information or datasets, it has wide applicability and strong universality. Simultaneously, the sparsity perturbation provides a theoretical foundation for the study of deep neural network classification mechanisms, further promoting the development of neural network security attack and defense technologies.

[0053] Beneficial effects: Compared with the prior art, the significant advantages of this invention are: (1) High attack success rate. Through the knowledge transfer capability of the meta-learning stage, it can also achieve a good attack effect on black box models with unknown model structures, causing the model to output incorrect labels; (2) Good quality of adversarial sample images. Because only sparse adversarial perturbation is added through perturbation sparsification, the generated adversarial samples have high similarity to the original samples, and the adversarial perturbation is not easy to detect, with good concealment; (3) Strong universality of the method. Since this invention can attack unknown models, it has a wider range of application scenarios and stronger universality. Attached Figure Description

[0054] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments, and the advantages of the present invention in the above and other aspects will become clearer.

[0055] Figure 1 This is a flowchart illustrating the overall framework of the present invention.

[0056] Figure 2 This is a flowchart of the meta-learning MAML framework used in this invention. Detailed Implementation

[0057] like Figure 1 , Figure 2As shown, this invention primarily utilizes the knowledge transfer capability of meta-learning to improve the transferability of adversarial examples, thereby generating adversarial examples with high success rates in attacking black-box models and good image quality. The meta-learning MAML framework is combined with gradient-based attack methods, dividing the attack process into two stages: meta-training and meta-testing. White-box attacks and simulated black-box attacks are performed in these two stages respectively, thus improving the transferability of adversarial examples. Finally, a projection strategy is used to sparsify the global perturbation, making the adversarial examples also sparse, resulting in high-quality adversarial examples. The following steps will be explained in detail:

[0058] Step 1: Randomly sample n models from the white-box model set composed of image classification models, where the first n-1 models are used for the meta-training stage and the nth model is used for the meta-testing stage;

[0059] Step 2: Meta-training phase: White-box attacks are performed on the first n-1 models obtained from sampling to generate adversarial examples with transferability. The original image sample x with the classification label to be obtained is input into the first n-1 white-box classification models to obtain the model output logits value, and weighted fusion is performed. The cross-entropy loss function value of the current image is calculated based on the weighted fused logits value, and a gradient-based attack method is adopted to update the adversarial attack sample using the gradient value of the cross-entropy loss function; the logits value represents the output class probability value.

[0060] Step 3: In the meta-testing phase, a simulated black-box attack is performed using the last sampled model, and the adversarial examples are updated. The cross-entropy loss function value of the model with respect to the current adversarial examples is calculated, and the adversarial examples are updated according to the gradient;

[0061] Step 4: For the current adversarial example, since the perturbation is added globally, the sampling projection strategy will sparsify the global perturbation to obtain an adversarial example with sparsity.

[0062] Step 5: Repeat steps 1 to 4 until the number of times the adversarial sample is updated reaches the predetermined number of iterations T. Use the obtained adversarial sample to attack the target black-box model.

[0063] Step 1 is implemented as follows:

[0064] In a model set M1, M2, ..., M with N models N In the process, n models are obtained through random sampling. The first n-1 models are used as white-box models for white-box attacks in step 2, and the nth model is used as a black-box model for black-box attacks in step 3.

[0065] Step 2 includes the following steps:

[0066] Step 2-1: For the original image sample x that needs to be input into the classification model to obtain the classification label, set the starting point of the adversarial example update iteration process as x. i,j Here, the subscript i represents the number of times step 2 is executed in the outer loop, and the subscript j represents the number of times the inner loop of step 2 is executed. For n-1 randomly sampled models... Calculate the logits output value obtained from the model output of the current adversarial example, and then perform weighted fusion:

[0067]

[0068] in Representation Model For the current adversarial sample x i,j The output value of logits, w s This represents the weighting coefficients for each model, and w s ≥0,

[0069] Step 2-2: Based on the fused logits output value obtained in Step 2-1, calculate the loss function value of the current adversarial example using the cross-entropy loss function:

[0070]

[0071] Where y is the true label of the original sample. This represents the one-hot encoding of the actual label.

[0072] Steps 2-3: Calculate the gradient with respect to the current adversarial example based on the loss function value, and update the current adversarial example using the fast gradient sign method:

[0073]

[0074] Where sign is the sign function and α is the step size for updating the adversarial sample each time.

[0075] Step 2-4: Repeat steps 2-1 to 2-3 K times to obtain the final adversarial example x from step 2. i,K .

[0076] Step 3 includes the following steps:

[0077] Step 3-1: Meta-testing phase, using the last model obtained from sampling. Perform a simulated black-box attack based on the adversarial sample x obtained in step 2. i,K Input model Obtain the output logit value and calculate its cross-entropy loss function value:

[0078]

[0079] Where y is the true label of the original sample. This represents the one-hot encoding of the actual label.

[0080] Step 3-2: Calculate the gradient with respect to the current adversarial example based on its loss function value, and apply the fast gradient sign method to the initial adversarial example x. i Update:

[0081]

[0082] Where β is the step size for updating adversarial examples during the meta-testing phase, and x i+1 This is the final adversarial sample in the meta-testing phase.

[0083] Step 4 includes the following steps:

[0084] Step 4-1: For the adversarial samples with global perturbations obtained above, in order to obtain the final sparse adversarial samples, it is necessary to sparsify the global adversarial perturbations. For the current adversarial sample x... adv =x i+1 Projecting it onto the L-0 norm space, we obtain the following minimization problem:

[0085]

[0086] Make -∈≤z mn -x mn ≤∈,m=1,…,d,n=1,…,3

[0087]

[0088] in This indicates that the difference between the image before and after projection is minimal; Let z represent a real space of dimension d×3, i.e., the size dimension of the image; z represents the final sparsed adversarial example; z mn The pixel value at coordinates (m,n) represents the sparsed adversarial sample. The value represents the pixel value at coordinates (m,n) of the current adversarial sample; k represents the sparsity, i.e., the number of pixels that can be added with adversarial perturbations; ∈ represents the maximum perturbation magnitude that can be added to a single pixel; i and j represent the x and y coordinates of the image sample pixel, respectively; max is the function for finding the maximum value.

[0089] Step 4-2: For the minimization problem in Step 4-1, first ignore the sparsity constraint, and solve for the pixel value of each pixel after projection as follows:

[0090]

[0091] Make -∈≤z mn -x mn ≤∈,m=1,…,d,n=1,…,3

[0092] Since the magnitude of the perturbation added to each pixel is different, pixels with relatively larger perturbation magnitudes generally contribute more to the generation of adversarial examples, thus affecting the pixel value of each pixel after projection. The calculation formula is as follows:

[0093]

[0094] Step 4-3: Sort the pixels in descending order based on the projected pixel values.

[0095] In step 4-3, sort in descending order according to the following formula:

[0096]

[0097] Where φ m This represents the contribution of the m-th pixel in the adversarial example to the generation of the adversarial example.

[0098] For the sorted pixel values, the top k pixel values ​​are selected based on their contribution to the generated adversarial examples to form the final sparse adversarial examples, while the values ​​of the remaining pixels are the same as those of the original sample pixels.

[0099]

[0100] Step 5 includes:

[0101] The sparse adversarial examples obtained in step 4-3 are used as the input x for the next iteration. i+1 =z, and repeat steps 2 to 4T times to obtain the final sparse adversarial sample, and use the obtained sparse adversarial sample to attack the target black box model.

[0102] Example

[0103] The technical solution of the present invention will be further described below with reference to specific embodiments.

[0104] To verify the effectiveness of this invention, 1000 images from 1000 categories in the ImageNet2012 validation set and 5000 images in the CIFAR-10 test set were selected as the experimental dataset. This invention uses a model ensemble consisting of six white-box models, on which adversarial examples are generated. The six white-box models are VGG19, VGG16, ResNet101, ResNet152, DenseNet201, and DenseNet169. To evaluate the transferability of the models, i.e., the attack success rate on the black-box models, six black-box models were selected as target models for the ImageNet and CIFAR-10 datasets.

[0105] Since the pixel value of each pixel in the image is 0-255, this invention sets the maximum perturbation amplitude ∈ parameter to 16 for comparative experiments. This invention will be compared with the sparse attack methods SparseFool and GreedyFool, using the default parameter values ​​given in the original methods. The parameter settings of this invention are as follows: number of repetitions of steps 1-4 T = 40; number of iterations in the meta-training phase K = 10; number of randomly sampled models per round n = 5; model weighting coefficients are uniformly distributed, i.e., w s =0.2; the perturbation amplitudes in the meta-training and meta-testing phases are respectively And β = ∈, where ∈ is the maximum perturbation amplitude.

[0106] Attack success rate and average number of perturbation pixels (l0) are selected as evaluation metrics to assess the performance of the attack method. Attack success rate refers to the percentage of successful attacks out of all attacks. In a black-box model, the attack success rate also represents the transferability of the adversarial example; a higher success rate indicates better transferability. Average number of perturbation pixels (l0) refers to the number of pixels with added perturbation in the adversarial example, i.e., the sparsity of the adversarial example; a smaller l0 value indicates better sparsity.

[0107] This embodiment presents the experimental results of the present invention on the CIFAR-10 and ImageNet datasets, and compares the scores with some sparse attack methods. The results for the CIFAR-10 dataset are shown in Table 1, and the results for the ImageNet dataset are shown in Table 2.

[0108] Table 1

[0109]

[0110]

[0111] Table 2

[0112]

[0113] The experimental data in the table shows that the present invention performs better in terms of attack success rate. Specifically, on the CIFAR-10 dataset, as shown in Table 1, when the number of perturbation pixels is similar, the present invention has a significant improvement in attack success rate on black-box models compared to the comparison methods. For example, on the ResNet50 model, the attack success rates of SparseFool and GreedyFool are 22.5% and 7.62%, respectively, while the attack success rate of the present invention is 50.8%, representing improvements of 28.3% and 43.18%, respectively. This indicates that the adversarial examples generated by the present invention have better transferability. Furthermore, on the CIFAR-10 dataset, the attack success rate of the present invention is close to 50% on all six black-box models, while the attack success rate of GreedyFool on all six black-box models is only around 10%. This is because GreedyFool adopts a greedy search approach, making the current optimal solution based on the gradient information of the C&W loss function in each iteration. However, this optimal solution depends entirely on the information of the white-box model, causing the adversarial examples to overfit to the white-box model and thus have weak transferability. In contrast, this invention samples different model combinations from the model set during each round of meta-training to update the adversarial perturbation. This allows the generated adversarial examples to access models with various structures, thus exhibiting transferability even to black-box models with unknown structures. Furthermore, by comprehensively utilizing the gradient information of multiple models, the adversarial examples do not rely solely on a single model, thereby preventing overfitting.

[0114] Compared to the CIFAR-10 dataset, the ImageNet dataset is larger and has more categories, making it more difficult to attack. Nevertheless, compared to the SparseFool and GreedyFool methods, the method in this chapter still achieves a higher attack success rate on black-box models despite the increased attack difficulty. This demonstrates that the adversarial examples generated by this method can simultaneously achieve better sparsity and transferability.

[0115] In its specific implementation, this application provides a computer storage medium and a corresponding data processing unit. The computer storage medium is capable of storing a computer program, which, when executed by the data processing unit, can run the inventive content of the image sparse adversarial sample generation method based on meta-learning provided by this invention, as well as some or all of the steps in various embodiments. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0116] Those skilled in the art will clearly understand that the technical solutions in the embodiments of the present invention can be implemented using computer programs and their corresponding general-purpose hardware platforms. Based on this understanding, the technical solutions in the embodiments of the present invention, or the parts that contribute to the prior art, can be embodied in the form of computer programs, i.e., software products. These computer program software products can be stored in a storage medium and include several instructions to cause a device containing a data processing unit (which may be a personal computer, server, microcontroller, MUU, or network device, etc.) to execute the methods described in various embodiments or certain parts of the embodiments of the present invention.

[0117] This invention provides a method for generating sparse adversarial examples for images based on meta-learning. Many methods and approaches exist for implementing this technical solution; the above description is merely a preferred embodiment of the invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this invention, and these improvements and modifications should also be considered within the scope of protection of this invention. All components not explicitly stated in this embodiment can be implemented using existing technologies.

Claims

1. A method for generating image sparse adversarial samples based on meta-learning, characterized in that, The method comprises the following steps: Step 1, randomly sampling n models in a white-box model set composed of image classification models, wherein the first n-1 classification models are used in the meta-training stage, and the nth classification model is used in the meta-testing stage; Step 2, meta-training stage: generating an adversarial sample with migration by performing a white-box attack on the first n-1 models, inputting an original image sample x to be input into a classification model to obtain a classification label into the first n-1 white-box classification models to obtain logits values, and performing weighted fusion, calculating the cross-entropy loss function value of the current image according to the logit values after weighted fusion, and updating the adversarial attack sample by using the gradient value of the cross-entropy loss function based on the gradient-based attack method; the logits value represents the output class probability value; the gradient-based attack method is to update the current adversarial sample according to the fast gradient sign method; Step 3, meta-testing stage: performing a simulated black-box attack by using the nth model, and updating the adversarial sample; calculating the cross-entropy loss function value of the current adversarial sample, and updating the adversarial sample according to the gradient; Step 4, for the current adversarial sample, a projection strategy is used to sparsify the global perturbation to obtain an adversarial sample with sparsity; the projection strategy comprises: projecting the current adversarial sample into an L-0 norm space to obtain a minimization problem, solving the pixel value of each pixel point after projection, and arranging the pixel values after projection in descending order, and selecting the first k pixel values according to the contribution degree of the generated adversarial sample to form a final sparse adversarial sample; Step 5, repeating steps 1 to 4 T times until the number of updates of the adversarial sample reaches a predetermined iteration number, and using the obtained adversarial sample to attack the target black-box model; Step 1 includes: in a white-box model set M1, M2, …, M N n models are randomly sampled The first n-1 models are attacked as white-box models in step 2, and the n th model is simulated as a black-box model in step 3 M N Mn represents the n th model, Mn represents the n th model.

2. The method of claim 1, wherein, Step 2 comprises: Step 2-1: for the original image sample x to be input into the classification model to obtain a classification label, set the starting point of the adversarial sample update iteration process as x i,j wherein the subscript i represents the number of times of step 2 execution in the outer loop, and the subscript j represents the number of times of step 2 internal loop; for the n-1 models randomly sampled Calculate the logits output value obtained by inputting the current adversarial sample into the model, and perform weighted fusion: wherein denotes the s-th model For the logits output value of the current adversarial sample x i,j l(x i,j ) denotes the output logits value after n-1 models are weighted and fused, w s denotes the weight coefficient of each model, and w s ≥ 0, Step 2-2: calculating the loss function value of the current adversarial sample by using the cross-entropy loss function according to the fused logits output value calculated in step 2-1: where y is the true label of the original sample, represents one-hot code encoding of the true label, and softmax is a normalization function, represents the cross-entropy loss function value of the current adversarial sample on the previous n-1 models. Step 2-3: calculating the gradient of the current adversarial sample according to the loss function value, and updating the current adversarial sample according to the fast gradient sign method: where sign is a sign function, a is a step size of updating the adversarial sample each time, x i,j+1 represents the adversarial sample after one iteration of updating; Step 2-4: Repeat steps 2-1~2-3 K times, K is a hyperparameter, to get the final adversarial sample x of step 2 stage i,K .

3. The method of claim 2, wherein, Step 3 comprises: Step 3-1: Meta-testing phase, using the last model obtained by sampling Perform a one-time analog black-box attack; according to the adversarial sample x obtained in step 2 i,K , input the model Get the output logit value and calculate the cross-entropy loss function value Step 3-2: According to the loss function value Compute the gradient of the current adversarial sample, and update the initial adversarial sample x i Update: where β is the step size of updating adversarial samples in the meta-testing phase, x i+1 is the final adversarial sample in the meta-testing phase.

4. The method of claim 3, wherein, Step 4 comprises: Step 4-1: For the current adversarial sample x adv = x i+1 Projecting it to the L-0 norm space, we get the following minimization problem: such that -e < z mn - x mn < e, m = 1,..., d, n = 1,..., 3 wherein represents the minimum difference between the projected front and back images; represents a real number space with dimension d x 3, i.e., the size dimension of the image; z represents the final sparse adversarial sample; z mn represents the pixel value of the sparse adversarial sample at the coordinate (m, n); represents the pixel value of the current adversarial sample at the coordinate (m, n); k represents the sparsity, i.e., the number of pixel points allowed to add adversarial perturbations; ∈ is the maximum perturbation amplitude allowed to be added to a single pixel point; i and j represent the horizontal and vertical coordinates of the image sample pixel points, respectively; max is the maximum value function; Step 4-2: for the minimization problem in step 4-1, first ignore the sparsity constraint, and solve the pixel value of each pixel point after projection as follows: such that -e < z mn - x mn < e, m = 1,..., d, n = 1,..., 3 Step 4-3: arranging the pixel values after projection in descending order.

5. The method of claim 4, wherein, In step 4-2, the pixel value of each pixel point after projection The calculation formula is as follows:

6. The method of claim 5, wherein, In step 4-3, the descending order is arranged according to the following formula: wherein φ m represents the contribution degree value of the mth pixel point in the adversarial sample to the generation of the adversarial sample.

7. The method of claim 6, wherein, In step 4-3, the first k pixel values are selected according to the contribution degree of the generated adversarial sample to form a final sparse adversarial sample, and the values of the remaining pixel points are the same as the values of the original sample pixel points:

8. The method of claim 7, wherein, Step 5 comprises: input x for the next round of iteration i+1 = z, and repeat steps 2-4 T times to obtain the final sparse adversarial sample, and use the obtained sparse adversarial sample to attack the target black-box model.

9. A storage medium, characterized by A computer program or instructions are stored, and when the computer program or instructions are run, the method in any one of claims 1 to 8 is implemented.

Images