A method, system and device for generating adversarial samples based on CAM
By using a CAM-based adversarial example generation method, the image feature importance distribution matrix is calculated and combined with a feature transformation model to generate high-quality adversarial examples. This solves the problems of high noise and poor transferability of the fast gradient symbolic method, and improves the robustness and attack success rate of deep neural networks.
Patent Information
- Application Number
- CN202310398199.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2023-04-14
- Publication Date
- 2026-02-10
- Estimated Expiration
- 2043-04-14
AI Technical Summary
In existing technologies, adversarial examples generated by the fast gradient sign method have large noise and are prone to overfitting, lack transferability, and are difficult to effectively improve the robustness of deep neural networks.
A CAM-based adversarial example generation method is adopted. By calculating the importance distribution matrix of image features, fine-tuning the perturbation data, and combining feature transformation models and iterative optimization, high-quality adversarial examples are generated.
It improves the speed and accuracy of adversarial example generation, enhances the success rate of attacks on different classifiers, obtains stable image gradients, and improves the practicality of adversarial examples.
Smart Images
Figure CN116486201B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of machine learning technology, and more specifically, to a method, system, and apparatus for generating adversarial examples based on machine learning (CAM). Background Technology
[0002] Deep neural networks, as a type of multi-layer unsupervised neural network, perform well in computer vision tasks such as image classification, object detection, and semantic segmentation. However, current research has revealed that deep neural networks are vulnerable; applying moderate perturbations to samples can effectively compromise the accuracy of deep neural network classifiers. These samples that may cause misclassification are called adversarial examples. Researching adversarial examples can effectively assist in the retraining and / or optimization of existing deep neural network classifiers, improving the robustness of deep neural networks.
[0003] Fast gradient signification (FCL) is a commonly used method for generating adversarial examples, capable of quickly obtaining them. However, adversarial examples obtained using FCL are often noisy. To address this issue, existing techniques iterate FCL to generate more refined perturbations. However, the adversarial examples obtained after iteration are prone to overfitting, are only effective for current deep neural network classifiers, and lack transferability. Summary of the Invention
[0004] To improve the efficiency and perturbation accuracy of adversarial example generation, this invention provides a CAM-based adversarial example generation method, which includes:
[0005] The sample collection steps include: obtaining an original sample image, classifying the original sample image, and obtaining first data;
[0006] The sample processing steps include: preprocessing the original sample image to obtain a first image;
[0007] Traverse the first image, calculate the class activation map for each first image, and obtain the corresponding second data, which is an importance distribution matrix used to describe the image features in the first image;
[0008] Countermeasures against attacks include:
[0009] Iterate through the first image, and for each first image, obtain the first perturbation data corresponding to the first image according to the neural network model;
[0010] Based on the first disturbance data corresponding to the second data processing, the second disturbance data is obtained;
[0011] The second image is obtained by processing the first image corresponding to the second disturbance data.
[0012] The principle of this method is as follows: after obtaining the original sample image and performing preprocessing, the class activation map corresponding to the image is calculated respectively, and the importance distribution matrix of the image features in each image is obtained respectively; the perturbation data is processed according to the importance distribution matrix to obtain the second perturbation data corresponding to the important part of the image features; finally, the processed second perturbation data is added to the image based on the fast gradient sign method to obtain adversarial examples.
[0013] Furthermore, after obtaining adversarial examples, the same adversarial example may have different attack effects on different classifiers. To ensure that the adversarial example successfully attacks the classifier, the CAM-based adversarial example generation method further includes:
[0014] The attack verification steps include: Step 1: Build a classifier and obtain the second image, classify the second image according to the classifier, and obtain third data;
[0015] Step 2: Obtain the first data, determine whether the third data is the same as the first data, if not, obtain an adversarial sample; if so, update the first image according to the second image, and return to execute the adversarial attack step. Thus, by continuing to add perturbation data to samples that fail to be attacked, the success rate of adversarial samples attacking different classifiers is improved.
[0016] Furthermore, since the second data is an importance distribution matrix describing the image features in the first image, in order to obtain the second perturbation data corresponding to the important parts of the image features, the adversarial attack step processes the first perturbation based on the second data to obtain the second perturbation specifically as follows:
[0017] Iterate through the second data, and for each piece of the second data, perform statistics based on the size of each element in the second data to obtain the statistical results;
[0018] Based on the statistical results, the second data is segmented to obtain the fourth data.
[0019] Based on the first disturbance data corresponding to the fourth data processing, the second disturbance data is obtained.
[0020] Furthermore, in the adversarial attack step, the first image corresponding to the second perturbation data is processed to obtain the second image, specifically as follows:
[0021] The disturbance direction is calculated based on the second-order moment estimate and the first-order moment estimate to obtain the fifth data.
[0022] The attenuation step size is calculated based on the second perturbation data, and the first image is iteratively processed based on the fifth data and the attenuation step size to obtain the second image.
[0023] Furthermore, in order to obtain stable image gradients when classifying images, corresponding perturbations are added to the image gradients to improve the accuracy of adversarial example generation. When iterating the first image, the first-order moment estimate is updated for each iteration in the following way:
[0024]
[0025] Where t represents the number of iterations. The cumulative gradient of the image is β1, where β1 is the exponential decay rate. This is the first-order moment estimate of the bias correction before the update in the t-th iteration. This is the updated first-order moment estimate of the bias correction in the t-th iteration.
[0026] Furthermore, to improve the accuracy of adversarial example generation, during iterative processing of the first image, the image samples are updated for each iteration in the following manner:
[0027]
[0028] Where t is the number of iterations. For the updated image sample in the t-th iteration, Let α be the image sample before the update in the t-th iteration. t Let μ be the step size of the t-th iteration, and μ represent the decay factor. This is the updated bias-corrected first-order moment estimate in the t-th iteration. Let δ be the bias-corrected second-order moment estimate after introducing the belief parameter in the t-th iteration, where δ is a constant.
[0029] Furthermore, to improve the quality of adversarial examples, before processing the first image corresponding to the second perturbation data in the adversarial attack step, a feature transformation model is established, and the first image is transformed according to the feature transformation model. The feature transformation model includes a random flip sub-model, a random translation sub-model, a random rotation sub-model, and a random scale sub-model. Each of the random flip sub-model, random translation sub-model, random rotation sub-model, and random scale sub-model corresponds to a different probability of effectiveness. After performing the above four feature transformations on the first image, the loss brought by each feature transformation sub-model is calculated to obtain the corresponding image gradient. The updated first image is obtained by weighted averaging of the above image gradients, thereby expanding the original sample and improving the quality of generated adversarial examples.
[0030] To achieve the above objectives, the present invention also provides a CAM-based adversarial example generation system, the system comprising:
[0031] The sample acquisition unit is used to: acquire an original sample image, classify the original sample image, and obtain first data;
[0032] The sample processing unit is used to: preprocess the original sample image to obtain a first image;
[0033] Traverse the first image, calculate the class activation map for each first image, and obtain the corresponding second data, which is an importance distribution matrix used to describe the image features in the first image;
[0034] Counter-attack unit, used for:
[0035] Traverse the first image and obtain the corresponding first perturbation data based on each first image and neural network model;
[0036] Based on the first disturbance data corresponding to the second data processing, the second disturbance data is obtained;
[0037] The second image is obtained by processing the first image corresponding to the second disturbance data.
[0038] The principle of this system is as follows: after obtaining the original sample image and performing preprocessing, the sample processing unit calculates the class activation map corresponding to the image and obtains the importance distribution matrix of the image features in each image. The adversarial attack unit processes the perturbation data according to the importance distribution matrix to obtain the second perturbation data corresponding to the important part of the image features. Finally, the processed second perturbation data is added to the image to obtain the adversarial sample.
[0039] To achieve the above objectives, the present invention also provides a CAM-based adversarial example generation apparatus, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements any of the steps of the CAM-based adversarial example generation method described above.
[0040] The present invention provides one or more technical solutions, which have at least the following technical effects or advantages: after obtaining the original sample image and performing preprocessing, the class activation map corresponding to the image is calculated respectively, the second perturbation data corresponding to the important parts in the image features is obtained, and finally the processed second perturbation data is added to the image, which improves the generation speed and perturbation accuracy of adversarial examples; by updating the image sample and the first moment estimate corresponding to the image sample, a stable image gradient is obtained, which improves the attack success rate of adversarial examples and has good practicality. Attached Figure Description
[0041] The accompanying drawings, which are provided to further illustrate embodiments of the invention and constitute a part of this invention, are not intended to limit the scope of the invention.
[0042] Figure 1 This is a schematic diagram of the CAM-based adversarial sample generation method in this invention;
[0043] Figure 2 This is a schematic diagram of the CAM-based adversarial sample generation system structure in this invention;
[0044] Figure 3 This is a schematic diagram showing the distribution of importance of image features in this invention. Detailed Implementation
[0045] To better understand the above-mentioned objectives, features, and advantages of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be noted that, where there is no conflict, the embodiments of the present invention and the features thereof can be combined with each other.
[0046] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and therefore the scope of protection of the invention is not limited to the specific embodiments disclosed below.
[0047] Example 1
[0048] Please refer to Figures 1-2 Embodiment 1 of the present invention provides a method for generating adversarial examples based on CAM, characterized in that the adversarial example generation method includes:
[0049] The sample collection steps include: obtaining an original sample image, classifying the original sample image, and obtaining first data;
[0050] The sample processing steps include: preprocessing the original sample image to obtain a first image;
[0051] Traverse the first image, calculate the class activation map for each first image, and obtain the corresponding second data, which is an importance distribution matrix used to describe the image features in the first image;
[0052] Countermeasures against attacks include:
[0053] Iterate through the first image, and for each first image, obtain the first perturbation data corresponding to the first image according to the neural network model;
[0054] Based on the first disturbance data corresponding to the second data processing, the second disturbance data is obtained;
[0055] The second image is obtained by processing the first image corresponding to the second disturbance data.
[0056] The first disturbance data includes the disturbance direction and the disturbance step size, which are determined according to actual needs and are not specifically limited in this embodiment.
[0057] The preprocessing of the original sample image includes grayscale transformation, geometric correction, image enhancement, or image filtering. The specific steps for preprocessing the original sample image are determined according to actual needs, and this embodiment does not impose specific limitations on them.
[0058] Among them, Class Activation Map (CAM) is an image classification visualization algorithm used in convolutional neural networks. Because convolutional neural networks employ transfer learning, the convolutional layers are frozen and fixed. Therefore, for the same image, the output features of the convolutional layers remain unchanged. The classifier's classification of images is essentially based on a weighted sum of the feature map sets. The Class Activation Map calculates the product of the feature map set and the weight matrix to determine which regions the classifier uses for classification. In this embodiment, the Class Activation Map for each first image is calculated to obtain corresponding second data, which is an importance distribution matrix describing the image features in the first image.
[0059] In this embodiment, the adversarial example generation method based on CAM further includes:
[0060] The attack verification steps include: Step 1: Build a classifier and obtain the second image, classify the second image according to the classifier, and obtain third data;
[0061] Step 2: Obtain the first data, determine whether the third data is the same as the first data, if not, obtain the adversarial sample; if so, update the first image according to the second image, and return to execute the adversarial attack step.
[0062] In this embodiment, the step of countering attacks, which involves processing the first perturbation based on the second data to obtain the second perturbation, specifically involves:
[0063] Iterate through the second data, and for each piece of the second data, perform statistics based on the size of each element in the second data to obtain the statistical results;
[0064] Based on the statistical results, the second data is segmented to obtain the fourth data.
[0065] Based on the first disturbance data corresponding to the fourth data processing, the second disturbance data is obtained.
[0066] The second data is an importance distribution matrix describing the image features in the first image. Each element in the matrix corresponds to a pixel in the first image, and each element describes the importance score of the corresponding pixel. After statistically analyzing the value of each element in the second data, the statistical result represents the proportion of the importance distribution of image features in the first image.
[0067] In this embodiment, a threshold is first set, and the importance score of each pixel in the statistical results is determined to be related to the threshold to obtain fourth data. The fourth data includes a first set of pixels with importance scores greater than the threshold and a second set of pixels with importance scores less than or equal to the threshold. Based on the fourth data, corresponding first perturbation data is processed to obtain second perturbation data, which is a perturbation applied to the first set of pixels. Specifically, when attacking the image based on the second perturbation data, perturbation is only applied to pixels in the first set of pixels, not to pixels in the second set of pixels, ensuring a successful attack while reducing the noise level in the adversarial example.
[0068] The threshold can be determined based on the mean, median or mode of the statistical results. The specific setting method of the threshold is not specifically limited in this embodiment.
[0069] In a more preferred embodiment, the method for segmenting the second data according to the statistical results to obtain the fourth data is as follows: the pixels in the first image are divided into m segments according to the importance score of each pixel in the first image, and n data transition points are obtained in the above segmentation. The data transition point corresponds to the importance score, indicating that the number of pixels with an importance score less than the score and the number of pixels with an importance score greater than the score are significantly different. The n data transition points divide the second data into n+1 score intervals.
[0070] The specific method for processing the corresponding first perturbation data to obtain the second perturbation data is as follows: obtain the pixels of the feature importance score in the (n+1)th score interval to obtain the (n+1)th pixel set;
[0071] Traverse the n+1 pixel sets, determine the perturbation size for each pixel set, and finally obtain the second perturbation data. That is, when attacking the image based on the second perturbation data, the perturbation size is different for pixels belonging to different pixel sets. The specific perturbation size is determined according to actual needs, and this embodiment does not make a specific limitation here.
[0072] For example, please refer to a sample image. Figure 3 , Figure 3 This represents the importance distribution of each pixel's image feature in the sample image. Figure 3 The horizontal axis represents the pixels in the sample image. Figure 3 The vertical axis represents the feature importance score corresponding to each pixel in the sample image. Specifically, in this sample image, 25% of the pixels have an importance score range of 0-100, 50% have an importance score range of 0-500, 75% have an importance score range of 0-1000, and 100% have an importance score range of 0-2000. Therefore, points with feature scores of 500 and 1000 are used as transition points in the statistical results corresponding to this sample image. These transition points divide the second data corresponding to this sample image into three segments with feature scores of 0-500, 500-1000, and 1000-2000. For pixels with a feature importance score of 0-500, no perturbation is added; for pixels with a feature importance score of 500-1000, partial perturbation is added; and for pixels with a feature importance score of 1000-2000, full perturbation is added. The specific perturbation magnitude is determined according to actual needs, and this embodiment does not impose specific limitations on it.
[0073] In this embodiment, before processing the first image corresponding to the second perturbation data in the adversarial attack step, a feature transformation model is further established, and the second image is transformed according to the feature transformation model. The feature transformation model includes a random flip sub-model, a random translation sub-model, a random rotation sub-model, and a random scale sub-model. Each of the random flip sub-model, the random translation sub-model, the random rotation sub-model, and the random scale sub-model has a different probability of effectiveness.
[0074] The random flipping sub-model is used to flip the second image, and the specific processing method is as follows:
[0075]
[0076] in, This refers to the random flipping sub-model. Represents the original image. p1 represents the image after flipping, and p1 represents the probability of the random flipping sub-model taking effect.
[0077] The random translation sub-model is used to translate the second image by d pixels and to perform padding on the cropped image to maintain the original image size. The specific processing method is as follows:
[0078]
[0079] in, This represents the random translation sub-model. Represents the original image. Let d represent the translated image, d represent the translation distance, and p2 represent the probability of the random translation sub-model taking effect.
[0080] The random scaling sub-model is used to adjust the scale of the second image randomly. It enlarges or reduces each pixel in the second image with a probability of p3 from the input image. The specific processing method is as follows:
[0081]
[0082] in, This represents the random scaling sub-model. Represents the original image. p3 represents the image after scaling, n represents the magnification or reduction factor, and p3 represents the probability of the random scaling sub-model taking effect.
[0083] The random rotation sub-model is used to rotate the second image along its center, and the specific processing method is as follows:
[0084]
[0085] in, This represents the random rotation sub-model. Represents the original image. Let represent the rotated image, 'a' represent the image rotation angle, and 'p4' represent the probability of the random rotation sub-model taking effect.
[0086] For the image updated by the feature transformation model, its corresponding image gradient g t for:
[0087]
[0088] in, S represents the original image. i Let represent the i-th seed model in the feature transformation model, L represent the loss value corresponding to the image after the feature transformation model is updated, and y represent the classification result of the classifier for the image.
[0089] Example 2
[0090] Please refer to Figure 1 Embodiment 2 of the present invention provides a method for generating adversarial examples based on CAM. Building upon Embodiment 1, the adversarial attack step involves processing the first image corresponding to the second perturbation data to obtain the second image, specifically as follows:
[0091] The disturbance direction is calculated based on the second-order moment estimate and the first-order moment estimate to obtain the fifth data.
[0092] The attenuation step size is calculated based on the second perturbation data, and the first image is iteratively processed based on the fifth data and the attenuation step size to obtain the second image.
[0093] The second data includes the disturbance limit value, the iteration number limit value, and the step size decay rate. The specific values are determined according to actual needs, and this embodiment does not make specific limitations here.
[0094] In this embodiment, when iteratively processing the first image, the first-order moment estimate is updated for each iteration in the following manner:
[0095]
[0096] Where t represents the number of iterations. The cumulative gradient of the image is β1, where β1 is the exponential decay rate. This is the bias correction moment estimate before the update in the t-th iteration. This is the updated first-order moment estimate of the bias correction in the t-th iteration.
[0097] In this embodiment, when iteratively processing the first image, the image samples are updated for each iteration in the following manner:
[0098]
[0099] Where t is the number of iterations. For the updated image sample in the t-th iteration, Let α be the image sample before the update in the t-th iteration. t Let μ be the step size of the t-th iteration, and μ represent the decay factor. This is the updated bias-corrected first-order moment estimate in the t-th iteration. Let δ be the bias-corrected second-order moment estimate after introducing the belief parameter in the t-th iteration, where δ is a constant.
[0100] Example 3
[0101] Please refer to Figures 1-2 Embodiment 3 of the present invention provides an adversarial example generation system based on CAM, the system comprising:
[0102] The sample acquisition unit is used to: acquire an original sample image, classify the original sample image, and obtain first data;
[0103] The sample processing unit is used to: preprocess the original sample image to obtain a first image;
[0104] Traverse the first image, calculate the class activation map for each first image, and obtain the corresponding second data, which is an importance distribution matrix used to describe the image features in the first image;
[0105] Counter-attack unit, used for:
[0106] Traverse the first image and obtain the corresponding first perturbation data based on each first image and neural network model;
[0107] Based on the first disturbance data corresponding to the second data processing, the second disturbance data is obtained;
[0108] The second image is obtained by processing the first image corresponding to the second disturbance data.
[0109] Example 4
[0110] Please refer to Figure 1 Embodiment 4 of the present invention provides an adversarial sample generation device based on CAM, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements any one of the steps of the CAM-based adversarial sample generation method described above.
[0111] The processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.
[0112] The memory can be used to store the computer program and / or modules. The processor implements the various steps of the CAM-based adversarial sample generation method of the invention by running or executing the data stored in the memory. The memory may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc. In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, RAM, plug-in hard disk, smart memory card, secure digital card, flash memory card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.
[0113] If the CAM-based adversarial sample generation device is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of the present invention can also be implemented by storing a computer program in a computer-readable storage medium. When executed by a processor, this computer program can implement the steps of the various method embodiments described above. The computer program includes computer program code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory, random access memory, dot carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction.
[0114] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.
[0115] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.
Claims
1. A method for generating adversarial examples based on CAM, characterized in that, The adversarial example generation method includes: The sample collection steps include: obtaining an original sample image, classifying the original sample image, and obtaining first data; The sample processing steps include: preprocessing the original sample image to obtain a first image; Traverse the first image, calculate the class activation map for each first image, and obtain the corresponding second data, which is an importance distribution matrix used to describe the image features in the first image; Countermeasures against attacks include: Iterate through the first image, and for each first image, obtain the first perturbation data corresponding to the first image according to the neural network model; Iterate through the second data, and for each second data, perform statistics based on the size of each element in the second data to obtain statistical results that represent the importance distribution ratio of image features in the first image; Based on the statistical results, the second data is segmented and the first perturbation data is processed to obtain the second perturbation data; Based on the first image corresponding to the second disturbance data, a second image is obtained; The method for segmenting the second data and processing the first perturbation data according to the statistical results to obtain the second perturbation data is as follows: setting a threshold, judging the relationship between the importance score of each pixel in the statistical results and the threshold, and if the importance score is less than the threshold, setting the corresponding perturbation in the first perturbation data to 0 to obtain the second perturbation data; Alternatively: Divide the pixels in the first image into m segments based on the importance score of each pixel in the first image, obtain n data transition points in the above segments, and divide the second data into n+1 score intervals based on the n data transition points. Set the corresponding perturbation size in the first perturbation data according to the score intervals to obtain the second perturbation data.
2. The CAM-based adversarial example generation method according to claim 1, characterized in that, The adversarial example generation method further includes: The attack verification steps include: Step 1: Build a classifier and obtain the second image, classify the second image according to the classifier, and obtain third data; Step 2: Obtain the first data, determine whether the third data is the same as the first data, if not, obtain the adversarial sample; if so, update the first image according to the second image, and return to execute the adversarial attack step.
3. The CAM-based adversarial example generation method according to claim 1, characterized in that, The process of processing the first image corresponding to the second perturbation data in the counter-attack step to obtain the second image specifically involves: The disturbance direction is calculated based on the second-order moment estimate and the first-order moment estimate to obtain the fifth data. The attenuation step size is calculated based on the second perturbation data, and the first image is iteratively processed based on the fifth data and the attenuation step size to obtain the second image.
4. The CAM-based adversarial example generation method according to claim 3, characterized in that, When iteratively processing the first image, the first-order moment estimate is updated for each iteration in the following manner: Where t represents the number of iterations. Accumulate gradients for the image. The exponential decay rate, This is the first-order moment estimate of the bias correction before the update in the t-th iteration. This is the updated first-order moment estimate of the bias correction in the t-th iteration.
5. The CAM-based adversarial example generation method according to claim 4, characterized in that, When iteratively processing the first image, the image samples are also updated for each iteration in the following manner: Where t is the number of iterations. For the updated image sample in the t-th iteration, For the image sample before the update in the t-th iteration, Let be the step size of the t-th iteration. Indicates the attenuation factor. This is the updated bias-corrected first-order moment estimate in the t-th iteration. The bias-corrected second-moment estimate after introducing the belief parameter in the t-th iteration. It is a constant.
6. The adversarial example generation method based on CAM according to claim 1, characterized in that, In the adversarial attack step, before processing the first image corresponding to the second perturbation data, a feature transformation model is further established, and the first image is transformed according to the feature transformation model. The feature transformation model includes a random flip sub-model, a random translation sub-model, a random rotation sub-model, and a random scale sub-model.
7. The CAM-based adversarial example generation method according to claim 6, characterized in that, The random flipping sub-model, the random translation sub-model, the random rotation sub-model, and the random scaling sub-model each have different probabilities of effectiveness.
8. A CAM-based adversarial example generation system, characterized in that, The system includes: The sample acquisition unit is used to: acquire an original sample image, classify the original sample image, and obtain first data; The sample processing unit is used to: preprocess the original sample image to obtain a first image; Traverse the first image, calculate the class activation map for each first image, and obtain the corresponding second data, which is an importance distribution matrix used to describe the image features in the first image; Counter-attack unit, used for: Traverse the first image and obtain the corresponding first perturbation data based on each first image and neural network model; Iterate through the second data, and for each second data, perform statistics based on the size of each element in the second data to obtain statistical results that represent the importance distribution ratio of image features in the first image; Based on the statistical results, the second data is segmented and the first perturbation data is processed to obtain the second perturbation data; Based on the second disturbance data, the first image is processed to obtain the second image; The method for segmenting the second data and processing the first perturbation data according to the statistical results to obtain the second perturbation data is as follows: setting a threshold, judging the relationship between the importance score of each pixel in the statistical results and the threshold, and if the importance score is less than the threshold, setting the corresponding perturbation in the first perturbation data to 0 to obtain the second perturbation data; Alternatively: Divide the pixels in the first image into m segments based on the importance score of each pixel in the first image, obtain n data transition points in the above segments, and divide the second data into n+1 score intervals based on the n data transition points. Set the corresponding perturbation size in the first perturbation data according to the score intervals to obtain the second perturbation data.
9. A CAM-based adversarial example generation apparatus, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the CAM-based adversarial example generation method as described in any one of claims 1-7.