Adversarial sample generation method, device and electronic device

Abstract

The present application provides a method, apparatus, and electronic device for generating adversarial samples. The method comprises: obtaining training data and a target neural network model trained based on the training data; using the training data as input, calculating the average output value of each layer of the target neural network model, and using the average value of each layer as the output benchmark data of that layer; obtaining target data through iterative calculation based on the output benchmark data; and using the target data as an adversarial sample in response to determining that a predetermined condition has been met. This method limits the extent to which the generated adversarial sample deviates from the normal sample manifold, reducing the likelihood of the adversarial sample being detected.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to a method, device, and electronic device for generating adversarial samples. Background Art

[0002] Adversarial examples are input samples created by intentionally adding subtle perturbations to a dataset, causing the model to produce an incorrect output with high confidence. Using adversarial examples to train a target neural network model can improve its robustness.

[0003] In related technologies, a single loss function is generally used to measure the gap between the output label of the adversarial sample and the true label. This method limits and affects the generation of adversarial samples. Summary of the Invention

[0004] In view of this, the purpose of this application is to solve the problems raised in the background technology that limit and affect the generation of adversarial samples, and to propose an adversarial sample generation method, device and electronic device.

[0005] Based on the above objectives, this application provides a method for generating adversarial samples, including:

[0006] Obtaining training data and a target neural network model trained according to the training data;

[0007] Using the training data as input, respectively calculating the average output value of each layer of the target neural network model, and using the average value of each layer as the output benchmark data of the layer;

[0008] Obtaining target data through iterative calculation based on the output benchmark data;

[0009] In response to determining that a predetermined condition is met, the target data is used as an adversarial sample.

[0010] Optionally, obtaining the target data through iterative calculation based on the reference value includes iteratively executing the following steps until the predetermined condition is met:

[0011] In response to determining to perform a first round of iterative calculation, the training data is used as input data;

[0012] In response to determining that a non-first round of iterative calculation is to be performed, target data obtained in a previous round of iterative calculation is used as input data;

[0013] Calculating a loss function value based on the output benchmark data and the input data;

[0014] Calculating temporary target data according to the loss function value and a predetermined disturbance coefficient;

[0015] Calculating a disturbance value according to the temporary target data;

[0016] The disturbance value is superimposed on the input data to obtain the target data of this round of iterative calculation.

[0017] Optionally, calculating a loss function value based on the output reference data and the input data includes:

[0018] Determining a true category corresponding to the input data;

[0019] According to the input data, the output value and classification category of each layer of the target neural network model are obtained through the target neural network model;

[0020] According to the output value of each layer of the target neural network model, the output benchmark data, the true category, the classification category and the input data, the loss function value is calculated by the following formula:

[0021]

[0022] Wherein, θ represents the parameters of the target neural network model, x represents the input data, y represents the true category, L(θ, x, y) represents the loss function value, C(θ, x, y) represents the cross entropy loss function value between the true category and the classification category, k represents the number of layers of the target neural network model, ζ i represents the mean square loss term coefficient, represents the Euclidean distance between the output value of the i-th layer of the target neural network model and the output reference data, represents the output value of the i-th layer of the target neural network model, Represents the output benchmark data of the i-th layer of the target neural network model.

[0023] Optionally, the calculating and obtaining temporary target data according to the loss function value and a predetermined disturbance coefficient includes:

[0024] According to the loss function value, a gradient value is calculated by a back propagation algorithm;

[0025] The product of the disturbance coefficient and the gradient value is superimposed on the input data to obtain temporary target data.

[0026] Optionally, the mean square loss term coefficient can be obtained by the following method:

[0027] Obtaining a predetermined initial mean square loss term coefficient;

[0028] In response to determining to perform a first round of iterative calculation, the mean square loss term coefficient is the initial mean square loss term coefficient;

[0029] In response to determining that a non-first round of iterative calculation is to be performed, the output distance of each layer of the target neural network model in the previous round of iterative calculation is calculated according to the output value and output reference data of each layer of the target neural network model in the previous round of iterative calculation by the following formula:

[0030]

[0031] Among them, Dis i represents the output distance of the i-th layer, Indicates the absolute value of the difference between the output value of the i-th layer of the target neural network model in the previous round of calculation and the output reference data of the i-th layer, Indicates the output value of the i-th layer obtained by the target data obtained in the previous round through the target neural network model, represents the output reference data;

[0032] Determine the layer with the largest output distance of the target neural network model in the previous round of iterative calculation, and set the mean square loss term coefficient of this layer to the initial mean square loss term coefficient times the preset value, and set the mean square loss term coefficients of other layers to the initial mean square loss term coefficients.

[0033] Optionally, the predetermined mean square loss term coefficient may also be obtained by the following method:

[0034] In response to determining to perform the third and subsequent rounds of iterative calculations, the total output value distances of the target neural network model in the previous two rounds of iterative calculations are calculated respectively by the following formulas:

[0035]

[0036] Among them, Dis i represents the output distance of the i-th layer, and k represents the number of layers of the target neural network model;

[0037] In response to determining that the total output value distance of the previous round of iterative calculation is greater than the total output value distance of the previous round of iterative calculation, the mean square loss term coefficient is calculated by the following formula:

[0038]

[0039] Among them, i,t represents the mean square loss coefficient of the i-th layer in this round, ζ i,t-1 Represents the mean square loss coefficient of the i-th layer in the previous round, Dis iIndicates the output distance of the i-th layer of the target neural network model in the previous round of calculation, Dis min Represents the minimum value of the output distances of all layers of the target neural network model in the previous round of calculation.

[0040] Optionally, calculating the disturbance value according to the temporary target data includes:

[0041] The disturbance value is obtained according to the training data and the temporary target data by the following calculation formula:

[0042]

[0043] Among them, ε′ is the disturbance, p is the temporary target data; ε is the preset maximum disturbance value; p o For input data.

[0044] Optionally, the predetermined condition includes that the number of iterative calculation rounds reaches a predetermined number.

[0045] Based on the same inventive concept, this application also provides an adversarial sample generation device, including:

[0046] An acquisition module is configured to acquire training data and a target neural network model trained according to the training data;

[0047] an output benchmark data calculation module, configured to take the training data as input, calculate the average output value of each layer of the target neural network model, and use the average value of each layer as the output benchmark data of the layer;

[0048] a target data calculation module, configured to obtain target data through iterative calculation according to the output reference data;

[0049] The generating module is configured to use the target data as an adversarial sample in response to determining that a predetermined condition is met.

[0050] Based on the same inventive concept, the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and runnable on the processor, wherein when the processor executes the program, an adversarial sample generation method as described in any one of the above items is implemented.

[0051] As can be seen from the above, the adversarial sample generation method provided by this application calculates the perturbation value of the adversarial sample by comprehensively considering the loss value between the target neural network output data and the target classification result, thereby generating an adversarial sample. The adversarial sample generated by this method is closer to the manifold geometry of the training data, and therefore has the advantage of being closer to the normal manifold geometry and less easily recognized by detectors based on manifold detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions in this application or related technologies, the following briefly introduces the drawings required for use in the embodiments or related technical descriptions. Obviously, the drawings described below are merely embodiments of this application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0053] Figure 1 A flowchart of a method for generating adversarial samples according to one or more embodiments of the present application;

[0054] Figure 2 A schematic diagram of the structure of an adversarial sample generation device according to one or more embodiments of the present application;

[0055] Figure 3 This is a schematic diagram of the hardware structure of an electronic device according to one or more embodiments of the present application. DETAILED DESCRIPTION

[0056] In order to make the objectives, technical solutions and advantages of this application more clear, this application is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0057] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present application should have the usual meanings understood by people with ordinary skills in the field to which this application belongs. The "first", "second" and similar words used in the embodiments of the present application do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprise" and similar words mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0058] A manifold is a space that locally exhibits the properties of Euclidean space and is used in mathematics to describe geometric shapes. In physics, examples of manifolds include the phase space of classical mechanics and the four-dimensional pseudo-Riemannian manifold used to construct the space-time model of general relativity. One application of manifolds is to reduce data from high-dimensional space to low-dimensional space without losing information by comprehensively considering the distance and topological structure of the data.

[0059] Deep learning utilizes neural network models to discover the essence of data by learning the inherent patterns and representational hierarchies of sample data. This knowledge is then used to analyze data and implement functions such as object detection. However, because their internal structure is primarily based on linear blocks, in some experiments, the overall functions they implement have been shown to be highly linear. These linear functions are easy to optimize, but are also susceptible to rapid changes due to the influence of input data.

[0060] In order to improve the robustness of the target neural network, related technologies propose to use adversarial samples to train the target neural network.

[0061] As described in the background art, current methods for generating adversarial samples generally use a single loss function to measure the distance between the output value of the adversarial sample and the true label, and then modify the training data to obtain the adversarial sample. However, the adversarial samples generated by the above method fail to take into account the manifold geometric structure between the training data, resulting in their output gradually deviating from the manifold of the training data after passing through the intermediate layer of the target neural network model. As a result, there is a deviation between the manifold of the adversarial sample and the training data, and it enters the manifold of the target label. The adversarial samples generated by the above method not only lose the information of the original training data, but also have difficulty passing the detection of detectors based on manifold detection. Therefore, the above method limits and affects the generation of adversarial samples.

[0062] Therefore, this application proposes a method for generating adversarial samples, which not only considers the output values of each output layer of the target neural network model and the loss value between the model output value and the true label, but also takes into account the deviation of the manifold geometric structure between the generated adversarial samples and the training data, in order to find the coupling area between the training data manifold and the adversarial sample manifold, and determine when the adversarial sample enters the coupling area during the iterative calculation process.

[0063] The technical solutions of one or more embodiments of this specification are described in detail below through specific examples.

[0064] refer to Figure 1 The adversarial sample generation method of one or more embodiments of the present application includes the following steps:

[0065] Step S101: Acquire training data and a target neural network model trained according to the training data.

[0066] In some embodiments, the training data can be images, text sequences, or other data. In some embodiments, the original dataset can be an existing public dataset, such as CIFAR-10 or MNIST, or a custom dataset. In some embodiments, the target neural network model can be a neural network model such as ResNet34 or Inception v3.

[0067] Step S102: using the training data as input values, respectively calculating the average value of the output value of each layer of the target neural network model, and using the average value of each layer as the output benchmark data of the layer.

[0068] In the process of realizing this application, the applicant discovered that the reason why the neural network model has advantages in fields such as target recognition is that it completes data dimensionality reduction on complex data sets, reducing data with complex manifold geometry, high dimensions, and multiple feature labels to data with simple manifold geometry, low dimensions, and a small number of feature labels. In the process of data dimensionality reduction, the less data information is lost, the higher the accuracy of its output value. In the process of data dimensionality reduction, the data dimension and data manifold geometry will change at each layer of the neural network model. Therefore, the adversarial sample generation method proposed in this application comprehensively considers the output value of each layer of the target neural network model, in order to obtain adversarial samples with minimal information loss.

[0069] In this step, each layer of the target neural network model will obtain its output data. The average value of the output data of each layer is calculated as the output reference data of the layer. In one embodiment of the present application, the target neural network model is a convolutional neural network, and the input data is at least one 32*32 pixel image data. After the image data is input into the convolutional neural network, each intermediate layer of the convolutional neural network will output at least one output value, and the average value of the output value of each layer is calculated as the output reference data of the layer. Taking the first layer as an example, the output value of each output image data in this layer is 6 feature maps of 28*28 pixels. Therefore, this layer includes multiple feature maps of 28*28 pixels, and the average value of each pixel is calculated, and the 28*28 pixel image composed of all the average values is used as the data reference data of this layer.

[0070] Step S103: Obtain target data through iterative calculation based on the output reference data.

[0071] According to the above content, in this step, based on the output reference data of step S102, the characteristics of the data and the manifold geometry are comprehensively considered, and the target data is obtained through iterative calculation.

[0072] In some embodiments, the input data for iterative calculation is first determined; then the loss value and distance value of the input data are calculated; finally, a perturbation value is calculated based on the loss value and distance value, and the perturbation value is superimposed on the input data to obtain an adversarial sample.

[0073] Specifically, in some embodiments, in response to determining to execute the first round of iterative calculations, the training data is used as input data; in response to determining to execute a round other than the first round of iterative calculations, the target data obtained in the previous round of iterative calculations is used as input data. That is, in some embodiments, in the first iterative calculation, the training data is used as input data; in subsequent iterative calculations, the target data obtained in the previous round is used as input data for the current round.

[0074] In some embodiments, the loss value of the input data is calculated using a cross entropy function. The cross entropy loss function is used to represent the difference between the probability distribution of the output reference data and the probability distribution of the output data of this round. In some embodiments, the distance value between the input data and the output reference data is calculated using Euclidean distance. A manifold is a space that locally has Euclidean space properties and can be used to calculate distance using Euclidean distance. In some embodiments, the loss function value is calculated by combining the above loss value and distance value using the following formula:

[0075]

[0076] Wherein, θ represents the parameters of the target neural network model, x represents the input data, y represents the true category, L(θ, x, y) represents the loss function value, C(θ, x, y) represents the cross entropy loss function value between the true category and the classification category, k represents the number of layers of the target neural network model, ζ i represents the mean square loss term coefficient, represents the Euclidean distance between the output value of the i-th layer of the target neural network model and the output reference data, represents the output value of the i-th layer of the target neural network model, Represents the output benchmark data of the i-th layer of the target neural network model.

[0077] In some embodiments, the gradient value of the target neural network model is calculated based on the loss function value through a back propagation algorithm.

[0078] In some embodiments, the product of the gradient value, the input data, and the disturbance coefficient is used as temporary target data.

[0079] In some embodiments, the disturbance system is obtained in a predetermined manner. In some embodiments, an initial disturbance coefficient is predetermined, and a disturbance coefficient is obtained based on the initial disturbance coefficient. In some embodiments, the disturbance coefficient is determined by the following method:

[0080] Obtaining a predetermined initial mean square loss term coefficient;

[0081] In response to determining to perform a first round of iterative calculation, the mean square loss term coefficient is the initial mean square loss term coefficient;

[0082] In response to determining that a non-first round of iterative calculation is to be performed, the output distance of each layer of the target neural network model in the previous round of iterative calculation is calculated according to the output value and output reference data of each layer of the target neural network model in the previous round of iterative calculation by the following formula:

[0083]

[0084] Among them, Dis i represents the output distance of the i-th layer, Indicates the absolute value of the difference between the output value of the i-th layer of the target neural network model in the previous round of calculation and the output reference data of the i-th layer, Indicates the output value of the i-th layer obtained by the target data obtained in the previous round through the target neural network model, represents the output reference data;

[0085] Determine the layer with the largest output distance of the target neural network model in the previous round of iterative calculation, and set the mean square loss coefficient of this layer to 1.05 times the initial mean square loss coefficient, and set the mean square loss coefficients of other layers to the initial mean square loss coefficients.

[0086] In some embodiments, in response to determining to perform the third and subsequent rounds of iterative calculations, the total output value distances of the target neural network model in the previous two rounds of iterative calculations are calculated using the following formulas:

[0087]

[0088] Among them, Dis i represents the output distance of the i-th layer, and k represents the number of layers of the target neural network model;

[0089] In response to determining that the total output value distance of the previous round of iterative calculation is greater than the total output value distance of the previous round of iterative calculation, the mean square loss term coefficient is calculated by the following formula:

[0090]

[0091] Among them, i,t represents the mean square loss coefficient of the i-th layer in this round, ζ i,t-1 Represents the mean square loss coefficient of the i-th layer in the previous round, Dis i Indicates the output distance of the i-th layer of the target neural network model in the previous round of calculation, Dis minRepresents the minimum value of the output distances of all layers of the target neural network model in the previous round of calculation.

[0092] In some embodiments, the disturbance value is obtained according to the training data and the temporary target data by the following calculation formula:

[0093]

[0094] Among them, ε′ is the disturbance, p is the temporary target data; ε is the preset maximum disturbance value; p o For input data.

[0095] In some embodiments, the disturbance value is superimposed on the input data to obtain the target data of this round of iterative calculation. In some embodiments, after the disturbance value is superimposed on the input data, the obtained value is subjected to a maximum and minimum value check, and the maximum and minimum value check is performed to ensure that the data is distributed within a predetermined value range. In some embodiments, the maximum and minimum value check is performed using the following formula:

[0096]

[0097] Among them, p is the input data; γ max is the predetermined maximum value; γ min is the predetermined minimum value.

[0098] Step S104: In response to determining that a predetermined condition is met, the target data is used as an adversarial sample.

[0099] In some embodiments, the predetermined condition is that the number of iteration rounds reaches a predetermined value.

[0100] In some embodiments, the predetermined value is determined based on past experimental results. The ultimate goal of the adversarial example is to ensure that its data manifold enters the coupling region of the training data manifold. In some embodiments, the predetermined value is set based on the average number of iterations required for the adversarial example's manifold to enter the coupling region, as determined through past experiments.

[0101] It should be noted that the method of the embodiment of the present application can be performed by a single device, such as a computer or server. The method of this embodiment can also be applied in a distributed scenario and performed by multiple devices working together. In such a distributed scenario, one of the multiple devices may only perform one or more steps of the method of the embodiment of the present application, and the multiple devices will interact with each other to complete the method.

[0102] It should be noted that the above description is limited to some embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in an order different from that described in the above embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order or sequential order shown to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0103] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides an adversarial sample generation device.

[0104] refer to Figure 2 , the adversarial sample generating device includes:

[0105] An acquisition module is configured to acquire training data and a target neural network model trained according to the training data;

[0106] an output benchmark data calculation module, configured to take the training data as input, calculate the average output value of each layer of the target neural network model, and use the average value of each layer as the output benchmark data of the layer;

[0107] a target data calculation module, configured to obtain target data through iterative calculation according to the output reference data;

[0108] The generating module is configured to use the target data as an adversarial sample in response to determining that a predetermined condition is met.

[0109] For the convenience of description, the above devices are described as being divided into various modules according to their functions. Of course, when implementing this application, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0110] The apparatus of the above embodiment is used to implement the corresponding adversarial sample generation method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0111] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and runnable on the processor, wherein when the processor executes the program, the adversarial sample generation method described in any of the above embodiments is implemented.

[0112] Figure 310 is a schematic diagram showing a more specific hardware structure of an electronic device provided in this embodiment. The device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are communicatively connected to each other within the device via the bus 1050.

[0113] The processor 1010 can be implemented using a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0114] The memory 1020 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage devices, dynamic storage devices, etc. The memory 1020 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 1020 and is called and executed by the processor 1010.

[0115] The input / output interface 1030 is used to connect input / output modules to implement information input and output. The input / output modules can be configured as components within the device (not shown in the figure) or can be externally connected to the device to provide corresponding functions. Input devices may include a keyboard, mouse, touch screen, microphone, various sensors, etc., and output devices may include a display, speaker, vibrator, indicator light, etc.

[0116] The communication interface 1040 is used to connect to a communication module (not shown) to enable communication between the device and other devices. The communication module can communicate via a wired method (such as USB, network cable, etc.) or a wireless method (such as mobile network, WiFi, Bluetooth, etc.).

[0117] The bus 1050 comprises a path for transmitting information between the various components of the device (eg, the processor 1010 , the memory 1020 , the input / output interface 1030 , and the communication interface 1040 ).

[0118] It should be noted that although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040, and the bus 1050, in a specific implementation, the device may also include other components necessary for normal operation. In addition, it will be understood by those skilled in the art that the above device may only include the components necessary to implement the embodiments of this specification, and does not necessarily include all the components shown in the figure.

[0119] The electronic device of the above embodiment is used to implement the corresponding adversarial sample generation method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0120] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present application (including the claims) is limited to these examples. Within the scope of the present application, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the present application as described above, which are not provided in detail for the sake of simplicity.

[0121] In addition, for simplicity of description and discussion, and in order not to make the embodiment of the application difficult to understand, the known power supply / ground connection with integrated circuit (IC) chip and other components may or may not be shown in the accompanying drawings provided. In addition, the device can be shown in the form of a block diagram to avoid making the embodiment of the application difficult to understand, and this also takes into account the following fact, that is, the details of the embodiment of these block diagram devices are highly dependent on the platform to be implemented in the embodiment of the application (that is, these details should be fully within the scope of understanding of those skilled in the art). When specific details (for example, circuit) are set forth to describe exemplary embodiments of the application, it will be apparent to those skilled in the art that the embodiment of the application can be implemented without these specific details or when these specific details are changed. Therefore, these descriptions should be considered to be illustrative rather than restrictive.

[0122] Although the present invention has been described in conjunction with specific embodiments thereof, many alternatives, modifications, and variations of these embodiments will be apparent to those skilled in the art based on the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may utilize the embodiments discussed.

[0123] The embodiments of the present application are intended to cover all such substitutions, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present application should be included in the scope of protection of this application.

Claims

1. A method for generating adversarial samples, characterized in that: include: Obtaining training data and a target neural network model trained according to the training data; Using the training data as input, respectively calculating the average output value of each layer of the target neural network model, and using the average value of each layer as the output benchmark data of the layer; Obtaining target data through iterative calculation based on the output benchmark data; In response to determining that a predetermined condition is met, using the target data as an adversarial example; Obtaining target data through iterative calculation based on the output reference data includes iteratively executing the following steps until the predetermined condition is met: In response to determining to perform a first round of iterative calculation, the training data is used as input data; In response to determining that a non-first round of iterative calculation is to be performed, target data obtained in a previous round of iterative calculation is used as input data; Calculating a loss function value based on the output benchmark data and the input data; Calculating temporary target data according to the loss function value and a predetermined disturbance coefficient; Calculating a disturbance value according to the temporary target data; Superimposing the disturbance value on the input data to obtain the target data of this round of iterative calculation; The calculating a loss function value based on the output reference data and the input data includes: Determining a true category corresponding to the input data; According to the input data, the output value and classification category of each layer of the target neural network model are obtained through the target neural network model; According to the output value of each layer of the target neural network model, the output benchmark data, the true category, the classification category and the input data, the loss function value is calculated by the following formula: in, represents the parameters of the target neural network model, represents the input data, represents the true category, represents the loss function value, Represents the cross entropy loss function value between the true category and the classification category, represents the number of layers of the target neural network model, represents the mean square loss coefficient of the i-th layer, represents the Euclidean distance between the output value of the i-th layer of the target neural network model and the output reference data, Represents the target neural network model The output value of the layer, Represents the output benchmark data of the i-th layer of the target neural network model; The step of calculating temporary target data based on the loss function value and a predetermined disturbance coefficient includes: According to the loss function value, a gradient value is calculated by a back propagation algorithm; The product of the disturbance coefficient and the gradient value is superimposed on the input data to obtain temporary target data.

2. The adversarial sample generation method according to claim 1, characterized in that: The mean square loss term coefficient is obtained by the following method: Obtaining a predetermined initial mean square loss term coefficient; In response to determining to perform a first round of iterative calculation, the mean square loss term coefficient is the initial mean square loss term coefficient; In response to determining that a non-first round of iterative calculation is to be performed, the output distance of each layer of the target neural network model in the previous round of iterative calculation is calculated according to the output value and output reference data of each layer of the target neural network model in the previous round of iterative calculation by the following formula: in, represents the output distance of the i-th layer, Indicates the absolute value of the difference between the output value of the i-th layer of the target neural network model in the previous round of calculation and the output reference data of the i-th layer, Indicates the output value of the i-th layer obtained by the target data obtained in the previous round through the target neural network model, represents the output reference data; Determine the layer with the largest output distance of the target neural network model in the previous round of iterative calculation, and set the mean square loss coefficient of this layer to the mean square loss coefficient of the previous round times the preset value, and set the mean square loss coefficients of other layers to the mean square loss coefficients of the previous round.

3. The adversarial sample generation method according to claim 2, characterized in that: The predetermined mean square loss term coefficient is obtained by the following method: In response to determining to perform the third and subsequent rounds of iterative calculations, the total output value distances of the target neural network model in the previous two rounds of iterative calculations are calculated respectively by the following formulas: in, represents the output distance of the i-th layer, and k represents the number of layers of the target neural network model; In response to determining that the total output value distance of the previous round of iterative calculation is greater than the total output value distance of the previous round of iterative calculation, the mean square loss term coefficient is calculated by the following formula: in, represents the mean square loss coefficient of the i-th layer in this round, represents the mean square loss coefficient of the i-th layer in the previous round, Represents the output distance of the i-th layer of the target neural network model in the previous round of calculation, Represents the minimum value of the output distances of all layers of the target neural network model in the previous round of calculation.

4. The adversarial sample generation method according to any one of claims 2 or 3, characterized in that The calculating the disturbance value according to the temporary target data includes: The disturbance value is obtained according to the training data and the temporary target data by the following calculation formula: in, For disturbance, Temporary target data; is the preset maximum disturbance value; For input data.

5. The adversarial sample generation method according to claim 1, characterized in that: The predetermined condition includes that the number of iterative calculation rounds reaches a predetermined number.

6. A device for generating adversarial samples, characterized in that: include: An acquisition module is configured to acquire training data and a target neural network model trained according to the training data; an output benchmark data calculation module, configured to take the training data as input, calculate the average output value of each layer of the target neural network model, and use the average value of each layer as the output benchmark data of the layer; a target data calculation module, configured to obtain target data through iterative calculation according to the output reference data; a generating module configured to, in response to determining that a predetermined condition is met, use the target data as an adversarial sample; Obtaining target data through iterative calculation based on the output reference data includes iteratively executing the following steps until the predetermined condition is met: In response to determining to perform a first round of iterative calculation, the training data is used as input data; In response to determining that a non-first round of iterative calculation is to be performed, target data obtained in a previous round of iterative calculation is used as input data; Calculating a loss function value based on the output benchmark data and the input data; Calculating temporary target data according to the loss function value and a predetermined disturbance coefficient; Calculating a disturbance value according to the temporary target data; Superimposing the disturbance value on the input data to obtain the target data of this round of iterative calculation; The calculating a loss function value based on the output reference data and the input data includes: Determining a true category corresponding to the input data; According to the input data, the output value and classification category of each layer of the target neural network model are obtained through the target neural network model; According to the output value of each layer of the target neural network model, the output benchmark data, the true category, the classification category and the input data, the loss function value is calculated by the following formula: in, represents the parameters of the target neural network model, represents the input data, represents the true category, represents the loss function value, Represents the cross entropy loss function value between the true category and the classification category, represents the number of layers of the target neural network model, represents the mean square loss coefficient of the i-th layer, represents the Euclidean distance between the output value of the i-th layer of the target neural network model and the output reference data, Represents the target neural network model The output value of the layer, Represents the output benchmark data of the i-th layer of the target neural network model; The step of calculating temporary target data based on the loss function value and a predetermined disturbance coefficient includes: According to the loss function value, a gradient value is calculated by a back propagation algorithm; The product of the disturbance coefficient and the gradient value is superimposed on the input data to obtain temporary target data.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method according to any one of claims 1 to 5 is implemented.

Images