An adversarial sample generation method and system based on the same semantic features

Abstract

This invention discloses a method and system for generating adversarial samples based on identical semantic features, relating to the technical field of artificial intelligence security. The method includes acquiring original image samples and generating corresponding perturbation samples; inputting these samples into a neural network model to be attacked; calculating a first similarity score and a second similarity score; adjusting the perturbation samples by setting weight factors on the similarity scores to obtain optimized perturbation samples; calculating and constraining the upper bound of the optimized perturbation samples to obtain initial adversarial samples; determining whether the initial adversarial samples meet preset requirements; if not, using the initial adversarial samples as new perturbation samples for a new round of iteration; otherwise, obtaining the final adversarial samples. This invention offers high stability and success rate, is not limited to specific datasets, making the generated adversarial samples more universal and transferable, and remains highly imperceptible when misleading classifiers, thus improving the reliability and practicality of adversarial attacks and effectively deceiving classifiers.

Description

Technical Field

[0001] This invention relates to the technical field of artificial intelligence security, and more specifically, to a method and system for generating adversarial examples based on the same semantic features. Background Technology

[0002] With the development of deep learning, neural networks have demonstrated excellent performance in real-world recognition tasks. However, recent research has shown that neural networks are vulnerable to image manipulation and adversarial instances, hindering their application in safety-critical areas of artificial intelligence, but driving research into the robustness of neural networks. The most intuitive approach to generating adversarial instances is to increase the cost of classification loss through gradient descent and apply lp distance to limit the visual differences between benign and perturbed images. However, traditional methods suffer from two open-ended problems: firstly, the inherent limitation of generalization across different datasets. In machine learning, to launch an attack, a surrogate classifier is often used to generate a learned weight vector representing the target class and mislead the model. However, this attack method is limited to cases where both training and attack data are targeted at the same set of classes—i.e., white-box or surrogate classifier attack paradigms. In the real world, there is the open-set problem, where input data may belong to novel classes not previously seen by the model. In such cases, surrogate classifier-based attacks are ineffective because the surrogate classifier does not contain information from the "unknown" class. Secondly, regarding the issue of differences in human visual camouflage, scholars have demonstrated that the LP distance metric cannot accurately assess perceptual similarity. That is, relying solely on perturbation intensity cannot clearly reflect visually imperceptible differences. For example, perturbations generated by the well-known C&W attack method become more easily perceived on smooth backgrounds. A series of works have addressed the design of perceptual similarity metrics to limit perturbations in the adversarial instance generation process. Based on the similarity of object structure, edges, color, and learned perceptual image patch similarity, other perceptual distances have been proposed to improve the imperceptibility of perturbations.

[0003] Existing technology discloses a highly transferable adversarial example generation method and system. The method includes acquiring feature maps of the original image across multiple intermediate layers of a specified deep learning network; dividing all feature maps into positive and negative feature regions based on the activation values ​​and gradients of the intermediate layers; weighted summing of different regions across all specified intermediate layers as a loss function; processing the loss function using the momentum method to obtain adversarial examples for each iteration; and generating highly transferable adversarial examples when the number of iterations reaches a preset number. This existing technology requires accurate feature segmentation and aggregation of feature information from multiple intermediate layers, which has significant limitations and results in low stability and success rate in generating adversarial examples. Summary of the Invention

[0004] To overcome the shortcomings of existing adversarial attack techniques, which require targeted perturbation design and have limitations in cross-dataset generalization, this invention provides an adversarial sample generation method and system based on the same semantic features. This method can attack semantically similar feature representations, is not limited to specific datasets, has high stability and success rate, improves the imperceptibility of perturbations, and effectively deceives classifiers.

[0005] To solve the above-mentioned technical problems, the technical solution of the present invention is as follows:

[0006] This invention provides a method for generating adversarial examples based on the same semantic features, comprising:

[0007] S1: Obtain the original image samples and the neural network model to be attacked, and generate perturbation samples corresponding to the original image samples;

[0008] S2: Input the original image samples and perturbation samples into the neural network model to be attacked, and calculate the first similarity score between the perturbation sample and the corresponding original image sample, and the second similarity score between the perturbation sample and other original image samples;

[0009] S3: Set corresponding weighting factors for the first similarity score and the second similarity score, and adjust the perturbation sample according to the first similarity score and its weighting factor, the second similarity score and its weighting factor to obtain the optimized perturbation sample;

[0010] S4: Calculate the upper bound of the optimized perturbation sample using the first derivative approximation algorithm, and use the upper bound to constrain the optimized perturbation sample to obtain the initial adversarial sample;

[0011] S5: Determine whether the initial adversarial sample meets the preset requirements; if it does, use the initial adversarial sample as the final adversarial sample; if it does not, use the initial adversarial sample as a new perturbation sample, and repeat steps S2-S5 until the preset requirements are met to obtain the final adversarial sample.

[0012] Preferably, the initial value of the perturbation sample is the original image sample.

[0013] Preferably, the original image samples and perturbation samples are input into the neural network model to be attacked, and the first similarity score between the perturbation sample and the corresponding original image sample is calculated using the following method:

[0014] The original image samples and perturbation samples are input into the neural network model to be attacked in batches. After being processed by the neural network model to be attacked, the output results of the original image samples and the output results of the perturbation samples are obtained.

[0015] Based on the output results of the perturbed samples and the corresponding output results of the original image samples, a reflexive similarity score is calculated and used as the first similarity score:

[0016]

[0017] In the formula, S′ i，i Let x′ represent the first similarity score between the i-th perturbed sample and the i-th original image sample. i Let x represent the i-th perturbation sample. i Let f(*) represent the i-th original image sample; f(*) represents the neural network model to be attacked, f(x′) i f(x) represents the output result of the i-th perturbation sample. i () represents the output result of the i-th original image sample; (*) T The expression represents the transpose operation, and ||*||2 represents the L2 norm operation.

[0018] Preferably, the specific method for inputting the original image samples and perturbation samples into the neural network model to be attacked, and calculating the second similarity score between the perturbation samples and other original image samples, is as follows:

[0019] For each other original image sample output, calculate the difference similarity score with the perturbed sample output:

[0020]

[0021] In the formula, S′ i，j Let x represent the similarity score, which is the difference between the first similarity score of the i-th perturbed sample and the j-th original image sample. j Let f(x) represent the j-th original image sample. j () represents the output result of the j-th original image sample, where i ≠ j;

[0022] The difference similarity score with the smallest value among all difference similarity scores is taken as the second similarity score min{(S′)}. i，j |j≠i)}.

[0023] Preferably, the specific method for setting corresponding weighting factors for the first similarity score and the second similarity score is as follows:

[0024] A preset adjustment value is used to set the corresponding weighting factors for the first and second similarity scores, respectively.

[0025] α=[S′ i，i -m] +

[0026] β=[1+m-min{(S′ i，j |j≠i)}] +

[0027] In the formula, α represents the weighting factor for the first similarity score, and β represents the weighting factor for the second similarity score; [*] + max(*, 0) represents a function that takes the larger value between * and 0; m represents a preset adjustment value, m≥0. During the optimization of perturbation samples, terms with close similarity will be assigned a smaller gradient, while terms with large differences in similarity will be assigned a larger gradient.

[0028] Preferably, the specific method for adjusting the perturbation sample based on the first similarity score and its weighting factor, and the second similarity score and its weighting factor to obtain the optimized perturbation sample is as follows:

[0029]

[0030] In the formula, Let represent the i-th optimized perturbation sample. This means finding x′ when * takes its minimum value. i A function that takes values.

[0031] This means reducing the similarity between the perturbation sample and the original image sample, and increasing the similarity between the perturbation sample and the least similar original image sample in a given pair, thereby misleading the classifier to map the adversarial sample into a different subspace.

[0032] Preferably, the specific method of step S4 is as follows:

[0033] The loss information is calculated based on the optimized perturbation sample and its corresponding real label, and the image gradient information is obtained by taking the derivative of the optimized perturbation sample with the loss information.

[0034] Based on the image gradient information, obtain the pixel values ​​in the optimized perturbation sample;

[0035] A preset maximum perturbation threshold is defined, and pixel values ​​in the optimized perturbation samples that exceed the maximum perturbation threshold range are clamped to the maximum perturbation threshold, thereby constraining the optimized perturbation samples and obtaining initial adversarial samples; the maximum perturbation threshold range is [original image sample -, original image sample +].

[0036] Preferably, the method for obtaining the initial adversarial example is as follows:

[0037]

[0038] In the formula, Let $\mathbf{i}$ represent the initial adversarial sample in the $t$-th iteration, $clip$ represent the shearing function, $\mathbf{i}$ represent the preset maximum perturbation threshold, and $\mathbf{i}$ represent the step size. This indicates the gradient calculation operation. Let y represent the loss between the predicted value and the true label of the (t-1)th initial adversarial sample in the tth iteration, and let y represent the true label.

[0039] Preferably, the specific method for determining whether the initial adversarial sample meets the preset requirements is as follows:

[0040] The initial adversarial sample is input into the neural network model to be attacked, and the initial adversarial sample predicted label is output. The initial adversarial sample predicted label is compared with the corresponding real label of the original image sample. If they are different, it is determined that the initial adversarial sample meets the preset requirements.

[0041] If they are the same, determine whether the current iteration round is less than the preset maximum iteration round; if it is less, determine that the initial adversarial sample does not meet the preset requirements; if it is not less, determine that the initial adversarial sample meets the preset requirements.

[0042] Preferably, the neural network model to be attacked is any one of Inception V3, Inception V4, Inception-ResNet V2, ResNet50 V2, ResNet101 V2, ResNet152 V2, Inc-v3adv, Inc-v3ens3, Inc-v3ens4, or IncRes-v2ens.

[0043] This invention also provides an adversarial example generation system based on the same semantic features, used to implement the above-described generation method, comprising:

[0044] The acquisition module is used to acquire the original image samples and the neural network model to be attacked, and to generate perturbation samples corresponding to the original image samples.

[0045] The similarity score calculation module is used to input the original image samples and perturbation samples into the neural network model to be attacked, and calculate the first similarity score between the perturbation sample and the corresponding original image sample, and the second similarity score between the perturbation sample and other original image samples.

[0046] The perturbation sample optimization module is used to set corresponding weight factors for the first similarity score and the second similarity score, and adjust the perturbation sample according to the first similarity score and its weight factor, the second similarity score and its weight factor, to obtain the optimized perturbation sample;

[0047] The perturbation sample constraint module is used to calculate the upper bound of the optimized perturbation sample using a first-order derivative approximation algorithm, and to constrain the optimized perturbation sample using the upper bound to obtain the initial adversarial sample.

[0048] The adversarial sample generation module is used to determine whether the initial adversarial sample meets the preset requirements; if it does, the initial adversarial sample is used as the final adversarial sample; if it does not, the initial adversarial sample is used as a new perturbation sample and returned to the similarity score calculation module until the preset requirements are met and the final adversarial sample is obtained.

[0049] Compared with the prior art, the beneficial effects of the technical solution of the present invention are:

[0050] This invention acquires original image samples and a neural network model to be attacked, and generates perturbation samples corresponding to the original image samples. The original image samples and perturbation samples are input into the neural network model to be attacked. A first similarity score between the perturbation sample and the corresponding original image sample, and a second similarity score between the perturbation sample and other original image samples are calculated. Appropriate weighting factors are set to adjust the perturbation samples, resulting in optimized perturbation samples. An upper bound for the optimized perturbation samples is calculated using a first-order derivative approximation algorithm. This upper bound is used to constrain the optimized perturbation samples, resulting in initial adversarial samples. It is then determined whether the initial adversarial samples meet preset requirements. If not, the initial adversarial samples are used as new perturbation samples, and the above steps are repeated until the preset requirements are met, resulting in final adversarial samples. Otherwise, the initial adversarial samples are used as final adversarial samples. This invention essentially generates adversarial examples based on the semantic features of original image samples. It boasts high stability and success rate, is not limited to specific datasets, and can generalize across datasets, making the generated adversarial examples more universal and transferable. This invention is applicable to common and practical black-box settings and remains highly imperceptible when misleading classifiers, thereby improving the reliability and practicality of adversarial attacks and achieving the goal of effectively deceiving classifiers. Attached Figure Description

[0051] Figure 1 This is a flowchart of an adversarial sample generation method based on the same semantic features as described in Example 1.

[0052] Figure 2 This is a schematic diagram illustrating the calculation of similarity scores using the cosine similarity method as described in Example 2.

[0053] Figure 3 This is a schematic diagram of the comparison difference similarity score as described in Example 2.

[0054] Figure 4 This is a schematic diagram illustrating how, in Example 2, weighting factors are set for the first similarity score and the second similarity score according to the adjustment value.

[0055] Figure 5 This is a schematic diagram illustrating the classification of application scenario examples as described in Example 2.

[0056] Figure 6 This is a schematic diagram of the structure of an adversarial sample generation system based on the same semantic features as described in Example 3. Detailed Implementation

[0057] The accompanying drawings are for illustrative purposes only and should not be construed as limiting the scope of this patent.

[0058] To better illustrate this embodiment, some parts in the accompanying drawings may be omitted, enlarged, or reduced, and do not represent the actual product dimensions.

[0059] It will be understood by those skilled in the art that certain well-known structures and their descriptions may be omitted in the accompanying drawings.

[0060] The technical solution of the present invention will be further described below with reference to the accompanying drawings and embodiments.

[0061] Example 1

[0062] This embodiment provides a method for generating adversarial examples based on the same semantic features, such as... Figure 1 As shown, it includes:

[0063] S1: Obtain the original image samples and the neural network model to be attacked, and generate perturbation samples corresponding to the original image samples;

[0064] S2: Input the original image samples and perturbation samples into the neural network model to be attacked, and calculate the first similarity score between the perturbation sample and the corresponding original image sample, and the second similarity score between the perturbation sample and other original image samples;

[0065] S3: Set corresponding weighting factors for the first similarity score and the second similarity score, and adjust the perturbation sample according to the first similarity score and its weighting factor, the second similarity score and its weighting factor to obtain the optimized perturbation sample;

[0066] S4: Calculate the upper bound of the optimized perturbation sample using the first derivative approximation algorithm, and use the upper bound to constrain the optimized perturbation sample to obtain the initial adversarial sample;

[0067] S5: Determine whether the initial adversarial sample meets the preset requirements; if it does, use the initial adversarial sample as the final adversarial sample; if it does not, use the initial adversarial sample as a new perturbation sample, and repeat steps S2-S5 until the preset requirements are met to obtain the final adversarial sample.

[0068] In the specific implementation process, this embodiment acquires original image samples and a neural network model to be attacked, and generates perturbation samples corresponding to the original image samples; inputs the original image samples and perturbation samples into the neural network model to be attacked, calculates the first similarity score between the perturbation sample and the corresponding original image sample, the second similarity score between the perturbation sample and other original image samples, and sets corresponding weight factors to adjust the perturbation samples to obtain optimized perturbation samples; calculates the upper bound of the optimized perturbation samples using a first-order derivative approximation algorithm, and uses the upper bound to constrain the optimized perturbation samples to obtain initial adversarial samples; determines whether the initial adversarial samples meet preset requirements; if not, uses the initial adversarial samples as new perturbation samples, repeats the above steps until the preset requirements are met to obtain the final adversarial samples; otherwise, uses the initial adversarial samples as the final adversarial samples. This embodiment essentially generates adversarial examples based on the semantic features of the original image samples. It has high stability and success rate, is not limited to specific datasets, and can achieve cross-dataset generalization, making the generated adversarial examples more universal and transferable. This embodiment is applicable to common and practical black-box settings, and remains highly imperceptible when misleading the classifier, thereby improving the reliability and practicality of adversarial attacks and achieving the goal of effectively deceiving the classifier.

[0069] Example 2

[0070] This embodiment provides a method for generating adversarial examples based on the same semantic features, which can be applied to both white-box and black-box attacks; including:

[0071] S1: Obtain the original image samples and the neural network model to be attacked, and generate perturbation samples corresponding to the original image samples;

[0072] In this embodiment, the original image samples use the ImageNet-compatible dataset, which contains 1000 images of size 299×299×3 and their corresponding ground truth labels; the neural network models to be attacked include 10 neural network models, including Inception V3, Inception V4, Inception-ResNet V2, ResNet50V2, ResNet101 V2, ResNet152 V2, Inc-v3adv, Inc-v3ens3, Inc-v3ens4, and IncRes-v2ens, which are trained using the ImageNet dataset; the original image samples are in .png or .jpg format, and the neural network model files are in .ckpt format;

[0073] S2: Input the original image samples and perturbation samples into the neural network model to be attacked, and calculate the first similarity score between the perturbation sample and the corresponding original image sample, and the second similarity score between the perturbation sample and other original image samples; specifically:

[0074] The original image samples and perturbation samples are input into the neural network model to be attacked in batches. After being processed by the neural network model to be attacked, the output results of the original image samples and the output results of the perturbation samples are obtained.

[0075] like Figure 2 As shown, based on the cosine similarity method, a reflexive similarity score is calculated according to the perturbed sample output and the corresponding original image sample output, which is used as the first similarity score:

[0076]

[0077] In the formula, S′ i，i Let x′ represent the first similarity score between the i-th perturbed sample and the i-th original image sample. i Let x represent the i-th perturbation sample. i Let f(*) represent the i-th original image sample; f(*) represents the neural network model to be attacked, f(x′) i f(x) represents the output result of the i-th perturbation sample. i () represents the output result of the i-th original image sample; (*) T The expression represents the transpose operation, and ||*||2 represents the L2 norm operation.

[0078] Based on the cosine similarity method, for each other original image sample output, a difference similarity score is calculated between the output of the original image sample and the perturbed sample output:

[0079]

[0080] In the formula, S i ′ ,j Let x represent the similarity score, which is the difference between the first similarity score of the i-th perturbed sample and the j-th original image sample. j Let f(x) represent the j-th original image sample. j () represents the output result of the j-th original image sample, where i ≠ j;

[0081] like Figure 3 As shown, the difference similarity score with the smallest value among all difference similarity scores is taken as the second similarity score min{ i ′ ,j |j≠i)}.

[0082] Cosine similarity measures the similarity score between two vectors by measuring the cosine of the angle between them; the similarity score ranges from [0,1], and the higher the score, the higher the similarity.

[0083] S3: Set corresponding weighting factors for the first similarity score and the second similarity score, and adjust the perturbation sample according to the first similarity score and its weighting factors, and the second similarity score and its weighting factors to obtain the optimized perturbation sample; specifically:

[0084] like Figure 4 As shown, a preset adjustment value is used to set the corresponding weighting factors for the first similarity score and the second similarity score, respectively, based on the adjustment value:

[0085] α=[S i ′ ,i -] +

[0086] β=[1+-min{(S i ′ ,j |j≠i)}] +

[0087] In the formula, α represents the weighting factor for the first similarity score, and β represents the weighting factor for the second similarity score; [*] + `max(*,0)` represents a function that takes the larger value between `*` and `0`; `m` represents a preset adjustment value, which is set to 0.2 in this embodiment.

[0088] The specific method for obtaining the optimized perturbation samples is as follows:

[0089]

[0090] In the formula, Let represent the i-th optimized perturbation sample. This means finding x when * takes its minimum value. i ′ A function that takes values.

[0091] This means reducing the similarity between the perturbation sample and the original image sample, and increasing the similarity between the perturbation sample and the least similar original image sample in a given pair, thereby misleading the classifier to map the adversarial sample into a different subspace.

[0092] S4: Calculate the upper bound of the optimized perturbation sample using a first-order derivative approximation algorithm, and use this upper bound to constrain the optimized perturbation sample to obtain the initial adversarial sample; specifically:

[0093] The loss information is calculated based on the optimized perturbation sample and its corresponding real label, and the image gradient information is obtained by taking the derivative of the optimized perturbation sample with the loss information.

[0094] Based on the image gradient information, obtain the pixel values ​​in the optimized perturbation sample;

[0095] A preset maximum perturbation threshold is defined. Pixel values ​​in the optimized perturbation samples that exceed the maximum perturbation threshold range are clamped to the maximum perturbation threshold, thereby constraining the optimized perturbation samples and obtaining initial adversarial samples. The maximum perturbation threshold range is [original image sample -, original image sample +].

[0096] The method for obtaining the initial adversarial examples is as follows:

[0097]

[0098] In the formula, Let represent the i-th initial adversarial sample in the t-th iteration, clip represent the shearing function, ∈ represent the preset maximum perturbation threshold, and γ represent the step size. In this embodiment, γ is set to 0.01. This indicates the gradient calculation operation. Let y represent the loss between the predicted value and the true label of the (t-1)th initial adversarial sample in the tth iteration, and let y represent the true label.

[0099] S5: Determine whether the initial adversarial sample meets the preset requirements; if it does, use the initial adversarial sample as the final adversarial sample; if it does not, use the initial adversarial sample as a new perturbation sample, and repeat steps S2-S5 until the preset requirements are met to obtain the final adversarial sample.

[0100] The specific method for determining whether the initial adversarial sample meets the preset requirements is as follows: input the initial adversarial sample into the neural network model to be attacked, and output the initial adversarial sample prediction label; compare the initial adversarial sample prediction label with the corresponding real label of the original image sample, and if they are different, determine that the initial adversarial sample meets the preset requirements.

[0101] If they are the same, determine whether the current iteration round is less than the preset maximum iteration round; if it is less, determine that the initial adversarial sample does not meet the preset requirements; if it is not less, determine that the initial adversarial sample meets the preset requirements; in this embodiment, the preset maximum iteration round is 100 rounds.

[0102] like Figure 5 The diagram shows an application scenario classification of this method. For an original image sample labeled "ship", after processing by the above method, the final adversarial sample "horse" is obtained, which indicates that the attack is successful.

[0103] Example 3

[0104] This embodiment provides an adversarial example generation system based on the same semantic features, used to implement the generation method described in Embodiment 1 or 2, such as... Figure 6 As shown, it includes:

[0105] The acquisition module is used to acquire the original image samples and the neural network model to be attacked, and to generate perturbation samples corresponding to the original image samples.

[0106] The similarity score calculation module is used to input the original image samples and perturbation samples into the neural network model to be attacked, and calculate the first similarity score between the perturbation sample and the corresponding original image sample, and the second similarity score between the perturbation sample and other original image samples.

[0107] The perturbation sample optimization module is used to set corresponding weight factors for the first similarity score and the second similarity score, and adjust the perturbation sample according to the first similarity score and its weight factor, the second similarity score and its weight factor, to obtain the optimized perturbation sample;

[0108] The perturbation sample constraint module is used to calculate the upper bound of the optimized perturbation sample using a first-order derivative approximation algorithm, and to constrain the optimized perturbation sample using the upper bound to obtain the initial adversarial sample.

[0109] The adversarial sample generation module is used to determine whether the initial adversarial sample meets the preset requirements; if it does, the initial adversarial sample is used as the final adversarial sample; if it does not, the initial adversarial sample is used as a new perturbation sample and returned to the similarity score calculation module until the preset requirements are met and the final adversarial sample is obtained.

[0110] The same or similar labels correspond to the same or similar parts;

[0111] The terms used to describe positional relationships in the accompanying drawings are for illustrative purposes only and should not be construed as limiting this patent.

[0112] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the present invention, and are not intended to limit the implementation of the present invention. Those skilled in the art can make other variations or modifications based on the above description. It is neither necessary nor possible to exhaustively describe all embodiments here. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the claims of the present invention.

Claims

1. A method for generating an adversarial sample based on the same semantic feature, characterized in that, Comprise: S1: obtain original image samples and a neural network model to be attacked, and generate perturbation samples corresponding to the original image samples; S2: input the original image samples and the perturbation samples into the neural network model to be attacked, calculate the first similarity score of the perturbation samples and the corresponding original image samples, and the second similarity score of the perturbation samples and other original image samples; The specific method for inputting the original image samples and the perturbation samples into the neural network model to be attacked to calculate the first similarity score of the perturbation samples and the corresponding original image samples is: The original image samples and the perturbation samples are input into the neural network model to be attacked in batches, and after being processed by the neural network model to be attacked, the original image sample output result and the perturbation sample output result are obtained; According to the perturbation sample output result and the corresponding original image sample output result, the self-reflection similarity score is calculated as the first similarity score: In the formula, S' i,i represents the first similarity score of the i th perturbed sample and the i th original image sample, x' i represents the i th perturbed sample, x i represents the i th original image sample; f(*) represents a neural network model to be attacked, f(x i ) represents the i th perturbed sample output result, f(x i ) represents the i th original image sample output result; T represents a transpose operation, and ||*||2 represents an L2 norm operation; The specific method for inputting the original image samples and the perturbation samples into the neural network model to be attacked to calculate the second similarity score of the perturbation samples and other original image samples is: For each other original image sample output result, the difference similarity score is calculated with the perturbation sample output result respectively: where S' = S - S0 i,j represents the first similarity score difference value of the ith perturbed sample and the jth original image sample, x j represents the jth original image sample, f(x j ) represents the output result of the jth original image sample, i≠j; The difference similarity score with the smallest value among all difference similarity scores is taken as the second similarity score min{(S′)}. i,j |j≠i)}; S3: set corresponding weight factors for the first similarity score and the second similarity score, adjust the perturbation sample according to the first similarity score and its weight factor, the second similarity score and its weight factor, and obtain an optimized perturbation sample; S4: calculate the upper bound of the optimized perturbation sample using a first derivative approximation algorithm, constrain the optimized perturbation sample using the upper bound, and obtain an initial adversarial sample; S5: determine whether the initial adversarial sample meets the preset requirements; if so, the initial adversarial sample is taken as a final adversarial sample; if not, the initial adversarial sample is taken as a new perturbation sample, and steps S2-S5 are repeated until the preset requirements are met, and a final adversarial sample is obtained.

2. The method of claim 1, wherein the same semantic feature based adversarial sample generation method is characterized by, The specific method for setting corresponding weight factors for the first similarity score and the second similarity score is: A preset adjustment value is set, and the weight factors corresponding to the first similarity score and the second similarity score are set according to the adjustment value respectively: a = [S' i,i - m] + β = [1 + m - min{S'(i) - S'(j) | j ≠ i)} i,j |j≠i)} + In the formula, a represents a first similarity score weight factor, β represents a second similarity score weight factor, m represents a preset adjustment value, and + is max(*, 0), which represents a function of taking a larger value between * and 0.

3. The method of claim 2, wherein, The specific method for adjusting the perturbation sample according to the first similarity score and its weight factor, the second similarity score and its weight factor to obtain an optimized perturbation sample is: wherein denotes the i-th optimized perturbation sample, denotes the value of x' when the minimum is taken i the function of the values.

4. The method of claim 3, wherein, The specific method of step S4 is: Calculate the loss information according to the optimized perturbation sample and the true label corresponding thereto, and derive the optimized perturbation sample using the loss information to obtain image gradient information; According to the image gradient information, the pixel value in the optimized perturbation sample is obtained; Pre-set maximum perturbation threshold The pixel value exceeding the maximum perturbation threshold range in the optimized perturbation sample is clamped to the maximum perturbation threshold, the optimized perturbation sample is constrained, and an initial adversarial sample is obtained; the maximum perturbation threshold range is [original image sample- , original image sample+ ].

5. The method of claim 4, wherein, The calculation method of the initial adversarial sample is: In the formula, represents the i-th initial adversarial sample of the t-th iteration, and clip represents a clipping function, represents a maximum perturbation threshold; γ represents a step size, represents a gradient operation, represents a loss value of the predicted value of the i-1-th initial adversarial sample of the t-th iteration and the true label, and y represents the true label.

6. The method of claim 5, wherein the same semantic feature based adversarial sample generation method is characterized by, The specific method for determining whether the initial adversarial sample meets the preset requirements is: Input the initial adversarial sample into the neural network model to be attacked to output an initial adversarial sample prediction label; compare the initial adversarial sample prediction label with the true label of the corresponding original image sample, and if they are not the same, it is determined that the initial adversarial sample meets the preset requirements; If the same, determine whether the current iteration is less than the preset maximum iteration; if less, determine that the initial adversarial sample does not meet the preset requirement; if not less than, Determine that the initial adversarial sample meets the preset requirement.

7. The method of claim 1 or 6, wherein, The neural network model to be attacked is any one of Inception V3, Inception V4, Inception-ResNet V2, ResNet50 V2, ResNet101 V2, ResNet152 V2, Inc-v3adv, Inc-v3ens3, Inc-v3ens4 or IncRes-v2ens.

8. A same semantic feature based adversarial sample generation system for implementing the generation method of any one of claims 1-7, characterized in that, Comprise: The acquisition module is used for acquiring the original image sample and the neural network model to be attacked, and generating a perturbation sample corresponding to the original image sample; The similarity score calculation module is used for inputting the original image sample and the perturbation sample into the neural network model to be attacked, calculating the first similarity score of the perturbation sample and the corresponding original image sample, and the second similarity score of the perturbation sample and other original image samples; The perturbation sample optimization module is used for setting corresponding weight factors for the first similarity score and the second similarity score, adjusting the perturbation sample according to the first similarity score and the weight factor thereof, the second similarity score and the weight factor thereof, and obtaining an optimized perturbation sample; The perturbation sample constraint module is used for calculating the upper bound of the optimized perturbation sample by using a first-order derivative approximation algorithm, and constraining the optimized perturbation sample by using the upper bound to obtain an initial adversarial sample; The adversarial sample generation module is used for determining whether the initial adversarial sample meets the preset requirement; if yes, the initial adversarial sample is taken as the final adversarial sample; If not, the initial adversarial sample is taken as a new perturbation sample, and the similarity score calculation module is returned until the preset requirement is met, and the final adversarial sample is obtained.

Images