An adversarial sample generation method based on AdvDrop

Abstract

The application discloses an adversarial sample generation method based on AdvDrop, relates to the technical field of machine learning security, and processes two different branches of an image input space domain and a frequency domain; for the frequency domain attack AdvDrop, first, the input image is segmented into N*N blocks, and discrete cosine transform (DCT) is used on each block to convert them to the frequency domain; a quantization matrix M is introduced to reduce some specific frequencies of the transformed image; a tangent function is introduced in the quantization process to gradually approach the quantization function, and then the quantization matrix M is accurately adjusted through the new quantization function; then, the image is converted from the frequency domain to the space domain through inverse discrete cosine transform (IDCT) operation; finally, the space domain attack and the frequency domain attack fusion module are used to iteratively update the adversarial perturbation by using the gradients from different fields, and the adversarial sample is generated; the quality of the generated adversarial sample is improved, the difference between the distribution characteristics of the adversarial sample and the distribution characteristics of the real sample is reduced, and the attack success rate is improved.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence security, and more specifically, to an adversarial example generation method based on AdvDrop. Background Technology

[0002] With the development of deep learning and generative adversarial networks (GANs), the security of deep neural networks has gradually become a research focus in artificial intelligence security issues. Although deep neural networks perform well in most classification tasks, they are very vulnerable to adversarial examples. Adversarial examples are a type of sample formed by adding subtle perturbations to the dataset. The generated adversarial examples can induce machine learning models to make incorrect classifications, posing a threat to the security of the model.

[0003] With Szegedy et al. first revealing the vulnerability of deep neural networks and proposing the concept of adversarial examples in 2013, adversarial attacks officially became a research area in deep learning security. Subsequent researchers, based on the high-dimensional linear hypothesis of CNNs, proposed a Fast Gradient Sign Method (FGSM), which creates perturbations along the direction opposite to the gradient of the loss function to cause the model to misjudge. Various improvements have been made to FGSM, one type being the introduction of iterative ideas. The Basic Iterative Method (BIM) adds an iterative process to FGSM, hence it is also called I-FGSM. This method works along the direction of gradient ascent. Multi-step perturbation, with recalculation of the gradient direction after each small step, can generate adversarial examples closer to the optimal solution than FGSM, but at the cost of increased computation. Another approach is to introduce momentum, which increases the speed of gradient descent by accumulating the velocity vector along the gradient direction of the loss function during iteration. The Momentum Iteration Method (MI-FGSM) proposed by Dong et al. integrates momentum into I-FGSM, which can stably update the direction during iteration. In addition, the CW attack algorithm proposed by Carlini and Wagner is the first to combine the two optimization problems of perturbation minimization and loss function maximization into a single objective function.

[0004] However, the aforementioned methods are considered spatial perturbation attacks, generating adversarial examples by altering the pixels of the original image. Although the generated adversarial examples have a high misleading rate on the model, they are easily distinguishable to the human eye. Therefore, many works attempt to understand the mechanism by which adversarial attacks work from the adversarial noise itself. Some researchers have found that adversarial examples compressed with JPG, when processed by the same network, have improved prediction accuracy compared to uncompressed adversarial examples. The JPEG algorithm used for compression undergoes five processes: YUV conversion, chroma subsampling, discrete cosine transform (DCT), quantization, and encoding. Among these, chroma subsampling can be seen as downsampling the image. In the quantization process, some high-frequency information is discarded from the frequency domain data after DCT processing; the rest are lossless processes. Therefore, the JPEG algorithm can be seen as compression that discards high-frequency information, and JPG transformation can also be interpreted as discarding high-frequency information in the adversarial image. Ng et al. conducted a more systematic study on the impact of high-frequency information on DCNN. They first proved that a well-trained DCNN is highly dependent on high-frequency information. Even using only the high-frequency parts of the image that are not recognizable by the human eye, it can achieve high-confidence classification. However, the classification effect is greatly reduced or even impossible for low-frequency images that are recognizable by the human eye after removing the high-frequency parts. Duan et al. divided the image into frequencies and compared the statistical characteristics of each frequency band of the original sample and the adversarial sample. They found that the low-frequency component (low-frequency signal) of the adversarial sample represents the area in the image where the brightness or gray value changes slowly, that is, the large flat area in the image. It describes the main part of the image and mainly measures the overall intensity of the image. The high-frequency component (high-frequency signal) of the adversarial sample corresponds to the part of the image that changes drastically, that is, the edge (contour) or noise and details of the image. It mainly measures the edge and contour of the image.

[0005] Traditional attack methods suffer from drawbacks such as slow sample generation speed and high computational cost. The process of generating samples requires obtaining structural information and parameter content of the target model, resulting in limited applicability. Furthermore, the generated adversarial samples are of low quality, the added perturbations can be identified by humans, the success rate of generating adversarial samples is low, and the attack has low transferability. Summary of the Invention

[0006] To overcome the aforementioned shortcomings of low-quality adversarial samples generated by existing technologies, this invention provides an AdvDrop-based adversarial sample generation method that can generate high-quality adversarial samples and improve the success rate of adversarial sample generation.

[0007] To achieve the above objectives, the present invention proposes the following technical solution:

[0008] An adversarial example generation method based on AdvDrop includes the following steps:

[0009] S1: Obtain the original image;

[0010] S2: Input the original image into two different branches. One branch uses PGD to attack the spatial domain of the original image to obtain preliminary adversarial samples; the other branch uses Advdorp to attack the frequency domain of the original image to obtain the first image.

[0011] S3: The first image obtained in step S2 is merged into the preliminary adversarial sample obtained in step S2, and the perturbation is updated using gradients from different domains to generate the final adversarial sample.

[0012] Further, in step S2, the PGD is used to attack the spatial domain of the image to obtain the preliminary adversarial sample input classification model for classification, specifically as follows:

[0013]

[0014] In the formula, x represents image information, its label is y, and θ represents the parameters of the classification model. It is the value of the loss function, x t It is an adversarial example processed by the FGSM algorithm t times, x t+1 This is an adversarial example processed by the FGSM algorithm for t+1 iterations. The sign function sign() extracts the gradient direction, and the parameter β represents the magnitude of the image pixel update in each iteration. a+S Let represent a+S iterations. For each image pixel 'a', a set of perturbations 'S' is introduced. In the PGD algorithm for attacking the spatial domain, the specific method for maximizing the loss function is as follows:

[0015] arg max L(x adv ,y),st||x adv -x init || p <∈

[0016] In the formula x init The image is the original image, where y represents the corresponding true / false label, and x represents the true / false label. adv For adversarial examples, ∈ represents the Lp norm.

[0017] Furthermore, the other branch uses Advdorp to attack the frequency domain of the original image to obtain the first image. The specific steps include:

[0018] S2.1: Divide the input image into N*N blocks and apply DCT to each block to transform the original image from the spatial domain to the frequency domain;

[0019] S2.2: By adjusting the input original image, the loss function in the frequency domain reaches its maximum value;

[0020] S2.3: Calculate the adversarial loss P for each block after it has been partitioned in the frequency domain. n+1 ;

[0021] S2.4: Introduce the quantization matrix M for quantization operation;

[0022] S2.5: Introducing the differential quantization function M diff By introducing a tangent function during the quantization process, the quantization function is gradually approximated, thereby accurately adjusting the quantization matrix M.

[0023] S2.6: Combine the quantization matrix M obtained in step S2.5 with the adversarial loss P obtained in step S2.3. n+1 To merge;

[0024] S2.7: Apply IDCT to convert the N*N blocks in the frequency domain after modifying the image frequency back to the spatial domain.

[0025] Furthermore, the method for calculating the maximum value of the loss function in the frequency domain by adjusting the input original image in step S2.2 is as follows:

[0026] arg max L(D'(F(D(X adv ))),θ,y),st||D(X adv )-D(X)|| p <∈

[0027] In the formula, D() is the DCT operation, F() represents the modification of image frequencies, D'() is the IDCT operation, θ is the parameter of the classification model, y is the label of the input image, X is the original image, ∈ is the LP norm, and X adv It is an adversarial example.

[0028] Further, in step S2.3, the adversarial loss P is calculated for each block separated in the frequency domain. n+1 The process is as follows:

[0029]

[0030] In the formula, ω is the step size of each iteration, D() is the DCT operation, D'() is the IDCT operation, F() represents the modification of image frequencies, θ is the parameters of the classification model, y is the label of the original image, and P... n It is the adversarial loss when updating to step n. It is an adversarial example that has undergone n iterations.

[0031] Further, in step S2.4, the quantization operation is performed by introducing a quantization matrix M, and the quantization operation is as follows:

[0032]

[0033] In the formula, Δ represents the quantization step size, and the quantized value is restricted to a valid range [∈ min ,∈ max ], M is the quantization matrix.

[0034] Further, in step S2.5, the differential quantization function M is introduced. diff By introducing a tangent function during the quantization process to gradually approach the quantization function, the quantization matrix M is accurately adjusted. The differential quantization function M... diff Specifically:

[0035]

[0036] φ(·) is defined as follows:

[0037]

[0038] In the formula, α is an adjustable parameter, and the quantization matrix M is updated using the gradient sign returned by backpropagation. The above process is expressed as:

[0039]

[0040] ∈ restricts the norm of the quantization matrix M, M init Let L(x',y) represent the initial quantization matrix, M represent the quantization matrix, L(x',y) represent the loss, and M' be the updated quantization matrix.

[0041] Further, in step S2.6, the quantization matrix M obtained in step S2.5 is combined with the adversarial loss P obtained in step S2.3. n+1 The fusion process is as follows:

[0042]

[0043] In the formula, ⊙ represents the Hadamard product. For the adversarial example after n iterations, D() is the DCT operation, F() modifies the image frequencies, M is the quantization matrix, and P... n+1 It is a counter-loss.

[0044] Further, in step S2.7, the IDCT is applied to convert the N*N blocks with modified image frequencies in the frequency domain back to the spatial domain. The IDCT expression is as follows:

[0045]

[0046] In the formula Dx u,vLet x be the frequency domain representation of the input image x after discrete cosine transform, let x[k,m] be the coefficient at position (u,v) in the frequency domain, let x[k,m] be the coordinates of the image in the frequency domain transformed to the spatial domain, let C(u) and C(v) be the scaling factors, let i and j be the loop variables with values ​​ranging from 0 to N-1, and let N be the size of each block.

[0047] Furthermore, in step S3, the first image obtained in step S2 is merged into the preliminary adversarial example obtained in step S2, and the perturbation is updated iteratively using gradients from different domains to finally generate the adversarial example, including the following steps:

[0048] S10.1: Let Ω S and Ω F These represent the attacks on the spatial domain of the image using PGD and the attacks on the frequency domain of the image using AdvDrop, respectively. Gradients from different domains are updated based on adversarial losses within the frequency domain. The attack on the frequency domain using AdvDrop is Ω. F The calculation method is as follows:

[0049]

[0050] In the formula, η' is the frequency value after the attack, η is the original image frequency, and γ f θ is the step size in the frequency domain, θ is the parameter of the classification model, and y is the label of the input image;

[0051] S10.2: Then, the gradient is updated based on the adversarial loss in the spatial domain, and PGD is used to attack the spatial domain of the image Ω. S The calculation method is as follows:

[0052]

[0053] In the formula, η” is the pixel value, and γ s Let θ be the step size in the spatial domain, y be the parameters of the classification model, and y be the label of the input image. Then, the pixel value η is calculated using the adversarial loss in the spatial domain. The calculation method for the pixel value η is as follows:

[0054]

[0055] In the formula, η' represents the frequency value after the attack, η” is the pixel value, and γ s The step size in the spatial domain;

[0056] S10.3: After each iteration, switch the order in which AdvDrop attacks the frequency domain of the image. The order is switched alternately between the frequency domain and the spatial domain according to the adversarial loss to generate adversarial input samples, causing the classification model to produce incorrect classification results and generating the final adversarial samples.

[0057] Compared with the prior art, the beneficial effects of the technical solution of the present invention are:

[0058] This invention proposes an Adverbial Example Generation Method based on AdvDrop, which combines spatial domain attacks and frequency domain attacks to generate adversarial examples. In the frequency domain attack, a quantization matrix M is proposed, and the amount of frequency domain detail discarded is increased by expanding the interval of the quantization matrix M. Furthermore, a differential quantization matrix M is proposed. diff This invention gradually approximates the quantization function by introducing a tangent function during the quantization process. This method generates more natural perturbations, making the image quality of adversarial samples closer to the original image. Furthermore, this invention combines spatial and frequency domain attacks, attacking Ω by switching frequencies each time. F and spatial attack Ω S The order of operations improves the speed and quality of adversarial sample generation; it also reduces the difference between the distribution characteristics of adversarial samples and those of real samples, increasing the difficulty of human identification while improving the success rate of attacks. Attached Figure Description

[0059] Figure 1 This is a flowchart of an adversarial example generation method based on AdvDrop provided by the present invention;

[0060] Figure 2 This is a flowchart of an adversarial example generation method based on AdvDrop provided in an embodiment of the present invention;

[0061] Figure 3 This is a flowchart of frequency domain attacks using Advdorp provided by the present invention;

[0062] Figure 4 This invention provides a flowchart for generating adversarial examples by updating perturbations using gradients from different domains. Detailed Implementation

[0063] The accompanying drawings are for illustrative purposes only and should not be construed as limiting the scope of this patent.

[0064] To better illustrate this embodiment, some parts in the accompanying drawings may be omitted, enlarged, or reduced, and do not represent the actual product dimensions;

[0065] It will be understood by those skilled in the art that certain well-known structures and their descriptions may be omitted in the accompanying drawings;

[0066] The technical solution of the present invention will be further described below with reference to the accompanying drawings and embodiments.

[0067] Example 1

[0068] This invention provides an Adverbial Example Generation Method based on AdvDrop. This method uses a branching framework to process information in both the spatial and frequency domains simultaneously as the method for generating adversarial examples. The flowchart of the method is shown below. Figure 1 As shown, the specific steps include:

[0069] S1: Obtain the original image;

[0070] S2: Input the original image into two different branches. One branch uses PGD to attack the spatial domain of the original image to obtain preliminary adversarial samples; the other branch uses Advdorp to attack the frequency domain of the original image to obtain the first image.

[0071] S3: The first image obtained in step S2 is merged into the preliminary adversarial sample obtained in step S2, and the perturbation is updated using gradients from different domains to generate the final adversarial sample.

[0072] Example 2

[0073] This embodiment, based on embodiment 1, continues to disclose the following content, such as... Figure 2 As shown:

[0074] In the specific implementation of this embodiment, random noise is first added to the real samples to obtain noise-enhanced samples; then, the image is processed in two different branches: the spatial domain and the frequency domain. The first branch uses spatial domain attack PGD. In step S2, the PGD is used to attack the spatial domain of the image to obtain the preliminary adversarial sample input classification model for classification, specifically:

[0075]

[0076] In the formula, x represents image information, its label is y, and θ represents the parameters of the classification model. It is the value of the loss function, x t It is an adversarial example processed by the FGSM algorithm t times, x t+1 This is an adversarial example processed by the FGSM algorithm for t+1 iterations. The sign function sign() extracts the gradient direction, and the parameter β represents the magnitude of the image pixel update in each iteration. a+S Let represent a+S iterations. For each image pixel 'a', a set of perturbations 'S' is introduced. In the PGD algorithm for attacking the spatial domain, the specific method for maximizing the loss function is as follows:

[0077] arg max L(x adv ,y),st||x adv -x init || p <∈

[0078] In the formula x init The image is the original image, where y represents the corresponding true / false label, and x represents the true / false label. adv For adversarial examples, ∈ represents the Lp norm.

[0079] Example 3

[0080] This embodiment, based on embodiment 1, continues to disclose the following content, such as... Figure 3 As shown:

[0081] The second branch introduces the frequency domain attack AdvDrop, which introduces an adversarial perturbation P when training an AdvDrop-based neural network. n+1 To improve the adversarial performance of the model, specifically, Dropout regularization is used to randomly delete some neurons in each training iteration. When adversarial perturbations are introduced, the deletion probability of Dropout can be gradually reduced to gradually reduce the perturbation. For the frequency domain attack AdvDrop, the input image is first divided into N*N blocks, and DCT is used to transform each block to the frequency domain. The principle of DCT transformation to compress the image is to reduce the high-frequency components in the image. High frequencies mainly correspond to the details in the image, and the human eye is not very sensitive to details, so the amount of high-frequency information can be removed.

[0082] The DCT expression is as follows:

[0083]

[0084] In the formula, x[k,m] represents the coordinates of the image, C[u] and C(v) are used to make the DCT matrix orthogonal, N is the size of each block, and in this invention N=8. Then, an initial perturbation P~U(0,1) is generated and injected into the frequency band.

[0085] In step S2, the other branch uses Advdorp to attack the frequency domain of the original image to obtain the first image. The specific steps include:

[0086] S2.1: Divide the input image into N*N blocks and apply DCT to each block to transform the original image from the spatial domain to the frequency domain;

[0087] S2.2: By adjusting the input original image, the loss function in the frequency domain reaches its maximum value;

[0088] S2.3: Calculate the adversarial loss P for each block after it has been partitioned in the frequency domain. n+1 ;

[0089] S2.4: Introduce a quantization matrix M for quantization operations;

[0090] S2.5: Introducing the differential quantization function Mdiff By introducing a tangent function during the quantization process, the quantization function is gradually approximated, thereby accurately adjusting the quantization matrix M.

[0091] S2.6: Combine the quantization matrix M obtained in step S2.5 with the adversarial loss P obtained in step S2.3. n+1 To merge;

[0092] S2.7: Apply IDCT to convert the N*N blocks in the frequency domain after modifying the image frequency back to the spatial domain;

[0093] In step S2.2, the method for calculating the maximum value of the loss function in the frequency domain by adjusting the input original image is as follows:

[0094] arg max L(D'(F(D(X adv ))),θ,y),st||D(X adv )-D(X|| p <∈

[0095] In the formula, D() is the DCT operation, F() represents the modification of image frequencies, D'() is the IDCT operation, θ is the parameter of the classification model, y is the label of the input image, X is the original image, ∈ is the LP norm, and X adv It is an adversarial example;

[0096] In step S2.3, the adversarial loss P is calculated for each block that has been segmented in the frequency domain. n+1 The process is as follows:

[0097]

[0098] In the formula, ω is the step size of each iteration, D() is the DCT operation, D'() is the IDCT operation, F() represents the modification of image frequencies, θ is the parameters of the classification model, y is the label of the original image, and P... n It is the adversarial loss when updating to step n. It is an adversarial example that has undergone n iterations;

[0099] In step S2.4, the quantization operation is performed by introducing a quantization matrix M. The quantization operation is as follows:

[0100]

[0101] In the formula, Δ represents the quantization step size, and the quantized value is restricted to a valid range [∈ min ,∈ max M is the quantization matrix;

[0102] To accurately adjust the quantization matrix M and further improve the success rate of the attack, this invention utilizes the gradient of the target model f through backpropagation, describing the entire process as an optimization problem. It is a step function, therefore a non-differential function, and cannot be directly integrated into the optimization through backpropagation. Step S2.5 involves introducing the differential quantization function M. diff By introducing a tangent function during the quantization process to gradually approximate the quantization function, the quantization matrix M is accurately adjusted. The differential quantization function M... diff Specifically:

[0103]

[0104] φ(·) is defined as follows:

[0105]

[0106] In the formula, α is an adjustable parameter, and the quantization matrix M is updated using the gradient sign returned by backpropagation. The above process is expressed as:

[0107]

[0108] ∈ restricts the norm of the quantization matrix M, M init Let M be the initial quantization matrix, L(x',y) be the quantization matrix, L(x',y) be the loss, and M' be the updated quantization matrix.

[0109] In differential quantization, adjacent weights are quantized to the same number of bits, and then the difference is calculated between these quantized values. Through differential quantization, the number of parameters in the quantization matrix M is reduced by half without significantly reducing the performance of the model. In addition, differential quantization can also reduce the model's storage space and computational cost, thereby speeding up the training and inference of the model.

[0110] The quantization matrix M obtained in step S2.5 is compared with the adversarial loss P obtained in step S2.3. n+1 The fusion process is as follows:

[0111]

[0112] In the formula, ⊙ represents the Hadamard product. For the adversarial example after n iterations, D() is the DCT operation, F() modifies the image frequencies, M is the quantization matrix, and P... n+1 It is a counter-cyclical loss;

[0113] Step S2.7, the IDCT is applied to transform the N*N blocks with modified image frequencies in the frequency domain back to the spatial domain. The IDCT expression is as follows:

[0114]

[0115] In the formula Dx u,v Let x be the frequency domain representation of the input image x after discrete cosine transform, let x[k,m] be the coefficient at position (u,v) in the frequency domain, let x[k,m] be the coordinates of the image in the frequency domain transformed to the spatial domain, let C(u) and C(v) be the scaling factors, let i and j be the loop variables with values ​​ranging from 0 to N-1, and let N be the size of each block.

[0116] Example 4

[0117] This embodiment, based on embodiment 1, continues to disclose the following content, such as... Figure 4 As shown, it includes the following steps:

[0118] This embodiment provides an adversarial example generation method based on AdvDrop, which combines spatial domain attack PGD and frequency domain attack AdvDrop through a fusion module; in step S3, the first image obtained in step S2 is merged into the preliminary adversarial example obtained in step S2, and the perturbation is updated iteratively using gradients from different domains to finally generate the adversarial example, including the following steps:

[0119] S10.1: Let Ω S and Ω F These represent the attacks on the spatial domain of the image using PGD and the attacks on the frequency domain of the image using AdvDrop, respectively. Gradients from different domains are updated based on adversarial losses within the frequency domain. The attack on the frequency domain using AdvDrop is Ω. F The calculation method is as follows:

[0120]

[0121] In the formula, η' is the frequency value after the attack, η is the original image frequency, and γ f θ is the step size in the frequency domain, θ is the parameter of the classification model, and y is the label of the input image;

[0122] S10.2: Then, the gradient is updated based on the adversarial loss in the spatial domain, and PGD is used to attack the spatial domain of the image Ω. S The calculation method is as follows:

[0123]

[0124] In the formula, η” is the pixel value, and γ s Let θ be the step size in the spatial domain, y be the parameters of the classification model, and y be the label of the input image. Then, the pixel value η is calculated using the adversarial loss in the spatial domain. The calculation method for the pixel value η is as follows:

[0125]

[0126] In the formula, η' represents the frequency value after the attack, η” is the pixel value, and γ s The step size in the spatial domain;

[0127] S10.3: After each iteration, switch the order in which AdvDrop attacks the frequency domain of the image. Alternately switch between the frequency domain and the spatial domain according to the adversarial loss to generate adversarial input samples. Optimize the frequency values ​​in the frequency domain and then optimize the pixel values ​​in the spatial domain. By alternating optimization, the adversarial attack can be made more effective and deceive the target model, causing the classification model to produce incorrect classification results, thus generating the final adversarial sample.

[0128] The same or similar labels correspond to the same or similar parts;

[0129] The terms used to describe positional relationships in the accompanying drawings are for illustrative purposes only and should not be construed as limiting this patent.

[0130] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the present invention, and are not intended to limit the implementation of the present invention. Those skilled in the art can make other variations or modifications based on the above description. It is neither necessary nor possible to exhaustively describe all embodiments here. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the claims of the present invention.

Claims

1. A method for generating adversarial examples based on AdvDrop, characterized in that, Includes the following steps: S1: Obtain the original image; S2: Input the original image into two different branches. One branch uses PGD to attack the spatial domain of the original image to obtain preliminary adversarial samples; the other branch uses AdvDrop to attack the frequency domain of the original image to obtain the first image. S3: The first image obtained in step S2 is merged into the preliminary adversarial sample obtained in step S2, and the perturbation is updated using gradients from different domains to generate the final adversarial sample; In step S2, the other branch uses AdvDrop to attack the frequency domain of the original image to obtain the first image. The specific steps include: S2.1: Divide the input image into N*N blocks and apply DCT to each block to transform the original image from the spatial domain to the frequency domain; S2.2: By adjusting the input original image, the loss function in the frequency domain reaches its maximum value; S2.3: Calculate the adversarial loss P for each block after it has been partitioned in the frequency domain. n+1 ; S2.4: Introduce a quantization matrix M for quantization operations; S2.5: Introducing the differential quantization function M diff By introducing a tangent function during the quantization process, the quantization function is gradually approximated, thereby accurately adjusting the quantization matrix M. S2.6: Combine the quantization matrix M obtained in step S2.5 with the adversarial loss P obtained in step S2.

3. n+1 To merge; S2.7: Apply IDCT to convert the N*N blocks of the image with modified frequency in the frequency domain back to the spatial domain.

2. The method for generating adversarial examples based on AdvDrop according to claim 1, characterized in that, In step S2, the process of using PGD to attack the spatial domain of the original image to obtain preliminary adversarial sample input classification models for classification is as follows: In the formula, x represents image information, its label is y, and θ represents the parameters of the classification model. It is the value of the loss function, x t It is an adversarial example processed by the FGSM algorithm t times, x t+1 This is an adversarial example processed by the FGSM algorithm for t+1 iterations. The sign function sign() extracts the gradient direction, and the parameter β represents the magnitude of the image pixel update in each iteration. a+S Let represent a+S iterations. For each image pixel 'a', a set of perturbations 'S' is introduced. In the PGD algorithm for attacking the spatial domain, the specific method for maximizing the loss function is as follows: arg maxL(X adv ,y),s.t.||X adv -x init || p < In the formula x init The image is the original image, where y is the label and X is the image. adv For adversarial examples, For the perturbation of the Lp norm.

3. The method for generating adversarial examples based on AdvDrop according to claim 1, characterized in that, In step S2.2, the method for calculating the maximum value of the loss function in the frequency domain by adjusting the input original image is as follows: arg max L(D′(F(D(X adv ))),θ,y),st||D(X adv )-D(X)|| p < In the formula, D() is the DCT operation, F() represents the modification of image frequencies, D′() is the IDCT operation, θ is the parameter of the classification model, y is the label, and X is the original image. It is a perturbation of the LP norm, X adv It is an adversarial example.

4. The Adverbial Example Generation Method Based on AdvDrop according to claim 1, characterized in that, In step S2.3, the adversarial loss P is calculated for each block that has been segmented in the frequency domain. n+1 The process is as follows: In the formula, ω is the step size of each iteration, D() is the DCT operation, D′() is the IDCT operation, F() represents the modification of image frequencies, θ is the parameter of the classification model, y is the label, and P n It is the adversarial loss when updating to step n. It is an adversarial example that has undergone n iterations.

5. The method for generating adversarial examples based on AdvDrop according to claim 1, characterized in that, In step S2.4, the quantization operation is performed by introducing a quantization matrix M. The quantization operation is as follows: In the formula, Δ represents the quantization step size, and the quantized value is limited to a valid range. M is the quantization matrix, and x is the image information.

6. The adversarial example generation method based on AdvDrop according to claim 1, characterized in that, Step S2.5, the introduction of the differential quantization function M diff By introducing a tangent function during the quantization process to gradually approach the quantization function, the quantization matrix M is accurately adjusted. The differential quantization function M... diff Specifically: φ(·) is defined as follows: In the formula, α is an adjustable parameter, and the quantization matrix M is updated using the gradient sign returned by backpropagation. The above process is expressed as: M represents the perturbation of the Lp norm. init Let M be the initial quantization matrix, L(x',y) be the quantization matrix, M' be the loss, and x be the image information.

7. The method for generating adversarial examples based on AdvDrop according to claim 1, characterized in that, Step S2.6, the quantization matrix M obtained in step S2.5 is combined with the adversarial loss P obtained in step S2.

3. n+1 The fusion process is as follows: In the formula, ⊙ represents the Hadamard product. For the adversarial example after n iterations, D() is the DCT operation, F() modifies the image frequencies, M is the quantization matrix, and P... n+1 It is a counter-loss.

8. The method for generating adversarial examples based on AdvDrop according to claim 1, characterized in that, Step S2.7, the IDCT is applied to transform the N*N blocks with modified image frequencies in the frequency domain back to the spatial domain. The IDCT expression is as follows: In the formula, D(x) [u,v] Let x be the frequency domain representation of the input image x after discrete cosine transform, let x[k,m] be the coefficient at position (u,v) in the frequency domain, let x[k,m] be the coordinates of the image in the frequency domain transformed to the spatial domain, let C(u) and C(v) be the scaling factors, let i and j be the loop variables with values ​​ranging from 0 to N-1, and let N be the size of each block.

9. The method for generating adversarial examples based on AdvDrop according to claim 1, characterized in that, In step S3, the first image obtained in step S2 is merged into the preliminary adversarial example obtained in step S2, and the perturbation is updated iteratively using gradients from different domains to finally generate the adversarial example, including the following steps: S10.1: Let Ω S and Ω F These respectively represent the use of PGD to attack the spatial domain of the original image and the use of AdvDrop to attack the frequency domain of the image. Gradients from different domains are updated based on adversarial loss in the frequency domain. The AdvDrop attack on the frequency domain of the image is described as follows: Ω F The calculation method is as follows: In the formula, η′ is the frequency value after the attack, η is the original image frequency, and γ f Let θ be the step size in the frequency domain, θ be the parameters of the classification model, and y be the label. It is the value of the loss function; S10.2: Then, the gradient is updated based on the adversarial loss in the spatial domain, and PGD is used to attack the spatial domain of the image Ω. s The calculation method is as follows: In the formula, η″ is the pixel value, and γ s Let θ be the step size in the spatial domain, y be the parameters of the classification model, and y be the label of the input image. Then, the pixel value η″ is calculated using the adversarial loss in the spatial domain. S10.3: After each iteration, switch the order in which AdvDrop attacks the frequency domain of the image. The order is switched alternately between the frequency domain and the spatial domain according to the adversarial loss to generate adversarial input samples, causing the classification model to produce incorrect classification results and generating the final adversarial samples.

Images