A migration-based adversarial sample preparation method

Abstract

The present application relates to the security field of image classification model, specifically relates to a kind of preparation method of adversarial sample based on migration, first, input image is copied according to the set sampling number and respectively adds disturbance, obtains a group of respectively near the decision boundary of substitute model in random direction boundary point sample;Then, using substitute model, the loss gradient of each boundary point sample is calculated;Afterwards, the average gradient of boundary point sample is calculated, and the disturbance of set step is added in the direction of average gradient, obtains the output image of current step;Finally, through the iteration of multiple times, adversarial sample is obtained.The method, by making full use of the decision boundary information of substitute model, boundary fitting is carried out, the migration of adversarial sample is enhanced, the migration range is wide, can effectively evaluate the model of multiple different structures, and the evaluation result is closer to the robustness lower limit of target model.Suitable for black-box model robustness evaluation based on migration.

Description

Technical Field

[0001] This invention relates to the field of image classification model security, specifically to a method for preparing adversarial examples through basis transfer. Background Technology

[0002] Currently, image classification models based on deep neural networks have achieved significant success. However, recent research has shown that adding imperceptible perturbations to clean samples can fool state-of-the-art models. This has prompted researchers to re-examine image classification models, attempting to find the reasons for their lack of robustness and striving to build more reliable image classification models. These samples, created by adding imperceptible perturbations to clean samples to deceive the model, are also known as adversarial examples.

[0003] Based on the understanding of the target model's internal mechanisms, adversarial attacks can be categorized into white-box attacks and black-box attacks. White-box attacks have complete access to the target model's training data, parameters, and structure, even the parameters and structure of its defenses; in other words, the target model's internal mechanisms are known. Black-box attacks, on the other hand, cannot obtain the target model's parameters and structure, only the type label of the target model's output; in other words, the target model's internal mechanisms are unknown. In practice, black-box attacks are more practical. Currently, black-box attack methods mainly include: transfer-based attacks, confidence score-based attacks, and decision boundary-based attacks.

[0004] Transfer-based attacks allow attackers to query the target model and access its training set. Then, based on this information, the attacker selects a known local model identical to the target model's training set, substitutes it for the target model, and performs a white-box attack on this substitute model, obtaining adversarial examples for evaluating the robustness of the target model. Therefore, research on transfer-based attacks focuses on transferability, i.e., the effectiveness of the attack after the adversarial example is transferred to the target model.

[0005] The transferability of adversarial examples is primarily influenced by the method of perturbation addition. Currently, the most commonly used method is gradient-based attack, derived from the Fast Gradient Sign Method (FGSM). The FGSM method generates adversarial examples by adding perturbations in the opposite direction of the original sample's gradient in a single iteration. However, the FGSM method has a low success rate due to its single-step iteration. Therefore, the Iterative Fast Gradient Sign Method (I-FGSM) was proposed, essentially transforming the single-step iteration of FGSM into multiple iterations. While the I-FGSM method improves the success rate of adversarial example attacks, the adversarial images generated by this method are prone to getting trapped in local optimization and overfitting to alternative models, thus weakening the transferability of the generated adversarial examples.

[0006] Therefore, several improvements have been made to the I-FGSM method. Among them, the MI-FGSM method (MomentumIterative Fast Gradient Sign Method) integrates the momentum term into the attack iteration process, stabilizing the update direction, preventing local optimization, and improving transferability. The VMI-FGSM method (Variance Tuning MI-FGSM) does not directly use the current gradient for momentum accumulation in each iteration, but instead adjusts the current gradient by considering the gradient variance of previous iterations to stabilize the update direction. The Curls&Whey method combines the directions of gradient ascent and descent, increasing the diversity of iteration trajectories and generating more transferable adversarial examples. In summary, current research mainly focuses on how to obtain a minimum perturbation and improve transferability, i.e., increase the success rate of the attack.

[0007] However, it should be noted that, in existing methods, whether for improving transferability or reducing perturbation magnitude, the determination of the perturbation direction primarily involves finding the direction of the largest gradient based on the initial input image. Then, based on this, the update direction is determined by the gradient between the current iteration and the previous iteration. In other words, each iteration is based on the gradient of the current sample in the replacement model. Therefore, the main problem lies in how to stabilize the update direction of the current sample. Figure 1 As shown, the iterative process of the Curls & Whey method is illustrated. In the figure, x represents the initial input image, each arrow represents one iteration, the two arrows in the two directions represent gradient ascent and gradient descent, and the solid line represents the decision boundary of the alternative model.

[0008] However, current methods only add perturbations based on the gradient of the current sample in the surrogate model, without considering the differences between the surrogate and target models. Although this ensures that adversarial examples can only attack specific target models, such as CNNs, and the success rate can reach a certain level, the adversarial examples they produce are not transferable enough and cannot successfully attack multiple unknown black-box models, leading to distorted evaluation results and an overestimation of the robustness of the target model. Summary of the Invention

[0009] The technical problem to be solved by this invention is to propose a transfer-based adversarial example preparation method, which produces adversarial examples with strong transferability and a wide transfer range, and can effectively evaluate models with different structures, with evaluation results closer to the robustness lower limit of the target model.

[0010] The technical solution adopted by the present invention to solve the above-mentioned technical problems is as follows:

[0011] A method for preparing adversarial examples based on migration includes the following steps:

[0012] S1. Obtain the initial image x for preparing adversarial examples. 0 Using a trained alternative model whose internal mechanisms are known, classify it to obtain its category label y; then use the initial image x 0 As the initial input image, proceed to step S2;

[0013] S2, Input image x t The input image is copied N times according to a set number of samplings, and perturbations are added to each copy. After the perturbation is added, each input image moves in a random direction toward the decision boundary of the substitution model, resulting in N boundary point samples B. i (x t ), where the number of samplings N > 1, and i represents the i-th boundary point sample among the N boundary point samples, as shown in the following formula:

[0014]

[0015] Where f(·) is a function of the substitution model and is used to represent the image category output by the substitution model, and t represents the current iteration step; d i Indicates adding to the input image x t The perturbation that causes it to move toward the decision boundary of the alternative model, and d i ~N(0, σ 2 I), representing d i The perturbation direction is random and follows a Gaussian distribution, σ 2 I is the covariance matrix of a high-dimensional Gaussian distribution, I is a unit vector, σ is the standard deviation, and the preset value of σ should ensure that at least some samples in the N boundary point samples in the first iteration have f(x) t +di )≠f(x t ); r is the contraction factor and 0 <r<1,k i Denotes the number of contractions for the i-th sample as an integer ≥ 0, and ensures that all N samples satisfy f(B) i (x t ))=f(x t );

[0016] S3. Using the substitution model, samples B at each boundary point are used respectively. i (x t Perform forward propagation and calculate the gradient of the loss, as shown in the following formula:

[0017]

[0018] in, is the gradient sign, and J(·) is the loss function of the alternative model;

[0019] S4. Calculate the N boundary point samples B. i (x t The average gradient of the gradient corresponding to the given gradient is used; then, according to the set single-step perturbation step size, and with the direction of the average gradient as the perturbation direction of the current step, the attack perturbation of the current step is obtained; the attack perturbation of the current step is added to the input image to obtain the output image x of the current step. t+1 ;

[0020] S5, using the output image x of the current step t+1 As a new input image, repeat steps S1 to S5 until the set number of iterations T is reached to obtain the final adversarial sample x. T .

[0021] Specifically, the number of sampling times N ≥ 5.

[0022] Specifically, the number of samplings N ≤ 25.

[0023] Specifically, the contraction factor r is set to: 0.5 ≤ r ≤ 0.7.

[0024] Specifically, the number of contractions k ≤ 5 and the set value of σ is adapted accordingly.

[0025] Specifically, in step S4, the attack perturbation for the current step is obtained by setting the single-step perturbation step size and using the direction of the average gradient as the perturbation direction for the current step; the attack perturbation for the current step is added to the input image to obtain the output image x for the current step. t+1 The formula is as follows:

[0026]

[0027]

[0028]

[0029] in, The cropping function is a function whose output image is located in [x]. 0 -ε,x 0 Within +ε], ε is the preset maximum perturbation, and sign(·) is the sign function.

[0030] Specifically, the number of iterations T is set to 10, and the maximum perturbation ε is set to 16.

[0031] Specifically, the alternative model is obtained by training on the same training set as the black-box model to be evaluated.

[0032] Specifically, the alternative model employs convolutional neural networks or Transformers.

[0033] The beneficial effects of this invention are:

[0034] Transfer-based black-box attacks are a type of substitution attack based on local models. They rely on the similarity of decision boundaries between the target and substitution models, thus enabling the transferability of their adversarial examples. Existing research also shows that the adversarial subspace spans a large-dimensional continuous subspace, with different models sharing a significant portion of it, thereby achieving transferability. Therefore, finding a highly overlapping adversarial subspace can facilitate attacks. Based on this theory, the inventors further proved that sample gradients located at the decision boundary are more similar across different models. Therefore, the inventors hypothesize that using the sample gradient information of the substitution model's decision boundary to determine the direction of perturbation addition can find a more effective direction to cross the boundary.

[0035] Based on the above speculations, the method of this invention differs from existing technologies that primarily rely on the current gradient of the surrogate model when determining the direction of perturbation addition. It first finds a set of samples as close as possible to the decision boundary of the surrogate model. Then, based on the gradients of these samples, it performs boundary fitting. By fully utilizing the decision boundary information of the surrogate model, it enhances the transferability of adversarial examples, resulting in a wide transfer range and effectively evaluating models with various structures. The evaluation results are closer to the robustness lower bound of the target model. Furthermore, the core of this invention lies in the change in the method of determining the direction of perturbation addition, which can be easily combined with other existing gradient-based methods to achieve improvements. Attached Figure Description

[0036] Figure 1 A schematic diagram of the iteration process of the Curls & Whey method;

[0037] Figure 2This is a schematic diagram illustrating the determination of the perturbation addition direction in the adversarial sample preparation method of the present invention;

[0038] Figure 3 This is a graph showing the correlation between the shrinkage factor r and mobility in the adversarial sample preparation method of this invention.

[0039] Figure 4 This is a graph showing the correlation between the number of samplings N and mobility in the adversarial example preparation method of this invention for a common model;

[0040] Figure 5 This is a graph showing the relationship between the number of samplings N for the defense model and the mobility of the adversarial sample preparation method of the present invention. Detailed Implementation

[0041] This invention aims to propose a transfer-based adversarial example preparation method, which produces adversarial examples with better transferability and can better evaluate the robustness of black-box models. The method is based on the inventors' hypothesis: by utilizing the gradient information of decision boundary samples from local models to determine the direction of perturbation addition, a more effective direction can be found to cross the boundary.

[0042] Table 1. Gradient cosine similarity of model pairs

[0043] gradient Experiment 1 Experiment 2 FGSM gradient <![CDATA[1.6e -2 ]]> <![CDATA[2.1e -3 ]]> Boundary point gradient (N=1) <![CDATA[1.8e -2 (12.5%↑)]]> <![CDATA[2.6e -3 (23.8%↑)]]> Boundary point gradient (N=20) <![CDATA[2.3e -2 (43.8%↑)]]> <![CDATA[3.0e -3 (42.9%↑)]]>

[0044] The above speculation is based on the inventors' research on gradients at the decision boundaries between different models. Table 1 shows the gradient cosine similarity of different model pairs. Specifically, the model pair in Experiment 1 is the alternative model Inc-v3 and the target model Inc-v4, and the model pair in Experiment 2 is the alternative model Inc-v3 and the target model IncRes-v2ens; the FGSM gradient is the gradient of the samples obtained using the FGSM method based on the alternative model, such as... Figure 2 As shown, x represents the initial image, x′ G Let x and x′ represent the samples obtained by the FGSM method. G The solid arrows represent the gradients, the dashed lines represent the boundaries of the target model, and the solid lines represent the boundaries of the alternative model; the boundary point gradients are the gradients of samples located on the decision boundaries of the alternative model obtained through an approximation method (step S2 of the method of this invention), such as... Figure 2 As shown, B1(x) and B2(x) represent samples at boundary points, and the dashed arrows between x and B1(x) and B2(x) represent their gradients; N is the number of boundary point samples, and the values ​​in the table are the cosine similarity of the gradients of the samples in the two models of the model pair. When N=20, it is the cosine similarity of the average gradient of each boundary point sample. The average gradient of each boundary point sample is shown in the table. Figure 2 x and x′ BThe solid arrows indicate that the values ​​in parentheses represent the percentage change in cosine similarity, and the arrows indicate an increase in similarity.

[0045] Through experiments, the inventors proved that the sample gradients located at the decision boundary are more similar in different models. Therefore, the inventors speculate that by using the decision boundary gradient information of the alternative model to determine the direction of perturbation addition, a more effective direction can be found to cross the boundary of the target model.

[0046] Based on the above speculation, the inventors propose a migration-based adversarial example preparation method according to the present invention, comprising the following steps:

[0047] S1. Obtain the initial image x for preparing adversarial examples. 0 Using a trained alternative model whose internal mechanisms are known, classify it to obtain its category label y; then use the initial image x 0 As the initial input image, proceed to step S2;

[0048] S2, Input image x t The input image is copied N times according to a set number of samplings, and perturbations are added to each copy. After the perturbation is added, each input image moves in a random direction toward the decision boundary of the substitution model, resulting in N boundary point samples B. i (x t ), where the number of samplings N > 1, and i represents the i-th boundary point sample among the N boundary point samples, as shown in the following formula:

[0049]

[0050] Where f(·) is a function of the substitution model and is used to represent the image category output by the substitution model, and t represents the current iteration step; d i Indicates adding to the input image x t The perturbation that causes it to move toward the decision boundary of the alternative model, and d i ~N(0, σ 2 I), representing d i The perturbation direction is random and follows a Gaussian distribution, σ 2 I is the covariance matrix of a high-dimensional Gaussian distribution, I is a unit vector, σ is the standard deviation, and the preset value of σ should ensure that at least some samples in the N boundary point samples in the first iteration have f(x) t +d i )≠f(x t ); r is the contraction factor and 0 < r < 1, k i Denotes the number of contractions for the i-th sample as an integer ≥ 0, and ensures that all N samples satisfy f(B) i (x t ))=f(x t );

[0051] S3. Using the substitution model, samples B at each boundary point are used respectively. i (x t Perform forward propagation and calculate the gradient of the loss, as shown in the following formula:

[0052]

[0053] in, is the gradient sign, and J(·) is the loss function of the alternative model;

[0054] S4. Calculate the N boundary point samples B. i (x t The average gradient of the gradient corresponding to the given gradient is used; then, according to the set single-step perturbation step size, and with the direction of the average gradient as the perturbation direction of the current step, the attack perturbation of the current step is obtained; the attack perturbation of the current step is added to the input image to obtain the output image x of the current step. t+1 ;

[0055] S5, using the output image x of the current step t+1 As a new input image, repeat steps S1 to S5 until the set number of iterations T is reached to obtain the final adversarial sample x. T .

[0056] The core of the method of the present invention lies in how to determine the direction of the disturbance; therefore, the key steps are steps S2 to S4.

[0057] First, based on step S2, by inputting the image x t Add a perturbation in a random direction. To construct boundary point samples. Where d i ~N(0, σ 2 I) Following a Gaussian distribution, a sufficiently large σ can be set to ensure that most samples cross the decision boundary of the model during the first iteration. In other words, the preset value of σ should ensure that at least some samples among the N boundary point samples in the first iteration have f(x) t +d i )≠f(x t Meanwhile, for those that cross decision-making boundaries, through... For d i Shrinking ensures that all N samples satisfy f(B) i (x t ))=f(x t ), that is:

[0058] In the first iteration, by shrinking and satisfying f(B) i (x t ))=f(x tThis allows the sample to return to the decision boundary, ensuring that it is close to the decision boundary;

[0059] In iterations following the first iteration, x might... t The decision boundary has been crossed, meaning that f(x) has now crossed the boundary. t )≠f(x 0 ), by contraction and satisfying f(B) i (x t ))=f(x t This ensures proximity to the decision boundary;

[0060] Therefore, it can ensure B i (x t It should be as close as possible to the decision boundary of the alternative model.

[0061] Then, through step S3, the gradient of each boundary point sample is obtained.

[0062] Finally, through step S4, the average gradient of each boundary point sample is obtained, and the direction of the average gradient is used as the final direction of adding perturbation in this iteration.

[0063] The method of this invention uses the average gradient of boundary point samples to determine the direction. Therefore, the number of samples N must be an integer greater than 1. It should be noted that the smaller the number of samples N, the greater the influence of a single boundary point sample on the final direction; conversely, the larger the number of samples N, the less the influence of a single boundary point sample on the final direction, resulting in better performance. The results in Table 1 also verify that a larger number of samples N leads to more similar gradients among the boundary samples. Therefore, based on subsequent verification experiments, to ensure a certain success rate, the number of samples N ≥ 5. However, a larger number of samples N results in a greater computational load, and according to subsequent verification experiments, once the number of samples N reaches a certain value, further increases in N offer limited performance improvement. Therefore, as a balance, the optimal number of samples N ≤ 25.

[0064] To further reduce computational overhead, the number of contractions k i ≤5 and the setting value of σ is appropriate.

[0065] The shrinkage factor r has several advantages and disadvantages. A smaller shrinkage factor r results in a larger shrinkage amount and lower accuracy, but requires fewer shrinkage cycles and thus less computation. Conversely, a larger shrinkage factor r results in a smaller shrinkage amount and higher accuracy, but requires more shrinkage cycles and thus more computation. Furthermore, with a limited number of shrinkage cycles, a larger shrinkage factor r can cause samples to move further away from the decision boundary. Therefore, as a balance, the shrinkage factor r is set to: 0.5 ≤ r ≤ 0.7.

[0066] After determining the direction of the perturbation, the size of the perturbation added in each iteration can be determined using any existing algorithm's step size determination method. In this embodiment, the I-FGSM method is used to calculate the perturbation step size for each iteration.

[0067] The alternative model can be obtained using any existing technology. In this embodiment, the alternative model is obtained by training on the same training set as the black-box model to be evaluated.

[0068] Example

[0069] The migration-based adversarial example preparation method in this embodiment includes the following steps:

[0070] S1. Obtain the initial image x for preparing adversarial examples. 0 A trained alternative model with known internal mechanisms is used to classify the image and obtain its category label y. This alternative model is trained on the same training set as the black-box model to be evaluated. The initial image x is then... 0 As the initial input image, proceed to step S2;

[0071] S2, Input image x t The input image is copied N times according to a set number of samplings, and perturbations are added to each copy. After the perturbation is added, each input image moves in a random direction toward the decision boundary of the substitution model, resulting in N boundary point samples B. i (x t ), where the number of samplings N > 1, and i represents the i-th boundary point sample among the N boundary point samples, as shown in the following formula:

[0072]

[0073] Where f(·) is a function of the substitution model and is used to represent the image category output by the substitution model, and t represents the current iteration step; d i Indicates adding to the input image x t The perturbation that causes it to move toward the decision boundary of the alternative model, and d i ~N(0, σ 2 I), representing d i The perturbation direction is random and follows a Gaussian distribution, σ 2 I is the covariance matrix of a high-dimensional Gaussian distribution, I is a unit vector, σ is the standard deviation, and the preset value of σ should ensure that at least some samples in the N boundary point samples in the first iteration have f(x) t +d i )≠f(x t ); r is the contraction factor and 0 < r < 1, k i Denotes the number of contractions for the i-th sample as an integer ≥ 0, and ensures that all N samples satisfy f(B) i (xt ))=f(x t );

[0074] S3. Using the substitution model, samples B at each boundary point are used respectively. i (x t Perform forward propagation and calculate the gradient of the loss, as shown in the following formula:

[0075]

[0076] in, is the gradient sign, and J(·) is the loss function of the alternative model;

[0077] S4. Calculate the N boundary point samples B. i (x t The average gradient of the gradient corresponding to the given gradient is used; then, according to the set single-step perturbation step size, and with the direction of the average gradient as the perturbation direction of the current step, the attack perturbation of the current step is obtained; the attack perturbation of the current step is added to the input image to obtain the output image x of the current step. t+1 The formula is as follows:

[0078]

[0079]

[0080]

[0081] in, The cropping function is a function whose output image is located in [x]. 0 -ε, x 0 Within +ε], ε is the preset maximum perturbation, and sign(·) is the sign function.

[0082] S5, using the output image x of the current step t+1 As a new input image, repeat steps S1 to S5 until the set number of iterations T is reached to obtain the final adversarial sample x. T .

[0083] Based on the above embodiments, and according to the settings of the existing I-FGSM method, the number of iterations T was set to 10, and the maximum perturbation ε was set to 16, and experimental verification was carried out.

[0084] First, Inc-v3 was used as an alternative model. Then, the impact of the contraction factor r was verified using six ordinary models and eleven defensive models as target models. The six ordinary models are: Inc-v3, Inc-v4, IncRes-v2, Res-50, Res-101, and Res-152. The eleven defensive models are: Inc-v3ens3, Inc-v3ens4, IncRes-v2ens, HGD, R&P, RS, NRP, and NIPS-r3. Res152B and Res152D. During verification, the number of samples N = 20 and the number of contractions k are set. i ≤5, and the migration of samples obtained at different shrinkage factors r was tested, and the results are as follows. Figure 3 As shown, the value is the average of multiple target models, where the dark, tall bars represent the normal model and the light, short bars represent the defense model. From Figure 3 As you can see, when the shrinkage factor r is small, the shrinkage amount is large, moving far from the decision boundary; therefore, its success rate, i.e., its transferability, is poor. When the shrinkage factor r is large, because the number of shrinkages is limited, the appropriate standard deviation σ is also small, causing samples other than those in the direction of large gradient to also move far from the decision boundary; therefore, its success rate, i.e., its transferability, is also poor. Therefore, the optimal shrinkage factor r is set to: 0.5 ≤ r ≤ 0.7. In the subsequent verification experiments, the shrinkage factor r was set to 0.6. The ordinary model refers to the model trained normally, i.e., the model where the existence of adversarial examples is not considered during training; the defensive model is a model with a defensive mechanism that can effectively reduce the adverse effects of adversarial examples.

[0085] Secondly, we used Inc-v3 as a replacement model, and then used three ordinary models and three defensive models as target models to verify the impact of the number of samplings N. The six ordinary models were: Inc-v4, IncRes-v2, and Res-152. The results are as follows: Figure 4 As shown; the three defense models are: Inc-v3ens4, HGD, and R&P, and the results are as follows. Figure 5 As shown. During verification, the contraction factor r = 0.6 and the number of contractions k are set. i The sampling number N was set to ≤5, and the transferability of samples obtained at different sampling times N was tested. As shown in the figure, the success rate was guaranteed when the sampling number N ≥ 5. However, as the sampling number N increases, the transferability of adversarial samples also continues to increase. However, the computational cost is proportional to the sampling number N. Therefore, the optimal sampling number N ≤ 25. In subsequent verification, the sampling number N was set to 20.

[0086] Most current adversarial example creation methods are limited to attacking only CNNs (Convolutional Neural Networks). However, existing research shows that Transformers have higher accuracy and robustness. Therefore, further validation experiments were conducted, including three settings: 1) CNNs as the substitute model and Transformers as the target model; 2) Transformers as the substitute model and CNNs as the target model; 3) Both the substitute and target models are Transformers, that is, the substitute model uses either a convolutional neural network or Transformers. Existing adversarial example creation methods were also compared to demonstrate the superiority of the method presented in this invention.

[0087] In the first experimental setup, CNNs were used as the alternative model, and Transformers were used as the target model. The number of sampling times N = 20 and the number of contractions k were set. i ≤5, shrinkage factor r=0.6. The results are shown in Table 2. As can be seen from Table 2, the adversarial sample prepared by the method of the present invention has a higher attack success rate and therefore better mobility.

[0088] Table 2 shows the transferability when CNNs are used as alternative models and Transformers are used as the target models.

[0089]

[0090] In the second set of experiments, Transformers were used as the alternative model and CNNs were used as the target model. The number of sampling times N=20 and the number of contractions k were set. i ≤5, shrinkage factor r=0.6. The results are shown in Table 3. As can be seen from Table 3, the adversarial sample prepared by the method of the present invention has a higher attack success rate and therefore better mobility.

[0091] Table 3. Transferability when Transformers are used as alternative models and CNNs are used as target models.

[0092]

[0093] In the third set of experiments, both the alternative and target models were Transformers, with the number of samplings N=20 and the number of contractions k. i ≤5, shrinkage factor r = 0.6. The results are shown in Table 4. As can be seen from Table 4, the adversarial examples prepared by the method of this invention have a higher attack success rate, and therefore better transferability. At the same time, combined with Tables 2 and 3, it can be shown that Transformers can generate more transferable adversarial examples.

[0094] Furthermore, it should be noted that while existing adversarial attack methods can successfully deceive ordinary models, they typically fail to attack defensive models. To further verify the effectiveness of the method of this invention, experiments were conducted against defensive models. When attacking defensive models, multiple alternative models are generally integrated to generate adversarial examples. This experiment employed a strategy of fusing Logit activations from different models, using a set of Inc-v3, Inc-v4, IncRes-v2, and Res-152 to create adversarial examples, with each model having a weight of 1 / 4. The results are shown in Table 5. The method of this invention can deceive state-of-the-art defensive models, significantly outperforming existing methods.

[0095] Table 4. Transferability when Transformers are the alternative model and when Transformers are the target model.

[0096]

[0097] Table 5 shows the portability for the defense model.

[0098]

[0099] Therefore, experiments have shown that the method of this invention has found adversarial example spaces with strong transferability in both CNNs and Transformers, which can be used to more realistically evaluate target black-box models.

[0100] Although the present invention has been described herein with reference to embodiments thereof, the above embodiments are merely preferred embodiments of the present invention, and the implementation of the present invention is not limited to the above embodiments. It should be understood that those skilled in the art can design many other modifications and implementations, which will fall within the scope and spirit of the principles disclosed in this application.

Claims

1. A method for preparing adversarial examples based on transfer learning, comprising the following steps: S1. Obtain the initial image used to prepare adversarial examples. Using an alternative model that has been trained and whose internal mechanisms are known, its category label is obtained by classifying it. ; Initial image As the initial input image, proceed to step S2; S2, Input image According to the set number of sampling times copy Each input image is then divided into several parts, and perturbations are added to each part so that each input image moves in a random direction toward the decision boundary of the alternative model after the perturbation is added, thus obtaining... Boundary point samples Among them, the number of samplings , express The first boundary point sample The formula for the boundary point samples is as follows: in, This is a function of the alternative model and is used to represent the image category output by the alternative model. Indicates the current iteration step; Indicates adding to the input image The perturbation that causes it to move toward the decision boundary of the alternative model, and ,express The perturbation direction is random and follows a Gaussian distribution. The covariance matrix is ​​a high-dimensional Gaussian distribution. It is a unit vector. Standard deviation The preset values ​​should ensure that during the first iteration At least some samples from the boundary point samples ; It is a contraction factor and , Indicates the first The number of contractions for each sample and is Integer, and ensure All samples satisfy ; S3. Using the substitution model, samples from each boundary point are used respectively. Perform forward propagation and calculate the gradient of the loss, as shown in the following formula: in, The gradient symbol, The loss function for the alternative model; S4, Calculation Boundary point samples The average gradient of the corresponding gradient is calculated; then, according to the set single-step perturbation step size, and with the direction of the average gradient as the perturbation direction of the current step, the attack perturbation of the current step is obtained; the attack perturbation of the current step is added to the input image to obtain the output image of the current step. ; S5. Using the output image of the current step. As a new input image, repeat steps S1 to S5 until the set number of iterations is reached. To obtain the final adversarial sample .

2. The method for preparing adversarial examples based on migration as described in claim 1, characterized in that, The number of samplings .

3. A method for preparing adversarial examples based on migration as described in claim 1 or 2, characterized in that, The number of samplings .

4. The method for preparing adversarial examples based on migration as described in claim 1, characterized in that, The number of contractions and The settings are adapted accordingly.

5. A method for preparing adversarial examples based on migration as described in claim 1 or 4, characterized in that, The contractile factor Set to: .

6. The method for preparing adversarial examples based on migration as described in claim 1, characterized in that, In step S4, the attack perturbation for the current step is obtained by setting the single-step perturbation step size and using the direction of the average gradient as the perturbation direction for the current step; the attack perturbation for the current step is added to the input image to obtain the output image for the current step. The formula is as follows: in, The cropping function is located at... Inside, For the preset maximum disturbance, sign It is a symbolic function.

7. The method for preparing adversarial examples based on migration as described in claim 6, characterized in that, The number of iterations Set to 10, maximum perturbation Set to 16.

8. The method for preparing adversarial examples based on migration as described in claim 1, characterized in that, The alternative model was obtained by training on the same training set as the black-box model to be evaluated.

9. The method for preparing adversarial examples based on migration as described in claim 1, characterized in that, The alternative models employ convolutional neural networks or Transformers.

Images