Adversarial sample generation method and system based on sparse matrix and penalty term

Abstract

The present application relates to the technical field of image processing, and discloses an adversarial sample generation method and system based on a sparse matrix and a penalty term, which comprises the following steps: acquiring an image, inputting the image into a model, obtaining classification scores for each category, and using the scores of correct categories to calculate a sparse matrix; using the sparse matrix to set a disturbance size, using gradient information of a model loss function to set a disturbance, using a gradient-based adversarial sample generation algorithm to obtain an adversarial sample, and reducing the L0 norm of the disturbance.

Description

Technical Field

[0001] This invention relates to the field of image processing technology, and more specifically, to a method and system for generating adversarial examples based on sparse matrices and penalty terms. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] With the continuous improvement of computer performance, deep learning has been widely applied in various fields. However, researchers have discovered that deep learning models are vulnerable to adversarial attacks. In the field of computer vision, adversarial examples are generated by attackers adding subtle perturbations to the original data that are almost imperceptible to humans through their senses, causing the original model to make incorrect changes.

[0004] While adversarial examples pose a threat to deep neural networks, their proper use can not only uncover model vulnerabilities but also strengthen and improve model robustness. Existing adversarial attacks are categorized into white-box and black-box attacks. White-box attacks allow attackers to exploit information about the target model by setting specific perturbations. Black-box attacks, on the other hand, only know the model's inputs and outputs, not its specific details.

[0005] Adversarial examples themselves have a certain degree of transferability, meaning that adversarial examples generated using one model can also be offensive to other models. However, adversarial examples generated using these methods suffer from overfitting, resulting in low transferability and a generally low success rate for black-box attacks, especially when attacking models with defensive mechanisms (such as adversarial training, input denoising, etc.).

[0006] Since the emergence of adversarial examples, various algorithms have appeared, such as gradient-based attack algorithms: FGSM (Fast Gradient Sign Method), I-FGSM (Basic Iterative Method), MI-FGSM (Momentum-Based Iterative Method), etc., and saliency map attacks (JSMA), etc. Adversarial examples generated by gradient-based attack algorithms attack the entire range of the image, resulting in excessively high L0 norm perturbations and poor adversarial example quality. In contrast, saliency map-based attacks attack only one pixel at a time until successful generation, resulting in a very low L0 norm for the generated adversarial examples. However, each attack requires finding the most important pixel in the image, which is very time-consuming.

[0007] Currently, in the field of image classification, gradient-based adversarial example generation algorithms only limit the size of perturbations in a single pixel to attack the entire image, belonging to the L-type. ∞The attacks generate perturbations with high L0 norms; while the saliency map attack JSMA has low L0 perturbations, it takes a long time to query pixels and attacks only a single pixel in each iteration, resulting in slow generation speed.

[0008] Furthermore, gradient-based adversarial attack methods only limit the maximum value of the perturbation, but not its range, resulting in perturbations with high L0 norms in the generated adversarial examples. In the case of transfer-based black-box attacks, gradient-based adversarial example generation algorithms use the gradient information of the surrogate model to generate specific perturbations and add them to the image to generate adversarial examples in a single iteration. Therefore, the generated adversarial examples suffer from overfitting, leading to poor transferability. Summary of the Invention

[0009] To address the aforementioned problems, this invention provides an adversarial sample generation method and system based on sparse matrices and penalty terms. The method generates sparse matrices and controls the addition of perturbations, thereby reducing the L0 norm of perturbations under white-box attacks and improving the success rate under black-box attacks.

[0010] To achieve the above objectives, the present invention adopts the following technical solution: The first aspect of the present invention provides an adversarial example generation method based on sparse matrices and penalty terms, comprising: Acquire an image, input the image into the model, obtain a classification score for each category, and use the score of the correct category to calculate a sparse matrix; The perturbation magnitude is set using the sparse matrix, and the perturbation is set using the gradient information of the model loss function. Then, an adversarial example generation algorithm based on gradient is used to obtain adversarial examples.

[0011] Furthermore, when calculating the loss function, a penalty term is added for control.

[0012] Furthermore, the contribution of each pixel to the score is used as the image gradient, and pixels with contribution values ​​greater than a threshold are retained, while pixels with contribution values ​​less than a threshold are discarded.

[0013] Furthermore, the image gradient is randomly sparsified to obtain a sparse matrix.

[0014] Furthermore, the perturbation magnitude is the product of the ratio of the total perturbation magnitude to the number of iterations and the sparse matrix.

[0015] Furthermore, the gradient-based adversarial example generation algorithm is: a basic iterative method, a momentum-based iterative method, or a translation-invariant iterative method.

[0016] Furthermore, the image is standardized before being input into the model.

[0017] A second aspect of the present invention provides an adversarial example generation system based on sparse matrices and penalty terms, comprising: The sparse matrix calculation module is configured to: acquire an image, input the image into a model, obtain a classification score for each category, and calculate a sparse matrix using the score of the correct category; The adversarial example generation module is configured to: set the perturbation size using the sparse matrix and set the perturbation using the gradient information of the model loss function, and obtain adversarial examples using a gradient-based adversarial example generation algorithm.

[0018] A third aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the adversarial example generation method based on sparse matrices and penalty terms as described above.

[0019] A fourth aspect of the present invention provides a computer device including a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor executes the program to implement the steps in the adversarial example generation method based on sparse matrices and penalty terms as described above.

[0020] Compared with the prior art, the beneficial effects of the present invention are as follows: The adversarial example generation method based on sparse matrix and penalty term provided by this invention uses the score of the correct class to calculate the sparse matrix, controls the addition of perturbation, attacks only important pixels with high scores, and controls the sparsity of perturbation by controlling the threshold. Without affecting the success rate of white-box attacks and the generation speed, the L0 norm can be controlled below 1% by controlling the threshold, and the generation speed is improved compared with JSMA.

[0021] The adversarial example generation method based on sparse matrices and penalty terms provided by this invention can reduce overfitting of adversarial examples under black-box attacks and improve the success rate of black-box attacks by adding penalty terms to control the cross-entropy loss function. Attached Figure Description

[0022] The accompanying drawings, which constitute a part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute a limitation thereof.

[0023] Figure 1 This is an overall flowchart of the adversarial example generation method based on sparse matrix and penalty term according to Embodiment 1 of the present invention; Figure 2 This is a detailed flowchart of the adversarial example generation method based on sparse matrix and penalty term according to Embodiment 1 of the present invention. Detailed Implementation

[0024] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0025] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0026] Unless otherwise specified, the embodiments and features in the embodiments of the present invention can be combined with each other. The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0027] Terminology Explanation: White-box attack success rate: The success rate of attacking a target model using adversarial attack algorithms by leveraging known information about the target model (such as its internal structure, parameters, and training dataset).

[0028] Black-box attack success rate: The success rate of attacking the target model using adversarial examples generated by adversarial attack algorithms using known alternative model information.

[0029] White-box attack: Using known information about the target model (such as its internal structure, parameters, and training dataset), generate adversarial examples to attack the model.

[0030] Gradient-based black-box transfer attacks: Since adversarial examples are transferable, adversarial examples are generated using gradient information of alternative models. By improving their transferability, these adversarial examples are used to attack the target model.

[0031] L0 norm against perturbation: The perturbation L0 norm refers to the number of modified pixel data; in this invention, it is expressed as a ratio, that is, the number of modified pixel data / the total number of pixels in the image; in this invention, the L0 norm against perturbation is abbreviated as L0 norm.

[0032] L2 norm against perturbation: The L2 norm of perturbation refers to the square root of the sum of the squares of the perturbation elements, which can measure the magnitude of the added perturbation; in this invention, it is expressed as a ratio, namely the L2 norm of the perturbation / the L2 norm of the original image; in this invention, the L2 norm against perturbation is referred to as the L2 norm.

[0033] Targeted Attack: A targeted attack is when an attacker causes an input sample to be classified into a specified incorrect category.

[0034] Non-targeted attack: A non-targeted attack refers to an attacker causing an input sample to be classified into an arbitrary incorrect category.

[0035] JSMA (Jacobian-based Saliency Map Approach) is an algorithm for generating adversarial examples. Adversarial examples involve adding small perturbations to the input data, causing the neural network to output incorrectly. The JSMA algorithm calculates the Jacobian matrix of the neural network, finds the pixels that most significantly affect the network's output, and adds perturbations to these pixels. It is only suitable for white-box attacks.

[0036] I-FGSM (Iterative Fast Gradient Sign Method) is an iterative algorithm for generating adversarial examples. This algorithm causes the neural network to output errors by applying multiple small perturbations to the original input data.

[0037] MI-FGSM (Momentum Iterative Fast Gradient Sign Method) is an iterative algorithm for generating adversarial examples. Similar to the I-FGSM algorithm, MI-FGSM also generates adversarial examples through multiple small perturbations, but it also introduces the idea of ​​momentum gradient descent to accelerate the process of generating adversarial examples.

[0038] TI-FGSM (Translation-Invariant Iterative Fast Gradient Sign Method): To improve the black-box attack capability of MI-FGSM, data augmentation is used to enhance it. It's based on translation-invariant adversarial example generation, as described in the paper "Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks".

[0039] VMI-FGSM (Variance-based Momentum Iterative Fast Gradient SignMethod): To improve the black-box attack capability of MI-FGSM, an improved optimization algorithm was developed. This method, based on variance transformation, is used for adversarial example generation, as described in the paper "Enhancing the Transferability of Adversarial Attacks through VarianceTuning".

[0040] Logits: Unnormalized probabilities, typically the input to the activation function (Softmax) layer.

[0041] Inception (or Inception architecture): A sparse structure that efficiently represents features. The Inception-v3 model combines different convolutional layers in parallel, making it directly usable for image classification. It is denoted as Inc-v3. Inception-v4 is an improvement and optimization of Inception-v3, aiming to enhance model performance, accuracy, and efficiency. It is denoted as Inc-v4. Inception-ResNet-v2 is an improvement and fusion of the Inception-v4 and ResNet architectures. This model aims to combine the advantages of both Inception and ResNet network structures to improve performance and accuracy. Similar to Inception-v4, Inception-ResNet-v2 also uses the Inception module and introduces a new ResNet structure—"residual connections"—which helps solve the gradient vanishing problem during deep neural network training, making the network easier to train and converge. It is denoted as Inc-Resv2.

[0042] ResNet-152 is a deep residual network developed by the Microsoft Research Asia team. Trained on the ImageNet dataset, ResNet-152 can recognize 1000 different object categories. With 152 layers, it is the deepest model in the ResNet series. Unlike traditional convolutional neural networks, ResNet-152 uses a "residual block" structure to increase network depth, thereby improving network performance. This structure effectively solves the gradient vanishing problem, allowing for deeper networks and higher accuracy.

[0043] Models with defensive mechanisms are often referred to as adversarial training models. Adversarial training is a technique used to improve the robustness of deep learning models by adding adversarial examples during training to give the model defensive capabilities. Adversarial examples are samples that, even after being intentionally perturbed, can still fool the deep learning model. The basic idea of ​​adversarial training is to add adversarial examples to the training set in each training step and set their labels to the original sample labels. This forces the model to learn the features of the adversarial examples, thereby improving the model's robustness. ens4_adv_inceptionv3 and ens3_adv_inceptionv3 are both adversarial training models used to improve the model's robustness and defense against adversarial attacks. ens4_adv_inceptionv3 uses a more perturbed dataset and introduces some new data augmentation techniques to increase the model's robustness. ens3_adv_inceptionv3, on the other hand, uses only a perturbed dataset to train the model. Regarding the number and method of ensemble models during adversarial training, ens4_adv_inceptionv3 used 6 models, while ens3_adv_inceptionv3 used only 3. Furthermore, ens4_adv_inceptionv3 employed a Bagging-based ensemble method, averaging the predictions from multiple models to reduce overfitting risk. These are denoted as ens4_incv3 and ens3_incv3. ens_adv_inception_resnet_v2 improves upon ensception_resnet_v2 by adding adversarial examples to each training batch and using these examples to train the model, increasing its robustness. Specifically, this model generates adversarial examples by adding noise and perturbations to the original images, then uses these examples to train the model, thus giving it better adversarial attack defense capabilities. This is denoted as ens_incresv2.

[0044] Example 1 The purpose of this first embodiment is to provide an adversarial example generation method based on sparse matrices and penalty terms.

[0045] Gradient-based adversarial attack methods only limit the maximum value of the perturbation but not its range, resulting in perturbations with high L0 norms in the generated adversarial examples. In transfer-based black-box attacks, gradient-based adversarial example generation algorithms use the gradient information of the surrogate model to generate specific perturbations and add them to the image to generate adversarial examples in a single iteration. Therefore, the generated adversarial examples suffer from overfitting, leading to poor transferability.

[0046] It should be noted that the terms "target model" and "alternate model" are used in black-box attacks. This means using a known model, called the "alternate model" (whose structural parameters are known), to generate adversarial examples, and then attacking the model you want to attack, called the "target model" (whose structural parameters are unknown). A white-box attack, on the other hand, attacks a known model, referred to in this example as the "attacked model" (whose structural parameters are known).

[0047] The adversarial example generation method based on sparse matrices and penalty terms provided in this embodiment is improved through the following two methods: (1) Generate a Logits sparse matrix, control the addition of perturbation, and attack only important pixels with high weight values. This can greatly reduce overfitting and reduce the L0 norm of adversarial examples.

[0048] In transfer-based black-box attacks, perturbations are set using the gradient information of the loss function of the surrogate model. Adding perturbations to the entire image makes it easier to mislead the surrogate model out of its original label. However, because it utilizes information from a large number of unimportant pixels, adversarial examples are more likely to fit the surrogate model and get stuck in local optima. Since the surrogate model and the target model are structurally and parametrically different, the perturbations of unimportant pixels are carefully designed for the surrogate model, but have no good 'misleading' effect on the target model. The resulting adversarial examples have poor transferability. Logits information can be used to control the addition of perturbations. Logits are the output of the surrogate model without softmax processing, representing the classification score for each category. This retains rich information, and the scores of the correct categories are used to calculate a sparse matrix. Attacking only important pixels with high weight values ​​(scores) can reduce overfitting and improve the success rate of black-box attacks.

[0049] (2) Improve the cross-entropy loss function by adding a penalty term. β Controlling Logits increases or decreases the probability of the correct class in Softmax. This controls the fitting of adversarial examples. By controlling Softmax, appropriately reducing the Softmax probability of the correct class and increasing the Softmax probability of the incorrect class can reduce overfitting of adversarial examples under black-box attacks.

[0050] The adversarial example generation method based on sparse matrices and penalty terms provided in this embodiment one, such as Figure 1 As shown, it includes the following steps: Step 1: Obtain the original image and perform image preprocessing.

[0051] Image preprocessing is performed to transform the image size into an input shape that conforms to the alternative model, and the pixel range of the original image in the range of [0,255] is normalized to control the pixel value within the range of [-1,1] in order to speed up the generation of adversarial examples.

[0052] Step 2: Set the attack parameters.

[0053] Set the total perturbation size ε and the number of iterations. T Penalty items β Threshold r and sparse probability p .

[0054] Step 3: Generate the sparse matrix. That is, input the preprocessed image into the surrogate model to obtain the classification score Logits for each category, and use the score of the correct category to calculate the sparse matrix.

[0055] The output value Logits, obtained by inputting the original image into the substitution model, is denoted as... L is a tensor of shape [1, k], where k is the category to be classified by the model. The following algorithm is set: (1) (2) in, tar Label the original image to the correct category; For tags tar Logits value at location , To utilize the score of the correct category on the input original image x Taking the derivative, the obtained image gradient (including the image gradient) x The gradient of each pixel in the image (denoted as ). M ; Representing pixels ( c , i , j Image gradient value at () len The number of pixels in the image; r Threshold r ∈[0,1]; threshold To M After sorting the absolute values ​​from largest to smallest, in r × len The magnitude of the value at the location ( r × len (Round down) c The dimension of the image's RGB channels; i and j Represent c The dimensions of rows and columns under a channel.

[0056] Logits are the scores for each class output by the surrogate model, which are not activated by the Softmax function and retain a large amount of useful information. The image gradient is obtained by backpropagation using the derivative of Logits. M Image gradient M Each position ( c , i , j The value at that position represents the pixel pair. tar The contribution of Logits scores. Pixels with large contribution values ​​are retained, while those with small contributions are discarded.

[0057] Using formula (2) to control the threshold r Image gradient M Values ​​from largest to smallest r Retain the specified value and discard the rest. The L0 norm of the perturbation can be controlled. In white-box attacks, this control alone can obtain a matrix of pixels that contribute significantly to the classification results of the attacked model. However, in black-box attacks, due to the differences between the surrogate model and the target model, the pixels with high contributions generated by the surrogate model will differ from those considered to have high contributions by the target model. If only the threshold is controlled... r Controlling the L0 norm of the perturbation will result in poor transferability of the generated adversarial examples and a low success rate in black-box attacks. Therefore, the threshold should be set under black-box attacks. r The range is appropriately expanded, therefore, in order to further reduce the L0 norm of the perturbation, it is necessary to randomly adjust the image gradient. M After performing sparsity processing, a sparse matrix is ​​obtained, as shown in the following formula: (3) in, X For random operators, X ={0, 1}; indicates whether the matrix obtained by formula (2) is included. M of( c , i , j Each point at position ) is randomly discarded if X =1, then use formula (3) to ( c , i , j ) M Discard it, or retain it and further thin it out; make X Follows Bernoulli distribution: (4) in, p yes X The probability of =1; when X When =1, prevent that pixel from being updated; only when =1...X When =0, updating of that pixel is allowed; by controlling... p The value can further transform the matrix M Perform sparsity processing to obtain mask .

[0058] Step 4: Adjust the Logits score and improve the cross-entropy loss function.

[0059] The goal is to adjust the "weights" of different Logits scores when calculating the cross-entropy loss function. The improved cross-entropy loss function is as follows: (5) Where Logits is the predicted score obtained after the image is input to the replacement model. k represents the number of categories classified by the model. y The true distribution of the samples represents the one-hot encoding of the true labels. Indicates category j One-hot encoding at the location. q The value of the Logits score after activation by the softmax function. Represented as images as categories j The probability of correctly classifying a class. β > 0; when β is greater than 1, the probability of correctly classifying a class increases. softmax The value reduces the number of error categories. softmax The value of , thus leading to loss. loss It decreases; when β is less than 1 but greater than 0, the number of correct categories will decrease. softmax Increase the value of the error category. softmax The value of , thus causing loss Increase β; when attacking a black box, β is set to a value less than 1 to reduce overfitting and increase the success rate of the black box attack; when attacking a white box, β is set to a value greater than 1 to make the adversarial sample fit the attacked model more quickly.

[0060] Step 5: Set the perturbation size using a sparse matrix: (6) Where ε is the total disturbance magnitude, T The number of iterations. mask The sparse matrix obtained in step 3; the perturbation size α of each pixel in the image in a single iteration can be obtained by formula (6).

[0061] That is, Figure 2 As shown, when the number of iterations is 0, a sparse matrix generator is used to generate a perturbation size α, which controls the iteration step size of each pixel.

[0062] Step 6: Combine with a gradient-based adversarial example generation algorithm. That is, based on the perturbation magnitude and utilizing the gradient information of the alternative model loss function, set the perturbation, and then use a gradient-based adversarial example generation algorithm to obtain adversarial examples.

[0063] The perturbation magnitude α generated in step 5 for a single iteration can be combined with any gradient-based adversarial example generation algorithm. The following examples illustrate this combination using non-directional attacks from I-FGSM, MI-FGSM, TI-FGSM, and VMI-FGSM. For instance... Figure 2 As shown, the improved cross-entropy loss function is used to calculate the image loss value, and the image gradient information (gradient value) is calculated through backpropagation. Based on the image gradient information and the step size of each attack, a perturbation is generated and added to the image. .

[0064] ① The basic iterative method (I-FGSM / BIM) has the following formula: (7) in, t It is the number of iterations. For the first t The input for the next iteration, where α is the step size for each attack. y Indicates the true label, It is the cross-entropy loss function J right The gradient value is required; Clip {} represents a function used to crop each element of the input tensor to the range [0, 255] to prevent the generated adversarial sample pixel values ​​from exceeding the range of image pixel values; sign ( ) is a sign function that returns a new tensor based on the input value, where 1 indicates a positive input value, -1 indicates a negative input value, and 0 indicates a zero input value.

[0065] Substituting the α obtained from formula (6) into formula (7), and replacing the cross-entropy loss function in formula (7) with the improved cross-entropy loss function, it can be combined with I-FGSM.

[0066] ② The momentum-based iterative method (MI-FGSM) is shown in the following formula: (8) in, g t For the front t Gradient values ​​accumulated in rounds of iteration g 0=0, μ is the decay factor of the momentum term, and α is the step size of a single iteration; It is the cross-entropy loss function J right The gradient value is required; y The original image for the alternative model recognition x Tags; Clip {} represents a function used to crop each element of the input tensor to the range [0, 255] to prevent the generated adversarial sample pixel values ​​from exceeding the range of image pixel values; sign ( ) is a sign function that returns a new tensor based on the input value, where 1 indicates a positive input value, -1 indicates a negative input value, and 0 indicates a zero input value.

[0067] Substituting the α obtained from formula (6) into formula (8), and replacing the cross-entropy loss function in formula (8) with the improved cross-entropy loss function, it can be combined with TI-FGSM.

[0068] ③ The iterative method based on translation invariance (TI-FGSM) is shown in the following formula: (9) in, W A predefined kernel is used to convolve the gradient of the untranslated image to achieve translation invariance. It is the cross-entropy loss function J right The gradient value is required; y The original image for the alternative model recognition x Tags; Clip {} represents a function used to crop each element of the input tensor to the range [0, 255] to prevent the generated adversarial sample pixel values ​​from exceeding the range of image pixel values; sign ( ) is a sign function that returns a new tensor based on the input value, where 1 indicates a positive input value, -1 indicates a negative input value, and 0 indicates a zero input value.

[0069] Substituting the α obtained from formula (6) into formula (9), and replacing the cross-entropy loss function in formula (9) with the improved cross-entropy loss function, it can be combined with TI-FGSM.

[0070] ④ The iterative method using variance adjustment (Adversarial Attacks through Variance Tuning, VMI-FGSM) is shown in the following formula: (10) in, Attacks to calculate variance; It is the cross-entropy loss function Jright The gradient value is required; y The original image for the alternative model recognition x Tags; Clip {} represents a function used to crop each element of the input tensor to the range [0, 255] to prevent the generated adversarial sample pixel values ​​from exceeding the range of image pixel values; sign ( ) is a sign function that returns a new tensor based on the input value, where 1 indicates a positive input value, -1 indicates a negative input value, and 0 indicates a zero input value.

[0071] Substituting the α obtained from formula (6) into formula (10), and replacing the cross-entropy loss function of formula (10) with the improved cross-entropy loss function, it can be combined with VMI-FGSM.

[0072] Step 6 above represents a non-targeted attack. If a targeted attack is to be launched, the corresponding formulas for I-FGSM, MI-FGSM, TI-FGSM, and VMI-FGSM are as follows: (11) (12) (13) (14) in, tar For the targeted attack label, substitute the α obtained from formula (6) into formulas (11), (12), (13) and (14) respectively, and replace the cross-entropy loss function of formulas (11), (12), (13) and (14) with the improved cross-entropy loss function. This can be combined with gradient-based non-targeted attacks.

[0073] Step 7: Determine if the maximum number of iterations has been reached. T .

[0074] Perform step 6 T The next iteration.

[0075] in, t =[0, T -1], For the first t The input for the wheel is obtained through step 6. As the first t +1 round of input, until t =T-1 output is For adversarial examples.

[0076] Step 8: Save the adversarial sample to determine if the attack was successful.

[0077] The product generated in step 7 Save the image as a PNG file and input it into the target model to determine if the output label matches the original image label. If they match, the attack fails; otherwise, the attack succeeds.

[0078] Experiment 1: The L2 norm can measure the magnitude of the added perturbation. Under similar L2 norms for perturbations, the success rate of black-box and white-box attacks in this embodiment is compared with that of MI-FGSM.

[0079] Using a computer vision dataset (ImageNet dataset), 100 images were randomly selected from the validation set. Black-box attacks were performed using different attack algorithms with the Inception-v3 model as an alternative model. Among them, ens3_incv3 (ens3_adv_inceptionv3), ens4_incv3 (ens4_adv_inceptionv3), and ens_incresv2 (ens_adv_inception_resnet_v2) are defense models trained adversarially.

[0080] The parameter settings are as follows: The attack parameters for MI-FGSM are set as follows: T =10, ε=16 (within the image pixel value range [0,255]); In this embodiment of the method (L-MI-FGSM), parameter 1 is set as: T =10, ε =20 (within the image pixel value range [0,255]), penalty term β=0.99, threshold r =0.7, sparse probability p =10%; In this embodiment of the method (L-MI-FGSM), parameter 2 is set to: T =10, ε=40 (within the image pixel value range [0,255]), penalty term β=0.99, threshold r =0.3, sparse probability p =10%.

[0081] The norm mean values ​​of the generated adversarial sample perturbations are shown in Table 1, where L-MI-FGSM1 represents the method of this embodiment under parameter 1; and L-MI-FGSM2 represents the method of this embodiment under parameter 2.

[0082] Table 1. Mean of Perturbation Norm The success rate (in %) of the generated adversarial sample attacks is shown in Table 2.

[0083] Table 2. Attack Success Rate In this context, * represents white-box attacks Inc-v3, and the others represent black-box attacks that use Inc-v3 as a replacement model.

[0084] It can be seen that while maintaining a similar L2 norm to MI-FGSM, the L0 norm is reduced, and the success rate of black-box attacks is improved.

[0085] Experiment 2: L0 and L2 norms of generated adversarial examples under different perturbations ε.

[0086] Using the ImageNet dataset, 100 images were randomly selected from the validation set. Different attack algorithms were used to perform white-box attacks on the Inception-v3 model, and the effectiveness of the generated adversarial examples was demonstrated. The number of iterations was T=10.

[0087] In this embodiment, the method is combined with I-FGSM and MI-FGSM, respectively, and named LI-FGSM and L-MI-FGSM. The penalty term β is set to 1.01, and the threshold value is... r =0.2, sparse probability p =10%.

[0088] Different perturbations ε (within the image pixel value range [0,255]) were set to {16, 48, 96}. The experimental results are shown in Table 3.

[0089] Table 3. Success Rate of White-Box Attacks and Mean of Each Norm Experiment 3: Verify attack speed: Using the ImageNet dataset, perform white-box attacks on the Inception-v3 model using different attack algorithms, and verify the attack success rate.

[0090] The perturbation size of a single JSMA attack is α = 76.5 (within the range [0, 255]).

[0091] The I-FGSM and MI-FGSM settings are: number of iterations. T =10, perturbation ε=16 (range [0,255]). The method (L-MI-FGSM) in this embodiment sets the parameters as follows: number of iterations. T =10, penalty term β=1.01, threshold r =0.005, sparse probability p =0, perturbation ε=765 (within the range [0,255]), single perturbation size α=76.5×mask.

[0092] Table 4 shows the adversarial sample generation speed and the success rate of white-box attacks.

[0093] Table 4. Adversarial Example Generation Speed ​​and White-Box Attack Success Rate The adversarial example generation method based on sparse matrices and penalty terms provided in this embodiment addresses the problem of high L0 norm in gradient-based adversarial example generation algorithms. By controlling the threshold, the sparsity of the perturbation can be controlled. Without affecting the success rate of white-box attacks and the generation speed, the L0 norm can be controlled to below 1% by controlling the threshold.

[0094] The adversarial example generation method based on sparse matrices and penalty terms provided in this embodiment reduces the modified pixel values ​​by controlling the threshold, thereby decreasing the fit of adversarial examples generated by white-box attacks to the white-box model and preventing overfitting. In particular, it improves the black-box success rate of models with defensive mechanisms (adversarial training) by approximately 13%.

[0095] The adversarial example generation method based on sparse matrices and penalty terms provided in this embodiment improves the generation speed by about 10 seconds compared to the JSMA algorithm under the same conditions, and provides a fast attack algorithm with low L0 norm.

[0096] The adversarial example generation method based on sparse matrices and penalty terms provided in this embodiment solves three problems: reducing the L0 norm of gradient-based adversarial example perturbations; providing a fast method for generating white-box adversarial examples with low L0 norm; and improving the success rate of black-box attacks at similar L2 norms.

[0097] Example 2 The purpose of this second embodiment is to provide an adversarial example generation system based on sparse matrices and penalty terms. The sparse matrix calculation module is configured to: acquire an image, input the image into a model, obtain a classification score for each category, and calculate a sparse matrix using the score of the correct category; The adversarial example generation module is configured to: set the perturbation size using the sparse matrix and set the perturbation using the gradient information of the model loss function, and obtain adversarial examples using a gradient-based adversarial example generation algorithm.

[0098] It should be noted that each module in this embodiment corresponds one-to-one with each step in Embodiment 1, and their specific implementation processes are the same, so they will not be repeated here.

[0099] Example 3 This embodiment provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps in the adversarial example generation method based on sparse matrices and penalty terms as described in Embodiment 1 above.

[0100] Example 4 This embodiment provides a computer device, including a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the program, it implements the steps in the adversarial example generation method based on sparse matrices and penalty terms as described in Embodiment 1 above.

[0101] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0102] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims

1. An adversarial example generation method based on sparse matrices and penalty terms, characterized in that, include: The image is acquired, input into the model, and a classification score for each category is obtained. The sparse matrix is ​​then calculated using the scores for the correct categories. Specifically: The contribution of each pixel to the score is used as the image gradient, and pixels with contribution values ​​greater than a threshold are retained, while pixels with contribution values ​​less than a threshold are discarded. The image gradient is randomly subjected to sparse processing to obtain a sparse matrix; ； Where X is a random operator, X={0,1}, indicating whether to randomly discard each point at (c,i,j) of the image gradient M. If X=1, the image gradient M at (c,i,j) is discarded; otherwise, it is retained. This further sparsifies X so that it follows a Bernoulli distribution. ； Where P is the probability of X=1. When X=1, the pixel is prevented from updating, and the pixel is allowed to update only when X=0. By controlling the value of P, the image gradient M is further sparsed to obtain the mask. The perturbation magnitude is set using the sparse matrix, and the perturbation is set using the gradient information of the model loss function. An adversarial example generation algorithm based on gradient is used to obtain adversarial examples. When calculating the loss function, a penalty term is added. β To take control; When β > 0, the correct category will be increased. softmax The value reduces the number of error categories. softmax The value of , thus leading to loss. loss It decreases; when β is less than 1 but greater than 0, the number of correct categories will decrease. softmax Increase the value of the error category softmax The value of , thus causing loss Increase; when β is used for black-box attacks, it is set to a value less than 1 to reduce overfitting and increase the success rate of black-box attacks; when β is used for white-box attacks, it is set to a value greater than 1 to make adversarial examples fit the attacked model more quickly. The perturbation magnitude is the product of the ratio of the total perturbation magnitude to the number of iterations and the sparse matrix.

2. The adversarial example generation method based on sparse matrices and penalty terms as described in claim 1, characterized in that, The gradient-based adversarial example generation algorithm is: a basic iterative method, a momentum-based iterative method, or a translation-invariant iterative method.

3. The adversarial example generation method based on sparse matrices and penalty terms as described in claim 1, characterized in that, The image, after being standardized, is input into the model.

4. An adversarial example generation system based on sparse matrices and penalty terms, characterized in that, include: The sparse matrix calculation module is configured to: acquire an image, input the image into the model, obtain a classification score for each category, and calculate the sparse matrix using the scores of the correct categories, specifically: The contribution of each pixel to the score is used as the image gradient, and pixels with contribution values ​​greater than a threshold are retained, while pixels with contribution values ​​less than a threshold are discarded. The image gradient is randomly subjected to sparse processing to obtain a sparse matrix; ； Where X is a random operator, X={0,1}, indicating whether to randomly discard each point at (c,i,j) of the image gradient M. If X=1, the image gradient M at (c,i,j) is discarded; otherwise, it is retained. This further sparsifies X so that it follows a Bernoulli distribution. ； Where P is the probability of X=1. When X=1, the pixel is prevented from updating, and the pixel is allowed to update only when X=0. By controlling the value of P, the image gradient M is further sparsed to obtain the mask. The adversarial example generation module is configured to: set the perturbation size using the sparse matrix and set the perturbation using the gradient information of the model loss function, and use a gradient-based adversarial example generation algorithm to obtain adversarial examples; When calculating the loss function, a penalty term is added to control this. When β > 0, the correct category will be increased. softmax The value reduces the number of error categories. softmax The value of , thus leading to loss. loss It decreases; when β is less than 1 but greater than 0, the number of correct categories will decrease. softmax Increase the value of the error category softmax The value of , thus causing loss Increase; when β is used for black-box attacks, it is set to a value less than 1 to reduce overfitting and increase the success rate of black-box attacks; when β is used for white-box attacks, it is set to a value greater than 1 to make adversarial examples fit the attacked model more quickly. The perturbation magnitude is the product of the ratio of the total perturbation magnitude to the number of iterations and the sparse matrix.

5. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps in the adversarial example generation method based on sparse matrices and penalty terms as described in any one of claims 1-3.

6. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps in the adversarial example generation method based on sparse matrices and penalty terms as described in any one of claims 1-3.

Images