Multi-step Gradient Adversarial Sample Generation Method and System Based on Feature and Label Smoothing

Abstract

The present invention proposes a multi-step gradient adversarial sample generation method and system based on feature and label smoothing, belonging to the field of artificial intelligence security. It includes: obtaining the image to be attacked; obtaining the important feature regions of the image to be attacked based on the Grad-CAM++ algorithm; taking the image to be attacked as the center, selecting N images within the neighborhood of the image to be attacked, and calculating the gradient information of the loss function of the N images within the neighborhood; using the normal distribution function to perform weighted summation on the gradient information of the loss function of the N images within the neighborhood, generating perturbations for the important feature regions of the image to be attacked; adding the perturbations to the image to be attacked to generate the image after adding the perturbations; determining whether the image after adding the perturbations is successfully attacked or reaches the maximum number of iterations. If it is successfully attacked or reaches the maximum number of iterations, an adversarial sample is generated. The present invention attacks the feature regions, reduces the L0 norm of the adversarial samples, performs weighted summation processing on multiple sets of gradient information, reduces the fitting degree to the surrogate model, and increases the success rate of black-box attacks.

Description

Technical Field

[0001] The present invention belongs to the technical field of artificial intelligence security, and particularly relates to a multi-step gradient adversarial sample generation method and system based on feature and label smoothing. Background Technique

[0002] The statements in this part only provide background technical information related to the present invention and do not necessarily constitute prior art.

[0003] Nowadays, with the continuous improvement of computer performance, deep learning has been widely

[0004] applied in various fields. However, some researchers have found that deep learning models have potential security risks of being vulnerable to adversarial sample attacks. In the field of computer vision, adversarial samples are generated by attackers adding subtle perturbations that are almost indistinguishable to humans through the senses to the original data, so that the generated adversarial samples can make the original model make incorrect changes.

[0005] Adversarial samples can be classified into white-box attacks and black-box attacks according to the attack methods. Black-box attacks treat the model as a black box, completely unaware of the internal structure of the model, and only know the input and output of the model. A common black-box attack is based on the idea of transfer learning. An open-source model similar to the white-box attack is used, and model distillation is used to fit the decision results of the attacked black-box model, so as to complete the knowledge transfer from the black-box model to the proxy model. Then, the subsequent attack method is used to generate adversarial samples to conduct a transfer attack on the black-box model. Therefore, the white-box attack is the basis for realizing the transfer-based black-box attack.

[0006] Since the emergence of adversarial samples, various algorithms have emerged. Such as gradient-based attack algorithms FGSM, I-FGSM, MI-FGSM, and optimization-based adversarial sample attack algorithms C&W, etc. I-FGSM is a common white-box generation method for adversarial samples. Since the gradient information of each iteration is used to generate specific perturbations during its iterative process, the generated adversarial samples are overfitted and are often only effective for specific models. Therefore, the success rate of black-box attacks is very low.

[0007] In addition to the transferability of adversarial samples (the success rate of black-box attacks), the quality of generated adversarial samples is often measured by the Lp norm of the perturbation. Although C&W has an L2 attack, its attack time is long and the efficiency is low; the adversarial samples generated by gradient-based attack algorithms attack the entire range of the image, resulting in too high an L0 norm of the perturbation and too poor quality of the adversarial samples.

[0008] To sum up, the current gradient-based black-box adversarial sample generation algorithm in the field of image classification attacks the entire range of the image and belongs to L ∞For attacks, the generated perturbations all have a relatively high L0 norm, and at the same time, the success rate of black-box attacks is not high. Summary of the Invention

[0009] To overcome the deficiencies of the above-mentioned prior art, the present invention provides a multi-step gradient adversarial sample generation method and system based on feature and label smoothing. The Grad-CAM++ algorithm is applied to the generation process of adversarial samples to obtain the image feature region, and the pixels in the feature region are attacked to reduce the L0 norm of the generated adversarial samples; the normal distribution function is used to weighted sum the multi-step adversarial sample gradient information instead of the original gradient information, improve the I-FGSM algorithm, introduce the label smoothing idea, and improve the cross-entropy loss function to prevent overfitting of adversarial samples, further improve the transferability of adversarial samples, and increase the success rate of black-box attacks.

[0010] To achieve the above object, one or more embodiments of the present invention provide the following technical solutions:

[0011] The first aspect of the present invention provides a multi-step gradient adversarial sample generation method based on feature and label smoothing.

[0012] The multi-step gradient adversarial sample generation method based on feature and label smoothing includes the following steps:

[0013] Step 1: Obtain an image, preprocess the image to obtain the attacked image;

[0014] Step 2: Set the attack parameters, and extract the attention region of the model for the attacked image based on the Grad-CAM++ algorithm to obtain the important feature region of the attacked image;

[0015] Step 3: Introduce the label smoothing idea, improve the cross-entropy loss function of the network model to obtain the improved cross-entropy loss function. Centered on the attacked image, select N images in the neighborhood of the attacked image, input the N images into the network model to obtain the output, calculate the loss function value based on the improved cross-entropy loss function, and obtain the loss function gradient information of the N images in the neighborhood through backpropagation of the loss function;

[0016] Step 4: Use the normal distribution function to weighted sum the loss function gradient information of the N images in the neighborhood to obtain the picture gradient after multi-step gradient weighted summation;

[0017] Step 5: Generate perturbations for the important feature region of the attacked image based on the picture gradient after multi-step gradient weighted summation;

[0018] Step 6: Add perturbations to the attacked image to generate the image after adding perturbations;

[0019] Step 7: Determine whether the image after adding perturbation is successfully attacked or reaches the maximum number of iterations. If the attack is successful or the maximum number of iterations is reached, generate an adversarial sample; otherwise, use the image after adding perturbation as the new image to be attacked and loop through Steps 3 to 7 above.

[0020] The second aspect of the present invention provides a multi-step gradient adversarial sample generation system based on feature and label smoothing.

[0021] The multi-step gradient adversarial sample generation system based on feature and label smoothing includes:

[0022] An image to be attacked acquisition module, configured to: acquire an image, preprocess the image, and obtain the image to be attacked;

[0023] A parameter setting and important feature region acquisition module, configured to: set attack parameters, extract the attention region of the model for the image to be attacked based on the Grad-CAM++ algorithm, and obtain the important feature region of the image to be attacked;

[0024] An N-image loss function gradient information acquisition module, configured to: introduce the idea of label smoothing, improve the cross-entropy loss function of the network model to obtain the improved cross-entropy loss function, select N images in the neighborhood of the image to be attacked with the image to be attacked as the center, input the N images into the network model to obtain the output, calculate the loss function value based on the improved cross-entropy loss function, and obtain the loss function gradient information of the N images in the neighborhood through backpropagation of the loss function;

[0025] A multi-step gradient weighted summation image gradient acquisition module, configured to: perform weighted summation on the loss function gradient information of the N images in the neighborhood using the normal distribution function to obtain the image gradient after multi-step gradient weighted summation;

[0026] A perturbation generation module, configured to: generate a perturbation for the important feature region of the image to be attacked based on the image gradient after multi-step gradient weighted summation;

[0027] An image perturbation addition module, configured to: add a perturbation to the image to be attacked to generate an image after adding the perturbation;

[0028] An adversarial sample acquisition module, configured to: determine whether the image after adding the perturbation is successfully attacked or reaches the maximum number of iterations. If the attack is successful or the maximum number of iterations is reached, generate an adversarial sample.

[0029] The third aspect of the present invention provides a computer-readable storage medium, on which a program is stored, and when the program is executed by a processor, it implements the steps in the multi-step gradient adversarial sample generation method based on feature and label smoothing as described in the first aspect of the present invention.

[0030] In a fourth aspect of the present invention, there is provided an electronic device, including a memory, a processor, and a program stored on the memory and executable on the processor. When the processor executes the program, the steps in the multi-step gradient adversarial sample generation method based on feature and label smoothing as described in the first aspect of the present invention are implemented.

[0031] The above one or more technical solutions have the following beneficial effects:

[0032] To solve the problems of high L0 norm of adversarial sample perturbations and low success rate of black-box attacks in the prior art, the present invention proposes a new adversarial sample generation method, named FGMI-FGSM algorithm. The present invention first performs weighted summation processing on the multi-step adversarial sample gradient information using the normal distribution (Gaussian distribution) function to solve the error between the surrogate model and the target model existing in each iteration process of I-FGSM, so that the success rate of black-box attacks in the present invention has a certain improvement compared with I-FGSM; then the idea of label smoothing is introduced into it, and the Grad-CAM++ algorithm in the field of interpretability is used to extract important features of the image and attack the important feature regions. Finally, the L0 norm of the perturbations of the generated adversarial samples can be controlled at about 3.5%, and the success rate of black-box attacks is increased to about 88.2%, which is about 60% higher than that of I-FGSM.

[0033] Aiming at the problem of high L0 norm of the gradient-based adversarial sample generation algorithm, the present invention applies the Grad-CAM++ algorithm to the generation process of adversarial samples to obtain the image feature regions and attack the pixel points in the feature regions to reduce the L0 norm of the generated adversarial samples.

[0034] Aiming at the problem of low success rate of black-box attacks caused by overfitting of the generated adversarial samples in the gradient-based adversarial sample white-box algorithm I-FGSM, the present invention only attacks the image feature regions, generates perturbations for the important feature regions of the attacked image based on the picture gradient after multi-step gradient weighted summation, reduces the gradient information difference between the surrogate model and the target model, and at the same time introduces the idea of label smoothing, sets the γ term to improve the cross-entropy loss function, and reduces the overfitting to the surrogate model, thereby increasing the success rate of black-box attacks from the above three aspects.

[0035] The advantages of the additional aspects of the present invention will be partially given in the following description, partially become obvious from the following description, or be understood through the practice of the present invention. Description of the Drawings

[0036] The specification drawings constituting a part of the present invention are used to provide a further understanding of the present invention. The schematic embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation to the present invention.

[0037] Figure 1 Flowchart of the multi-step gradient adversarial sample generation method based on feature and label smoothing for the first embodiment.

[0038] Figure 2 Flowchart of the FGMI-FGSM algorithm for the first embodiment.

[0039] Figure 3 Image heatmap generated by Grad-CAM++.

[0040] Figure 4(a) shows the effect diagram of generating adversarial samples by attacking the Resnet34 model using the FGMI-FGSM algorithm of the present invention under white-box conditions;

[0041] Figure 4(b) shows the effect diagram of generating adversarial samples by attacking the Resnet34 model using the I-FGSM algorithm under white-box conditions;

[0042] Figure 5 System structure diagram of the second embodiment. Detailed implementation manners

[0043] It should be noted that the following detailed description is exemplary and is intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by those of ordinary skill in the technical field to which the present invention belongs.

[0044] It should be noted that the terms used herein are only for describing specific implementation manners and are not intended to limit the exemplary embodiments according to the present invention.

[0045] In the case of no conflict, the embodiments in the present invention and the features in the embodiments can be combined with each other.

[0046] Term explanation:

[0047] White-box attack success rate: The success rate of attacking a target model through an adversarial attack algorithm by using known target model information (such as the internal structure, parameters, and training data set of the model, etc.).

[0048] Black-box attack success rate: The success rate of generating adversarial samples through an adversarial attack algorithm by using known surrogate model information and then using the adversarial samples to attack the target model.

[0049] L0 norm of adversarial perturbation: The L0 norm of perturbation refers to the number of modified pixel data.

[0050] L2 norm of adversarial perturbation: The L2 norm of perturbation refers to the sum of the squares of the perturbation elements and then taking the square root.

[0051] Targeted Attack: A targeted attack means that the attacker classifies the input sample into a specified wrong category.

[0052] Non-Targeted Attack. A non-targeted attack means that the attacker classifies the input sample into any wrong category.

[0053] Transfer Attack: Since adversarial samples are transferable, using a known model (surrogate model) to generate adversarial samples to attack an unknown model (target model) belongs to black-box attack.

[0054] Overall idea proposed by the present invention:

[0055] In the prior art, the gradient-based adversarial sample attack method only limits the maximum value of the perturbation but does not limit the range of the perturbation. Therefore, the L0 norm of the perturbation of the generated adversarial samples is often relatively high. In the case of transfer-based black-box attacks, the I-FGSM algorithm generates a specific perturbation by using the gradient information of the surrogate model and adds it to the image to generate adversarial samples during a single iteration. So, the generated adversarial samples have overfitting problems, resulting in poor transferability of the adversarial samples.

[0056] The present invention improves the transferability of adversarial samples from three aspects.

[0057] 1. The present invention uses the Grad-CAM++ algorithm to obtain the important feature regions of the image. The Grad-CAM++ algorithm is one of the important algorithms in the field of interpretability and can be used in image classification tasks. This algorithm can provide reliable visual explanations for the predictions of the CNN model, can better locate the target, and can explain the appearance of multiple target instances in a single image. Knowing where the model's attention is on the picture and adding perturbations only to the important feature regions instead of other regions is less likely to fall into local maximum points compared to adding perturbations to the entire picture, greatly reducing the overfitting problem of adversarial samples.

[0058] In transfer-based black-box attacks, setting perturbations using the gradient information of the surrogate model's loss function and adding perturbations to the entire picture are more likely to mislead the surrogate model to jump out of the original label. However, since a large amount of information in non-significant regions is used, it will make the adversarial samples more likely to fit the surrogate model and fall into local extreme points. Since there are structural and parameter differences between the surrogate model and the target model, for the target model, the perturbations outside the non-feature regions are carefully set for the surrogate model and do not have a good'misleading' effect on the target model. In this way, the transferability of the generated adversarial samples is too poor.

[0059] For a simple example: The human eye judges a picture based on the "core information" of the picture, regardless of the surrounding background information. By replacing the "core information" without replacing the surrounding background, it is very easy to cause misjudgment. Even if the background is removed and only the "core information" is retained, the human eye can still recognize it. For a good model, the better it extracts the features of the image, the more abstract the obtained feature map is, and the attention of the model to the image is closer to the judgment of the human eye. By only adding perturbations to the core area for attack and generating adversarial samples, for the model, other areas remain unchanged, only the significant area changes. This significant area should be similar for each good classification model, so the transferability is increased.

[0060] 2. In a certain iteration process, there is an error between the gradient of the surrogate model loss function and the gradient of the target model loss function. This results in differences in the adversarial perturbations generated using gradient information between the target model and the surrogate model in each iteration of I-FGSM, which makes the generated adversarial samples more fitting to the surrogate model, leading to the failure of the black-box attack (transfer-based black-box attack) on the target model.

[0061] Therefore, in one iteration of the present invention, multi-step gradient information is utilized, and the normal distribution (Gaussian distribution) function is used to perform weighted summation processing on multiple groups of gradient information to obtain the processed gradient information, which can reduce the fitting degree to the surrogate model and improve the transferability of the adversarial samples.

[0062] 3. In multi-label image classification, the cross-entropy loss function is often used, and the labels use one-hot encoding. Minimizing the cross-entropy loss function is equivalent to maximizing the log-likelihood function of the correct class. Since only the correct label is 1 in one-hot encoding and the remaining incorrect labels are 0, this leads to continuously increasing the softmax probability of the correct class, that is, the logit score corresponding to the correct class will keep increasing until positive infinity to obtain the minimized cross-entropy loss function. This will undoubtedly lead to overfitting, and the model will be overly confident and increase the logit score of a certain class regardless of everything. The present invention introduces the idea of label smoothing in the attack iteration process, adding a γ term to the original one-hot label to prevent overfitting of the adversarial samples.

[0063] The present invention uses the Grad-CAM++ algorithm and the normal distribution (Gaussian distribution) function to perform weighted summation on multi-step adversarial sample gradient information to replace the original gradient information, improves the I-FGSM algorithm, then introduces the idea of label smoothing, improves the cross-entropy loss function to prevent overfitting of the adversarial samples, and further improves the transferability of the adversarial samples. At the same time, the Grad-CAM++ is used to find the important feature regions of the image, and the pixels in the important feature regions are attacked. According to this method, the L0 norm of the perturbation of the generated adversarial samples is significantly reduced, and it has a certain black-box attack ability.

[0064] Example 1

[0065] This example discloses a multi-step gradient adversarial sample generation method based on feature and label smoothing.

[0066] As Figure 1 shown, the multi-step gradient adversarial sample generation method based on feature and label smoothing includes the following steps:

[0067] Step 1: Obtain an image, preprocess the image, and obtain the attacked image;

[0068] Step 2: Set the attack parameters, extract the attention region of the model for the attacked image based on the Grad-CAM++ algorithm, and obtain the important feature region of the attacked image;

[0069] Step 3: Introduce the idea of label smoothing, improve the cross-entropy loss function of the network model, obtain the improved cross-entropy loss function. Centered on the attacked image, select N images within the neighborhood of the attacked image, input the N images into the network model to obtain the output, calculate the loss function value based on the improved cross-entropy loss function, and through the backpropagation of the loss function, obtain the loss function gradient information of the N images within the neighborhood;

[0070] Step 4: Use the normal distribution function to perform weighted summation on the loss function gradient information of the N images within the neighborhood to obtain the picture gradient after multi-step gradient weighted summation;

[0071] Step 5: Generate a perturbation for the important feature region of the attacked image based on the picture gradient after multi-step gradient weighted summation;

[0072] Step 6: Add the perturbation to the attacked image to generate the image after adding the perturbation;

[0073] Step 7: Determine whether the image after adding the perturbation has been successfully attacked or the maximum number of iterations has been reached. If the attack is successful or the maximum number of iterations has been reached, the generation of the adversarial sample is successful; if not, use the image after adding the perturbation as the new attacked image and loop through the above steps 3 to 7.

[0074] Specifically, as Figure 1 shown:

[0075] Step1: Image preprocessing.

[0076] Image preprocessing is to normalize or standardize the pixel range of the original image in the range of [0, 255] to control the pixel values within [0, 1] to obtain the attacked image.

[0077] Taking the preprocessing of ImageNet images with Pytorch as an example, the transforms.Normalize(mean, std) is used to normalize the images channel by channel, that is, subtracting the mean and then dividing by the variance. After such processing, the data is normalized, that is, the mean is 0 and the standard deviation is 1. This makes it easier for the model to converge and improves the speed of generating adversarial samples. Among them, the parameters mean and std represent the mean and variance sequences of each channel of the image respectively.

[0078] Step2: Set the attack parameters.

[0079] Obtain the attacked image after image preprocessing, denoted as the input image x, and its corresponding class label is y. Set the size of the perturbation in each iteration process to ε, and perform T iterations of attacks to generate adversarial samples. Set the momentum term m, the Gaussian kernel F(n) for weighted summation of the normal distribution, and the image neighborhood β is a real number, the number N of images obtained within the neighborhood, and the label smoothing term γ.

[0080] Step3: Obtain the important feature regions of the attacked image.

[0081] Use the Grad-CAM++ algorithm to extract the attention region of the model for the image, that is, the important feature region. Set the threshold L to control the size of the attacked range.

[0082] Step4: Perform iterative attacks and set t = 0.

[0083] Set t = 0,

[0084] Step5: Obtain the output of the image classification model.

[0085] Input Obtain the model classification label y.

[0086] Step6: Calculate the current image and the gradient of the loss function of N images within its neighborhood.

[0087] Through label smoothing, set the γ term to improve the cross-entropy loss function, 0 < γ < 1, and use q to replace the original one-hot code. The formula is as follows:

[0088]

[0089] When the one-hot encoding is 1, q is 1 - γ, and when the one-hot encoding is 0, q is γ / (K - 1), where K is the number of label categories in the dataset. Taking the ImageNet1K dataset as an example, K = 1000.

[0090] The improved cross-entropy loss function is as follows:

[0091]

[0092] Among them, q is the one-hot encoding after label smoothing, p is the model output after softmax, p(k) is the probability that the model predicts the image as the k label, and p(y) is the probability that the model predicts the image as the true label.

[0093] The log function has base e.

[0094] For example:

[0095] If the dataset has a total of 3 classes and the original label of image x is y = 3, then the one-hot encoding y = [0, 0, 1], and after label smoothing, q is [γ / 2, γ / 2, 1 - γ]. After the image is input into the model and the output logit scores are activated by softmax, it becomes [a, b, c].

[0096] Then the value of the loss function is: -(1 - γ)log(c) - γ / 2 * log(a) - γ / 2 * log(b)

[0097] By specifying the parameter β, obtain the neighborhood of the image as where ε is the perturbation size in a single iteration.

[0098] Since the neighborhood is continuous, it is actually impossible to perform a weighted sum of the normal distribution (Gaussian distribution) on a continuous interval. Therefore, with the image as the center, that is select N images within its neighborhood (including ), and perform a weighted sum of the multi-step gradient information within the neighborhood of using the normal distribution. Since it is required to be centered on , N is required to be an odd number.

[0099] Input the N images within the neighborhood into the model to obtain the output, calculate the value of the improved cross-entropy loss function, and through backpropagation, obtain the gradient information of the N images within the neighborhood.

[0100] Step 7: Use the normal distribution (Gaussian distribution) function to perform a weighted sum of the gradient information within the neighborhood of the current image

[0101] The formula for the probability density function of the normal distribution (Gaussian distribution) is as follows:

[0102]

[0103] Within the neighborhood of the image take N pictures (including​ ), centered around the image , with the coordinate t as the center point and μ = 0. Set the value of σ and calculate the weights of the normal distribution. The formula is as follows:

[0104]

[0105] After normalizing the weights F(n), a one-dimensional Gaussian kernel F(n) is obtained.

[0106] Using the one-dimensional Gaussian kernel F(n) to perform weighted summation on the gradient information of N images in the neighborhood. The formula is as follows:

[0107]

[0108] where is the gradient information of the image calculated by the backpropagation of the loss function J after label smoothing , n ∈ [1, N]. θ is the weight parameter of the model and is not updated. q is the one-hot encoding after label smoothing.

[0109] Use to replace 's gradient information

[0110] Step8: Set the perturbation using the processed multi-step gradient information and update the image.

[0111] Combining the momentum idea in MI-FGSM to improve the generation speed and transferability of adversarial samples. The MI-FGSM formula is as follows:

[0112]

[0113] In each iteration, the current gradient is normalized by its own L1 distance (any distance metric is feasible) because the magnitudes of the gradients in different iterations vary in magnitude.

[0114] Use to replace 's gradient information

[0115] The FGMI-FGSM algorithm formula in the present invention is as follows:

[0116]

[0117]

[0118]

[0119]

[0120] Among them, is the gradient information of the image calculated by the backpropagation of the loss function J after label smoothing, where n ∈ [1, N]. θ is the weight parameter of the model and is not updated. q is the one-hot encoding after label smoothing. g is the gradient value accumulated in the previous t iterations, μ is the decay factor of the momentum term, and ε is the perturbation size. t The Clip function clips the image

[0121] to the range [0, 255]; L is the range of the important feature region of the image obtained based on Grad-CAM++ in Step3. The shape of L is the same as that of the image. A threshold min is set for judgment. The important range value is 1, and the unimportant range value is 0. L[L < min] = 0, L[L >= min] = 1; The Sign() function is the sign function. If the input is positive, the output result is 1. If the input is negative, the output result is -1. If the input is equal to zero, the result is 0. This step demonstrates a non-targeted attack. If a targeted attack is to be performed, the label Y of the targeted attack needs to be specified.

[0122] The formula is as follows:

[0123] The formula is as follows:

[0124]

[0125]

[0126] Step Step8 is the core part of the present invention and is the key technology to achieve the technical effects of the present invention. In order to reduce the L0 norm of the perturbation of the adversarial samples generated by the I-FGSM algorithm, the present invention applies the Grad-CAM++ algorithm to the attack process, and restricts the perturbation area, so as to achieve the purpose of reducing the L0 norm of the perturbation. In order to improve the transferability of the gradient-based white-box attack algorithm I-FGSM, the present invention uses the multi-step gradient information after weighted summation to replace the gradient information in the iterative attack process of I-FGSM in each iteration process, which solves the problem of the gradient information difference between the surrogate model and the target model in the iterative process to a certain extent, avoids the generated adversarial samples falling into a poor local maximum, and improves the transferability of the adversarial samples. At the same time, the idea of momentum and the idea of translational invariance are applied to the iterative process to further improve the generation speed of adversarial samples.

[0127] Since in the process of generating adversarial samples, the surface of the model loss function is not smooth and there are local oscillation phenomena. In the black-box attack environment, it will cause an error between the gradient information of the surrogate model and the gradient information of the target model, resulting in the overfitting of the adversarial samples to the surrogate model, thus affecting its transferability and reducing the success rate of the black-box attack.

[0128] To solve this problem, the present invention utilizes the normal distribution (Gaussian distribution) function to perform weighted summation processing on the gradient information of the loss function of N images within the image neighborhood. The processed result is used as its gradient value for perturbation calculation.

[0129] Among them, the attacked image is used to generate adversarial samples through T iterations of attacks. t is the t-th iteration, and t ∈ [0, T - 1]. When t = 0,

[0130] First, read the original image to be attacked (the image after preprocessing) as the input for the iteration when t = 0. By specifying the parameter β and the perturbation size ε in a single iteration, obtain the neighborhood of the image, which is

[0131] Input N images into the network model, and use the improved loss function to obtain the gradient information of the N images. Through formula (5), perform weighted summation on the gradient information of the N images within the neighborhood to obtain the processed gradient information. Replace the original gradient information with it as the input, and obtain the perturbation of the image through the idea of momentum accumulation. Limit the perturbation range, and superimpose the final perturbation on the image to obtain

[0132] Step9: Determine whether an adversarial sample is successfully generated or the maximum number of iterations is reached.

[0133] Judgment conditions:

[0134] 1. In the white-box attack environment, determine whether an adversarial sample is successfully generated. If successful, output the adversarial sample; otherwise, return to Step6 and use as the input for the next iteration and continue to add perturbations to it. Keep adding perturbations until an adversarial sample is successfully generated or the maximum number of iterations is reached, and then exit the loop.

[0135] Successfully generating an adversarial sample means a successful white-box attack; otherwise, it is a failed white-box attack.

[0136] The conditions for successfully generating an adversarial sample are: (1) The label of the adversarial sample is not equal to the label of the original image and the total number of iterative attacks is less than or equal to T.

[0137] The conditions for failing to generate an adversarial sample are: (1) After T rounds of iterative attacks and the label of the adversarial sample is equal to the label of the original image.

[0138] 2. In the black-box attack environment, since this proposal is a transfer attack, T rounds of iterative attacks are performed through a surrogate model to generate adversarial examples. Then, the target model is attacked to determine whether the black-box attack is successful.

[0139] The conditions for generating adversarial examples are: (1) The T-round iterative attack ends.

[0140] The conditions for determining a successful black-box attack are: (1) Input the adversarial examples generated using the surrogate model into the target model, and the output label is inconsistent with the original label of the image.

[0141] The conditions for determining a failed black-box attack are: (1) Input the adversarial examples generated using the surrogate model into the target model, and the output label is consistent with the original label of the image.

[0142] Next, the method described in Embodiment 1 of the present invention is verified:

[0143] (1) Using the ImageNet dataset, under white-box conditions, different attack algorithms are used to attack the ResNet34 model to generate adversarial examples, and the effects are as follows:

[0144] When attacking with the FGMI-FGSM algorithm of the present invention, as shown in Figure 4(a), the perturbation L0 norm is approximately 2%, and the effects are as follows:

[0145] Image Size 150528Shape(1, 224, 224, 3)

[0146] NoiseL_⊙norm: 31112.07%

[0147] The attack with the I-FGSM algorithm is as follows. As shown in Figure 4(b), the L0 norm is 88%:

[0148] ImageSize 150528Shape(1, 224, 224, 3)

[0149] NoiseL-0 norm: 1323⊙787.90%

[0150] (2) Using the lmageNet dataset, under black-box conditions, 100 images from the lmageNet1K validation dataset are randomly selected for black-box attack experiments. The image classification model ResNet18 is used as the surrogate model, and the FGMI-FGSM algorithm of the present invention is used for transfer attack on the VGG16 model.

[0151] The experimental results are as follows:

[0152] Black-Attack-Agg16: SuccessfulAttacks = 51.⊙%

[0153] NoiseL_⊙norm = 3.18961256377551%

[0154] As shown in the experimental results, the success rate of the black-box attack is about 51%. At the same time, the average perturbation L0 norm of the generated adversarial samples is controlled at about 3.2%.

[0155] Using the ImageNet dataset, under the black-box condition, 100 images from the ImageNet1K validation dataset were randomly selected for the black-box attack experiment. The image classification model ResNet18 was used as the surrogate model, and the I-FGSM algorithm in Foolbox was used to transfer the attack to the VGG16 model.

[0156] The experimental results are as follows:

[0157] Black-Attack-Agg16: SuccessfulAttacks = 22.0%

[0158] Noise L-0norm = 79.70057518746134%

[0159] As shown in the experimental results, the success rate of the black-box attack is about 22%. At the same time, the average perturbation L0 norm of the generated adversarial samples is controlled at about 80%.

[0160] (3) Using the ImageNet dataset, under the black-box condition, 100 images from the ImageNet1K validation dataset were randomly selected for the black-box attack experiment. The image classification model Inception_v3 was used as the surrogate model, and the FGMI-FGSM algorithm of the present invention was used to transfer the attack to the ResNet18, VGG16, Inception_v4 and ResNet101 models.

[0161] The experimental results are as follows:

[0162] Black-Attack-Resnet18: Successful Attacks = 69.11764705882352%

[0163] Black-Attack-Agg16: Successful Attacks = 72.05882352941177%

[0164] Black-Attack-inv4: Successful Attacks = 88.23529411764706%

[0165] Black-Attack-Resnet1⊙1: Successful Attacks = 30.88235294117647%

[0166] Noise L_⊙norm = 3.544197757227891%

[0167] Using the ImageNet dataset, under the black-box condition, 100 images from the ImageNet1K validation dataset were randomly selected for black-box attack experiments. The image classification model Inception_v3 was used as the surrogate model, and the I-FGSM algorithm in FoolBox was used to transfer and attack the ResNet18, VGG16, Inception_v4, and ResNet101 models.

[0168] The experimental results are as follows:

[0169] Black-Attack-Resnet18: Successful Attacks = 13.0%

[0170] Black-Attack-Agg16: Successful Attacks = 15.0%

[0171] Black-Attack-inv4: Successful Attacks = 12.0%6

[0172] Black-Attack-Resnet1⊙1: Successful Attacks = 8.0%

[0173] Noise L_0norm = 76.78072518069727%

[0174] Using the ImageNet dataset, under the black-box condition, 100 images from the ImageNet1K validation dataset were randomly selected for black-box attack experiments. The image classification model Inception_v3 was used as the surrogate model, and the MI-FGSM algorithm was used to transfer and attack the ResNet18, VGG16, Inception_v4, and ResNet101 models.

[0175] The experimental results are as follows:

[0176] Black-Attack-Resnet18: SuccessfulAttacks = 36.84210526315789%

[0177] Black-Attack-Agg16: Successful Attacks = 44.21 ⊙ 52631578947%

[0178] Black-Attack-inv4: Successful Attacks = 45.26315789473684%

[0179] Black-Attack-Resnet1⊙1: Successful Attacks = 25.263157894736842%

[0180] Noise L⊙norm = 90.29061038477892%

[0181] Experimental comparison:

[0182]

[0183] Among them, those with * are white-box attacks on the Inc-v3 model, and the rest are black-box attacks using the Inc-v3 as the surrogate model.

[0184] Example 2

[0185] This example discloses a multi-step gradient adversarial sample generation system based on features and label smoothing.

[0186] As shown in Figure 4, the multi-step gradient adversarial sample generation system based on features and label smoothing includes:

[0187] Attacked image acquisition module, configured to: acquire an image, preprocess the image to obtain the attacked image;

[0188] Parameter setting and important feature region acquisition module, configured to: set attack parameters, extract the attention region of the model for the attacked image based on the Grad-CAM++ algorithm, and obtain the important feature region of the attacked image;

[0189] Loss function gradient information acquisition module for N images, configured to: introduce the idea of label smoothing, improve the cross-entropy loss function of the network model to obtain the improved cross-entropy loss function, take the attacked image as the center, select N images in the neighborhood of the attacked image, input the N images into the network model to get the output, calculate the loss function value based on the improved cross-entropy loss function, and obtain the loss function gradient information of the N images in the neighborhood through backpropagation of the loss function;

[0190] The image gradient acquisition module after multi-step gradient weighted summation is configured to: use the normal distribution function to perform weighted summation on the loss function gradient information of N images in the neighborhood to obtain the image gradient after multi-step gradient weighted summation;

[0191] The perturbation generation module is configured to: generate a perturbation for the important feature region of the attacked image based on the image gradient after multi-step gradient weighted summation;

[0192] The image perturbation addition module is configured to: add a perturbation to the attacked image to generate an image after the perturbation is added;

[0193] The adversarial sample acquisition module is configured to: determine whether the image after the perturbation is added is successfully attacked or reaches the maximum number of iterations. If the attack is successful or the maximum number of iterations is reached, an adversarial sample is generated.

[0194] Embodiment III

[0195] The purpose of this embodiment is to provide a computer-readable storage medium.

[0196] A computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, it implements the steps in the multi-step gradient adversarial sample generation method based on feature and label smoothing described in Embodiment 1 of the present disclosure.

[0197] Embodiment IV

[0198] The purpose of this embodiment is to provide an electronic device.

[0199] An electronic device, including a memory, a processor, and a program stored on the memory and executable on the processor. When the processor executes the program, it implements the steps in the multi-step gradient adversarial sample generation method based on feature and label smoothing described in Embodiment 1 of the present disclosure.

[0200] The steps involved in the apparatuses in Embodiments II, III, and IV above correspond to those in Method Embodiment 1. For specific implementation manners, reference may be made to the relevant description part of Embodiment 1. The term "computer-readable storage medium" should be understood to include a single medium or multiple media including one or more instruction sets; it should also be understood to include any medium that can store, encode, or carry an instruction set for execution by a processor and enable the processor to execute any method in the present invention.

[0201] Those skilled in the art should understand that the above-mentioned modules or steps of the present invention can be implemented by a general-purpose computer device. Optionally, they can be implemented by program codes executable by a computing device, so that they can be stored in a storage device and executed by the computing device, or they can be separately fabricated into individual integrated circuit modules, or multiple modules or steps among them can be fabricated into a single integrated circuit module for implementation. The present invention is not limited to any specific combination of hardware and software.

[0202] Although the specific implementation manners of the present invention have been described above in conjunction with the accompanying drawings, it is not a limitation to the protection scope of the present invention. Those skilled in the art should understand that based on the technical solution of the present invention, various modifications or deformations that can be made by those skilled in the art without creative efforts are still within the protection scope of the present invention.

Claims

1. A multi-step gradient adversarial sample generation method based on feature and label smoothing, characterized in that It includes the following steps: Step 1: Obtain an image, preprocess the image, and obtain the attacked image; Step 2: Set the attack parameters, extract the attention area of the model for the attacked image based on the Grad-CAM++ algorithm, and obtain the important feature area of the attacked image; Step 3: Introduce the label smoothing idea, improve the cross-entropy loss function of the network model to obtain the improved cross-entropy loss function. Centering on the attacked image, select N images in the neighborhood of the attacked image, input the N images into the network model to get the output, calculate the loss function value based on the improved cross-entropy loss function, and obtain the gradient information of the loss function of the N images in the neighborhood through backpropagation of the loss function; The improved cross-entropy loss function is: where q is the label encoding after label smoothing, p is the output of the model after softmax, p(k) is the probability that the model predicts the image as the k label, and p(y) is the probability that the model predicts the image as the true label; Step 4: Use the normal distribution function to perform weighted summation on the gradient information of the loss function of the N images in the neighborhood to obtain the image gradient after multi-step gradient weighted summation; Step 5: Generate a perturbation for the important feature area of the attacked image based on the image gradient after multi-step gradient weighted summation; Step 6: Add the perturbation to the attacked image to generate the image after adding the perturbation; Step 7: Determine whether the image after adding the perturbation is successfully attacked or reaches the maximum number of iterations. If it is successfully attacked or reaches the maximum number of iterations, the generation of the adversarial sample is successful; if not, use the image after adding the perturbation as the new attacked image and loop through the above steps 3 to 7.

2. The multi-step gradient adversarial sample generation method based on feature and label smoothing according to claim 1, wherein, Preprocess the image, specifically including: Normalize or standardize the pixel range of the image [0, 255], and control the pixel value within [0, 1] to obtain the attacked image.

3. The multi-step gradient adversarial sample generation method based on feature and label smoothing as described in claim 1, wherein Through label smoothing, set the γ term to improve the loss function, 0 < γ < 1, and use q to replace the original one-hot code. The formula is: When the one-hot encoding is 1, q is 1 - γ, and when the one-hot encoding is 0, q is γ / (K - 1), where K is the number of label categories in the dataset.

4. The multi-step gradient adversarial sample generation method based on feature and label smoothing as claimed in claim 1, wherein Introduce the momentum idea, and generate a perturbation for the important feature area of the attacked image based on the image gradient after multi-step gradient weighted summation. The algorithm formula for non-directed attack is: Among them, is the gradient information of the image calculated by the backpropagation of the loss function J after label smoothing, where n ∈ [1, N]; θ is the weight parameter of the model and is not updated; q is the one-hot encoding after label smoothing; g is the gradient value accumulated in the previous t rounds of iterations, μ is the decay factor of the momentum term, and ε is the perturbation size. t ​ 5. The multi-step gradient adversarial sample generation method based on feature and label smoothing as claimed in claim 4, wherein When performing a directed attack, specify the label Y of the directed attack. The algorithm formula is:

6. The multi-step gradient adversarial sample generation method based on feature and label smoothing according to claim 1, wherein Determine whether the image after adding the perturbation is successfully attacked or reaches the maximum number of iterations. If it is successfully attacked or reaches the maximum number of iterations, generate the adversarial sample. Specifically: In the white-box attack environment, the condition for successful generation of the adversarial sample is: input the image after adding the perturbation into the attacked model to obtain the label of the perturbed image, and determine that the label of the perturbed image is not equal to the label of the attacked image and the total number of iterative attacks is less than or equal to the set maximum number of iterations; In the black-box attack environment, the condition for generating the adversarial sample is: output the adversarial sample after the set maximum number of iterations ends.

7. A multi-step gradient adversarial sample generation system based on feature and label smoothing, characterized in that: It includes: An attacked image acquisition module, configured to: obtain an image, preprocess the image, and obtain the attacked image; The parameter setting and important feature region acquisition module is configured to: set the attack parameters, extract the attention region of the model for the attacked image based on the Grad-CAM++ algorithm, and obtain the important feature region of the attacked image; The loss function gradient information acquisition module for N images is configured to: introduce the label smoothing idea, improve the cross-entropy loss function of the network model to obtain the improved cross-entropy loss function. Centered on the attacked image, select N images within the neighborhood of the attacked image, input the N images into the network model to obtain the output, calculate the loss function value based on the improved cross-entropy loss function, and obtain the loss function gradient information of the N images within the neighborhood through the backpropagation of the loss function; The improved cross-entropy loss function is: where q is the label encoding after label smoothing, p is the output of the model after softmax, p(k) is the probability that the model predicts the image as the k label, and p(y) is the probability that the model predicts the image as the true label; The image gradient acquisition module after multi-step gradient weighted summation is configured to: use the normal distribution function to perform weighted summation on the loss function gradient information of N images within the neighborhood to obtain the image gradient after multi-step gradient weighted summation; The perturbation generation module is configured to: generate a perturbation for the important feature region of the attacked image based on the image gradient after multi-step gradient weighted summation; The image perturbation addition module is configured to: add a perturbation to the attacked image to generate an image with the perturbation added; The adversarial sample acquisition module is configured to: determine whether the image with the perturbation added is successfully attacked or reaches the maximum number of iterations. If it is successfully attacked or reaches the maximum number of iterations, an adversarial sample is generated.

8. A computer-readable storage medium having a program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps in the multi-step gradient adversarial sample generation method based on features and label smoothing as described in any one of claims 1-6.

9. An electronic device, comprising a memory, a processor, and a program stored on the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps in the multi-step gradient adversarial sample generation method based on features and label smoothing as described in any one of claims 1-6.

Images