A method to improve the portability of general adversarial attacks by maximizing the truncation ratio.

Abstract

This invention relates to a method for improving the transferability of general adversarial attacks (UAPs) by maximizing the truncation ratio, comprising the following steps: generating artificial images using a curriculum optimization method; linearly superimposing the artificial images with randomly initialized perturbation images as input data; inputting the input data into a standard CNN model for training; extracting the output values ​​of multiple selected layers in the CNN model and manually activating all output values; calculating the target loss function; updating the perturbation values ​​according to the loss values; cropping the perturbation image after each update of the perturbation values; and continuing training until the number of iterations of the UAP training reaches the maximum number of iterations T or the deception rate verified by proxy data reaches the convergence threshold F. max UAP is considered to converge at this point. This invention only calculates the magnitude of positive and negative activations from lower-level convolutions. Experimental results verify that the method of this invention has better transferability to dataless general attacks on different CNN models.

Description

Technical Field

[0001] This invention relates to the field of cloud computing technology, and in particular to a method for improving the portability of general adversarial attacks by maximizing the truncation ratio. Background Technology

[0002] Early research has shown that small and imperceptible perturbations can severely interfere with the predictions of deep neural networks (DNNs), especially for image recognition tasks. Adversarial examples (AEs), created by deliberately adding small perturbations to benign samples, are not only difficult to detect in computer vision tasks but also easily transferable between DNN models. Therefore, since the development of deep learning, AEs have been considered a serious threat to DNN models.

[0003] To explore the impact of adversarial events (AEs), numerous methods have been proposed to design highly transferable DNN models (i.e., high deception rates against other DNN models). However, the AEs generated by these works are explicitly designed for certain specific samples and often fail to interfere with other samples, even those from the same dataset. Unlike the aforementioned image-specific attacks, existing techniques propose a novel general attack that generates image-agnostic universal adversarial perturbations (UAPs). The UAPs in the general attack are trained based on some prior knowledge, such as substitute data, proxy models, etc. By adding UAPs to benign samples, the general attack can generate a large number of adverse events in a short time. Furthermore, the research shows that the general attack can deceive most DNN models trained on similar datasets and can significantly reduce the cost of building DNNs, making the adversary more applicable to real-world scenarios than image-specific attacks.

[0004] However, both image-specific and general attacks require well-annotated training or alternative data to generate AEs. In practice, obtaining a well-labeled, large-scale dataset is challenging and expensive, especially for applications with critical security needs and limited prior knowledge. Researchers have investigated data-free general attack methods, where AEs are generated directly from random noise rather than prior data. Current data-free general attack methods explore feature-based adversarial perturbations (UAPs) that attempt to maximize the activation of convolutional neural network (CNN) features (i.e., ReLU activation). Results show that feature-based UAP methods achieve efficient and applicable general attacks without using any prior data. However, these data-free UAP methods only consider positive activations and all CNN feature layers. Therefore, UAPs generated by proxy models are difficult to transfer to target models. Summary of the Invention

[0005] In view of the above-mentioned problems in the existing technology, the technical problem to be solved by the present invention is: how to achieve the portability of UAPs made without data-based universal adversarial attacks.

[0006] To solve the above-mentioned technical problems, the present invention adopts the following technical solution: a method for maximizing the portability of general adversarial attacks by maximizing the truncation ratio, comprising the following steps:

[0007] S1: Generate artificial images using course optimization methods, and then linearly overlay the artificial images with randomly initialized perturbation images as input data;

[0008] S2: Input the input data into a standard CNN model for training;

[0009] S3: Extract the output values ​​of multiple selected layers in the CNN model and manually activate all output values;

[0010] S4: Calculate the target loss function, update the perturbation value based on the loss value, and crop the perturbation value of the perturbation image after each update to satisfy the infinite norm constraint. Set the hyperparameter α to adjust the ratio of positive and negative activation values ​​of the truncated output. The training of UAP reaches the maximum number of iterations T or the deception rate verified by surrogate data reaches the convergence threshold F. max UAP is considered to have converged.

[0011] Preferably, the step of generating artificial images using the course optimization method in S1 is as follows:

[0012] The generation process of artificial images is controlled by parameters of a specific distribution and the number of perturbation iterations, as defined below:

[0013] D a <D b <...<D n

[0014] D t ={x|x~P(θ0,t)} (1)

[0015] Where D t Let O be the set of artificial images x at the t-th iteration, O be the distribution of artificial images with default parameter θ0, and D be the set of artificial images x at the t-th iteration. a <D b Describe set D b The pattern of the artificial image in the set D is greater than that of the set D a The complexity lies in the fact that as the number of training iterations t increases, the distribution parameter θ0 also gradually increases. This is in contrast to the set of artificial images D created using a Gaussian distribution. t Defined as:

[0016]

[0017] Where μ0 and σ0 represent the initial mean and standard deviation of the Gaussian distribution, respectively, γ represents the growth step size, t represents the number of training iterations, and t0 represents a predefined threshold that determines the growth of the standard deviation, meaning the standard deviation grows once every t0 iterations during training, with an increment of γ. When an artificial image is generated from a jigsaw puzzle image, its sample set D... t Defined as:

[0018]

[0019] in It is the distribution of jigsaw puzzle images. The initial frequency, γ′, and t′0 represent the growth step size when the artificial image is generated from the jigsaw puzzle image, and the growth of the standard deviation is determined by a predefined threshold.

[0020] Preferably, step S3 involves manually activating all output values ​​to maximize the output values, and the steps are as follows:

[0021]

[0022] st‖v‖ ∞ ≤δ (4)

[0023] The perturbation image v is constrained by the infinity norm and its constant value δ, l′ represents the selected activation layer with positive activation, and l″ represents the selected activation layer with negative activation. This indicates that the value is currently active. This indicates that a negative value is activated.

[0024] Preferably, the target loss function in S4 is as follows:

[0025]

[0026] Where |D t | is set D t The number of artificial images in China This represents the sum of positive and negative activation values ​​in the t-th iteration. and represent the positive activation value and negative activation value of the i-th convolutional layer, respectively.

[0027] Compared with the prior art, the present invention has at least the following advantages:

[0028] This invention provides a novel data-free general attack, called TRM-UAP, to reformulate the UAP generation task as a truncation ratio optimization problem. Compared to previous general attacks, the TRM-UAP method combines positive activation maximization and negative activation minimization. To further improve the transferability of UAP, we propose a truncation strategy that only computes the sizes of positive and negative activations from low-level convolutions. Experimental results on ImageNet and Cifar10 validate that our attack has better portability than other data-free general attacks on different CNN models. Attached Figure Description

[0029] Figure 1 A diagram illustrating the maximum activation and the proportional maximum activation.

[0030] Figure 2 Training process for the truncated ratio maximization activation method.

[0031] Figure 3 Examples of activation loss settings for different positive and negative truncations.

[0032] Figure 4 The average activation value of neurons in the intermediate layer of a neural network under different truncation settings.

[0033] Figure 5 Artificial images set for Gaussian distributions with different standard deviations.

[0034] Figure 6 Artificial images set for different frequency distributions of jigsaw puzzle images.

[0035] Figure 7 Comparison of the logit loss function of each model with other methods (ImageNet).

[0036] Figure 8 This is a positive and negative activation ablation experiment on a partial model.

[0037] Figure 9 This is an ablation experiment using a truncation strategy.

[0038] Figure 10 A bar chart showing the logit values ​​of TRM-UAP and other common attack methods on Cifar10.

[0039] Figure 11 Comparison of the logit loss function of each model with other methods (Cifar10).

[0040] Figure 12 Visualize the UAP to counteract disturbances.

[0041] Figure 13 Examples of counter-attacks. Detailed Implementation

[0042] The present invention will now be described in further detail.

[0043] To maximize the activation of convolutional layer outputs and improve the transferability of User-Aided Adversarial Examples (UAPs) generated through dataless general adversarial attacks, this invention proposes a dataless general adversarial attack using the Truncated Ratio Maximization (TRM-UAP) method. The UAP generation process is described as a truncated ratio maximization problem. The goal of the TRM-UAP method is to attempt further overactivation of neurons to disrupt features extracted from multiple CNN convolutional layers. Specifically, it uses generalized features extracted from shallow convolutional layers to train the UAP, retaining the output values ​​of shallow convolutional layers while discarding those of deep convolutional layers. This improves the transferability of adversarial examples generated by the UAP; this training strategy is called the truncated strategy. Furthermore, the activation maximization problem in the original dataless general attack is modified to a ratio maximization activation problem, adding additional prior knowledge to assist in UAP training. This invention argues that, in addition to maximizing the positive output values ​​of convolutional layer neurons, appropriately activating the negative output values ​​discarded during the activation process also helps in training the UAP. Therefore, TRM-UAP maximizes the activation target, thereby maximizing the ratio of positive to negative activations. This allows some negative output values ​​of convolutional layer neurons to be transformed into positive output values ​​during training and continue to optimize. Furthermore, to increase input diversity, this invention uses Gaussian noise and jigsaw puzzle images to create artificial samples that are input into the model along with the perturbation. The entire perturbation training process is optimized using the concept of curriculum learning, enabling the perturbation training to escape local suboptimal solutions and converge to the optimal solution.

[0044] A method for improving the portability of general adversarial attacks by maximizing the truncation ratio includes the following steps:

[0045] S1: Generate artificial images using course optimization methods, and then linearly overlay the artificial images with randomly initialized perturbation images as input data;

[0046] S2: Input the input data into a standard CNN model for training. The CNN model can be directly called through the Python library and pre-weights can be loaded.

[0047] S3: Extract the output values ​​of multiple selected layers in the CNN model and manually activate all output values. The ReLU activation function sets negative values ​​to 0 and keeps positive values. Since the output values ​​have not been activated by the ReLU activation function when they are extracted, the output values ​​are both positive and negative. The purpose of manual activation is to distinguish between positive and negative values.

[0048] S4: Calculate the target loss function and update it based on the loss value. After each update of the perturbation value, the perturbation value of the perturbation image is cropped to meet the constraint of the infinity norm. Set the hyperparameter α to adjust the ratio of positive and negative activation values ​​of the truncated output. The convergence occurs when the number of iterations of training UAP reaches the maximum number of iterations T or the deception rate verified by surrogate data reaches the convergence threshold F. max UAP is considered to have converged.

[0049] An image is typically composed of many pixels, each represented by RGB values ​​from 0 to 255. These values ​​represent grayscale levels. For example, in a grayscale image with only black and white, 0 represents black, 255 represents white, and there are gradual gray transitions in between. An image is essentially a two-dimensional matrix containing many values ​​from 0 to 255. I define the maximum perturbation as 16, but a pixel's perturbation could be 7, 16, or 24, depending on how much is updated based on the loss calculation. Therefore, values ​​greater than 16 are cut off, reduced to 16. This is the cut for the maximum perturbation limit. There's also a cut for constant values ​​(0-255). If a pixel's value is 253 and the perturbation is 8, then 253 + 8 is greater than 255, so the total value needs to be cut down to 255. In computer calculations, standardization is required, so pixel values ​​are scaled to 0-1, and perturbations are scaled to 16 / 255.

[0050] Specifically, the steps in S1 for generating artificial images using the course optimization method are as follows:

[0051] To enhance input diversity, this invention uses Gaussian noise and jigsaw puzzle images to generate artificial images, which are then input into the surrogate model along with the perturbed image. To simulate realistic training samples, mean filtering is applied to smooth the boundaries of different regions in the jigsaw puzzle image.

[0052] However, inputting complex artificial images in the early stages of training can cause the algorithm to have difficulty converging. Simpler artificial images are used as training data in the initial stages, and the complexity of the patterns in the artificial images is gradually increased as training progresses.

[0053] The generation process of artificial images is controlled by parameters of a specific distribution and the number of perturbation iterations, as defined below:

[0054] D a <D b <...<D n

[0055] D t ={x|x~P(θ0,t)} (1)

[0056] Where D tLet P be the set of artificial images x at the t-th iteration, and let P be the distribution of artificial images with default parameter θ0. a <D b Describe set D b The pattern of the artificial image in the set D is greater than that of the set D a The complexity arises because, with the increase of the number of training iterations t, the distribution parameter θ0 also gradually increases (the standard deviation of the Gaussian distribution and the frequency in the jigsaw images). Specifically, when the artificial images are created using a Gaussian distribution, the standard deviation of the Gaussian distribution also increases with the increase of training epochs, therefore the set D of artificial images created using a Gaussian distribution... t Defined as:

[0057]

[0058] Where μ0 and σ0 represent the initial mean and standard deviation of the Gaussian distribution, respectively, γ represents the growth step size, t represents the number of training iterations, and t0 represents a predefined threshold that determines the growth of the standard deviation; that is, the standard deviation grows once every t0 iterations during training, with an increment of γ. Artificial image visualizations created from Gaussian distributions with different standard deviations are shown below. Figure 5 As shown. Similarly, when an artificial image is generated from a jigsaw puzzle image, its sample set D t Defined as:

[0059]

[0060] in It is the distribution of jigsaw puzzle images. The initial frequency, γ′, and t′0 represent the growth step size when the artificial image is generated from the jigsaw puzzle image, and a predefined threshold is used to determine the growth of the standard deviation. Artificial jigsaw puzzle images at different frequencies are shown below. Figure 6 As shown. Therefore, in summary, for the t-th iteration, the course optimization algorithm will maximize.

[0061] Specifically, S3 involves manually activating all output values, i.e., maximizing the output values. The steps are as follows:

[0062] For general adversarial perturbations without data, a truncated ratiomaximization (TRM-UAP) method is proposed to create a perturbation v that satisfies the formula:

[0063]

[0064]

[0065] The perturbation image v is constrained by the infinity norm and its constant value δ, l′ represents the selected activation layer with positive activation, and l″ represents the selected activation layer with negative activation. This indicates that the value is currently active. This indicates that a negative value is activated.

[0066] The details of the proposed truncation ratio maximization method are presented in a strictly data-free manner to produce UAP.

[0067] Specifically, the target loss function in S4 is as follows:

[0068]

[0069] Where |D t | is set D t The number of artificial images in China This represents the sum of positive and negative activation values ​​in the t-th iteration. and represent the positive activation value and negative activation value of the i-th convolutional layer, respectively.

[0070] like Figure 1 As stated in (a), existing data-free general attacks aim to accumulate model error through multiple convolutional layers, increasing the classification loss and ultimately causing the model to make a misclassification. This invention proposes to create a general adversarial perturbation (UAP) by maximizing the activation ratio in the absence of data.

[0071]

[0072] st‖v‖ ∞ ≤δ (6)

[0073] Where positive activation is defined as Negative activation is defined as This indicates the calculation of its l2 norm. In order to further improve the probability of successful attack, the activation ratio objective in problem (1) attempts to maximize the size of the convolutional layer activation value by optimizing the ratio between positive and negative activation values.

[0074] Specifically, maximizing the proportion is a dynamic process. First, minimizing the negative activation objective causes the negative values ​​output by the convolutional layer to iterate in the direction of decreasing absolute value, i.e., closer to zero, producing negative values ​​close to zero. Second, during UAP training, due to the optimization step size setting during gradient descent, minimizing negative activation may cause some near-zero negative values ​​to change sign, i.e., jump from a small negative value to a small positive value, such as... Figure 1As shown in (b). Finally, in the next iteration, the objective of maximizing positive activation continues to update and optimize the activation values ​​from small positive values ​​to larger positive values. The above process is the process of optimizing the UAP using the objective of the proportional maximization activation problem. Compared with other optimization processes for general attacks without data, it utilizes negative activation as additional prior information to train the UAP. During training, as the number of negative activations decreases and the number of positive activations increases, proportional maximization can further increase the probability of successful adversarial attacks.

[0075] Different convolutional layers extract features with different characteristics and properties. This invention argues that not all convolutional layers contribute to increasing activation values ​​and scaling-maximization activation functions. To further enhance the transferability of the UAP produced by the scaling-maximization method, this invention proposes a novel data-free general adversarial attack method, Truncated Ratio Maximization, to compute the general adversarial perturbation v. The overall process is as follows: Figure 2 As shown.

[0076] For simplicity, the problem of maximizing the proportion of the i-th convolutional layer is defined as follows: in To maximize the proportion of activation values ​​in the convolutional layers, the proportion maximization objective loss is rewritten as follows:

[0077]

[0078] The logarithm (logarithm) readjusts the activation value range to prevent gradient explosion. Unlike existing methods that attack all convolutional layers or a specific layer, this invention attempts to truncate positive and negative activations in deep convolutional layers, since image-related features do not help in training UAP. Let the truncated rate (TR) be defined as... Starting from the (l+1)th truncated layer, set the positive and negative activation values ​​of the convolutional layer to Where τ represents a tiny positive value. Therefore It can be rewritten as equivalent to

[0079] However and The numerical differences in the proportional loss result in different effects in different layers. Maximizing the proportional loss may lead to a decrease in attack effectiveness. To address this issue, this invention first rewrites the proportional loss of the i-th convolutional layer as follows:

[0080]

[0081] Here, α is a hyperparameter that adjusts the relative importance of positive and negative activation values. α is set as an exponential hyperparameter because it narrows the range of values ​​due to the significant difference between positive and negative activation values. Next, the positive activation cutoff rate (Positive TR) is defined. And negative activation cutoff rate (Nagetive TR) That is, this invention uses different cutoff rates for positive and negative activation values, assuming... like Figure 3 As shown, the vertical axis represents positive and negative activation losses respectively, the horizontal axis represents the number of convolutional layers, the shaded area represents the retained activation values ​​of the convolutional layers, and the white area represents the truncated activation values ​​of the convolutional layers. The entire objective loss function... Rewritten as

[0082]

[0083] Where c = ((1-α)·Ll′+α·l″)·logτ, c is a constant.

[0084] Therefore, based on the above derivation, for general adversarial perturbations without data, a Truncated Ratio Maximization (TRM-UAP) method is proposed to create a perturbation v that satisfies the formula:

[0085]

[0086] st‖v‖ ∞ ≤δ (10)

[0087] This invention uses UAP input to explore the variation in the average activation value of each neuron in the convolutional layers of a CNN (such as VGG16) model. Specific results are as follows: Figure 4 As shown, compared with the untrunculated RM-UAP and the TRM-UAP with the same positive and negative truncation rates, the TRM-UAP with different positive and negative truncation rates can generate a larger positive activation from the perturbation, thereby further improving the attack effect.

[0088] When the truncation is set to PTR=0% and NTR=100% (i.e., positive values ​​are fully retained and negative values ​​are fully truncated), the TRM-UAP target loss function defined by this method will degenerate into the target loss function of the GD-UAP method. This indicates that the GD-UAP method is merely a special case of the TRM-UAP method proposed in this invention when inputting an artificial image with Gaussian noise under no-course learning settings. Compared to GD-UAP, the TRM-UAP method proposed in this invention can further improve the attack strength and transferability of general adversarial attacks without data by maximizing the target through the truncation ratio. The detailed differences between TRM-UAP and the GD-UAP method will be further discussed in the experimental section.

[0089] Experimental Results and Analysis

[0090] 1. Training details and parameter settings

[0091] Dataset and Model Setup: The main experiment maintains the same setup as existing general adversarial attack methods without data. This invention primarily evaluates the proposed method on the ImageNet validation set, which contains 1000 categories with 50 images per category. The extended dataset is Cifar10. Classic pre-trained models are used, including AlexNet, VGG16, VGG19, ResNet152, and GoogleNet.

[0092] Evaluation Criteria and Comparison Methods: The deception rate (FR) proposed in previous data-free general attack methods was used as the evaluation metric. A higher deception rate indicates a higher attack success rate and better attack transferability. Experiments were conducted to compare with all classic data-free general attack methods, including FFF, AAA, GD-UAP, PD-UA, and Cosine-UAP. Since GD-UAP did not use the standard pre-trained model officially released by PyTorch, this invention reproduced GD-UAP using a setting similar to that of TRM-UAP to ensure fairness in the comparison. Furthermore, to further analyze the transferability of the method, this invention also used the logit loss from the C&W attack method as an evaluation metric to analyze the transferability between adversarial example classes. A higher value indicates better transferability of the adversarial attack method.

[0093] Execution Details: The experimental environment for this method was an NVIDIA GeForce RTX3090Ti GPU, and the experimental framework was PyTorch. Based on previous research, δ was set to 10 / 255, the maximum number of iterations T = 10000, the saturation threshold r = 0.001%, and the values ​​of PTR and NTR were within the range of [0,1]. Hyperparameters α and cutoff rates were set for different models on ImageNet and Cifar10, respectively.

[0094] 2. Training details and parameter settings

[0095] Main Experiment on ImageNet Dataset: This invention applies the TRM-UAP method to create UAPs and adversarial examples on five CNN models, and attacks these CNN models on the ImageNet validation set. The hyperparameters of each model in the TRM-UAP algorithm are set as follows: α = {1, 0.1, 0.5, 1.5, 1}, PTR = {0.6, 0.2, 0.2, 0.4, 0.4}, NTR = {0.8, 0.3, 0.2, 0.3, 0.3}, corresponding to AlexNet, VGG16, VGG19, ResNet152, and GoogleNet, respectively. Comparison results with other general methods without data are shown in Table 1. The TRM-UAP results in Table 1 are the mean of the results from five repeated experiments. The GD-UAP results are compared with other methods after being reproduced in the same experimental environment as TRM-UAP on the PyTorch framework. All results of this method are compared with other methods using the optimal values. As observed in Table 1, the TRM-UAP method achieves a higher deception rate (FR) than other methods on most models. Although its FR on GoogleNet is slightly lower than that of Cosine-UAP, TRM-UAP has the best mean FR across all models, indicating that it improves the overall performance of UAP across the five models. This invention uses a proxy model to create a UAP to further attack other models to verify its transferability. Table 2 shows the attack results for different models. The horizontal axis represents the target model, and the vertical axis represents the proxy model used to create the UAP. Therefore, the diagonal lines represent the attack results under the white-box attack setting, and the off-diagonal lines represent the attack results under the black-box attack setting. Under the white-box attack setting, all five classic CNN models achieved optimal results. Under the black-box attack setting, except for a few cases where the attack effect was poor due to significant differences in the proxy model architecture, the FR of most black-box attack settings exceeded 60%. Whether from a white-box or black-box attack perspective, most attacks perform well in terms of transferability, demonstrating that the perturbations generated by the TRM-UAP method can be transferred between different target models to perform adversarial attacks.

[0096] Table 1 Comparison of TRM-UAP with other dataless general attacks

[0097]

[0098] Table 2. Transferability Analysis of TRM-UAP Method

[0099]

[0100] Logit loss transferability evaluation experiment: TRM-UAP improves the performance of general attacks and achieves good attack results in data-free attacks on the ImageNet validation set. To verify the effectiveness of the attack and compare it with other data-free general methods, this invention uses the logit loss proposed in the C&W attack method for extended experiments. The main purpose of introducing the logit loss of the C&W attack is to evaluate the transferability between different general attacks. The logit loss is defined as loss = (max... j≠t F(x+v) j )-F(x+v) t , where F(·) j This represents the j-th output of the model's logit layer, where t is the true label of the sample. Logit loss can be used to evaluate the transferability of adversarial examples between different classes. A negative value indicates that the model correctly classifies the sample, and the given classification matches the true label. A positive value indicates that the model misclassifies the sample. For adversarial examples, a larger logit loss value indicates better transferability.

[0101] Figure 7 As shown, this invention compares the transferability of GD-UAP, Cosine-UAP, and TRM-UAP, and calculates the logit loss of the original image as a reference baseline. Since the authors of Cosine-UAP have not released their source code, the results of Cosine-UAP were reproduced under the same experimental conditions as TRM-UAP. The subgraphs in the figure are titled "Proxy Model," i.e., the model that generates adversarial examples, and the horizontal axis of each subgraph represents the test model. The figure shows that the logit loss of the original image is negative for all models, indicating that the CNN model used in the experiment is a high-precision normal classification model. However, for most models, the logit loss of the adversarial examples generated by TRM-UAP is higher than other general attack methods, and the model has higher confidence in misclassifications, demonstrating the higher attack strength of TRM-UAP. In deep CNN models (such as ResNet152), the difference between TRM-UAP and GD-UAP becomes more significant, indicating that this method has good generalization ability.

[0102] Ablation Experiments: This invention designs ablation experiments to verify the effectiveness of negative activation and truncation strategies. To study the role of negative activation, experiments with positive and negative activations were designed for comparative analysis. The experiments tested the perturbations trained using only positive activation and the perturbations trained using a combination of positive and negative activations on other models, maintaining consistency in all settings except for the positive / negative activation settings. Figure 8Experimental results for some models are presented, with the subheading model representing the surrogate model and the horizontal axis representing the target model. The graph shows that negative activation significantly improves the transferability of perturbations. Similar results can be observed on other models. To further investigate the impact of the truncation strategy on the deception rate, attacks were designed to truncate convolutional layers in CNN models under different truncation rate settings. Specifically, the proportion of retained activations was increased by 10% with each step, allowing the UAP to gradually learn information from shallow to deep convolutional layers. Based on ImageNet settings, a white-box attack was used, employing the UAP generated by the target model itself. The parameter settings of PTR and NTR were combined to form a two-dimensional parameter space to explore the impact of the truncation rate on the deception rate. Experimental results are as follows: Figure 9 As shown, since AlexNet only has 5 convolutional layers, it can be seen that on all models, a better FR value is achieved when both the PTR and NTR are taken as intermediate values ​​instead of 0 (indicating no truncation). The best results of the attack were obtained by truncating the activation instead of fully activating all layers.

[0103] Cifar10 Dataset Extension Experiments: The experiments above demonstrate that TRM-UAP can improve the performance of general adversarial perturbations on large datasets like ImageNet, achieving good attack results in data-free attacks. This invention attempts to further observe the performance of adversarial attacks on other datasets, selecting the smaller Cifar10 dataset, which has significantly different image sizes from the ImageNet dataset, for exploration. Extension experiments on adversarial attacks were conducted on Cifar10. Since AlexNet has very low accuracy in standard training on the Cifar10 dataset, the model settings on Cifar10 were slightly adjusted, replacing AlexNet with ResNet18 and ResNet34 in the ImageNet-based setup. The hyperparameter settings were also adjusted on Cifar10, with α = {0.3, 0.01, 2, 2, 0.1, 1}, PTR = {0.4, 0.6, 0.5, 0.5, 0.5, 0.6}, and NTR = {0.3, 0.99, 0.9, 0.9, 0.8, 0.7} corresponding to VGG16, VGG19, ResNet18, ResNet34, ResNet152, and GoogleNet, respectively. In most attacks, the method achieved a deception rate exceeding 60%, indicating good transferability of the TRM-UAP method across different datasets. In the table, "Positive & Negative" represents the results of training UAP using a combination of positive and negative activation values, while "Positive" represents the results of training UAP using only positive activation values ​​and a truncation strategy. The two experimental settings differed only in the activation values; all other settings remained the same. All data in the table represents the results of five repetitions of training. Comparing the attack performance of UAPs trained with positive and negative activations with those trained with only positive activations in the table, it was found that on small datasets, negative activations provide a more significant improvement to shallow networks compared to deep networks such as ResNet152 and GoogleNet. Taking VGG16 as an example, whether using VGG16 as a proxy model to create a UAP or using a UAP created by other proxy models to attack VGG16, in most cases, UAPs trained with a combination of positive and negative activations have a certain improvement in deception rate compared to UAPs trained with only positive activations.

[0104] Since ImageNet has 1000 categories, it's difficult to intuitively analyze the impact of adversarial examples on the model's output. Therefore, we further explored the target model's output on the Cifar10 dataset. Specifically, we randomly selected original samples that the model could correctly classify, created corresponding adversarial samples, and observed and compared the changes in the logit of their outputs. Figure 10The logits in the figure verify the effectiveness of the attack. A classic no-data general attack method (GD-UAP) is selected for comparison. The model can give high logit values ​​for the correct classification of normal samples, indicating that the model has high confidence in that classification. However, for adversarial examples, the small perturbations accumulated in the model lead to many positive logit values ​​for irrelevant classes, thus increasing the probability of attack transfer. Furthermore, the method proposed in this invention has positive logit values ​​for more classes than GD-UAP, indicating that TRM-UAP has better inter-class transferability. In addition, to further compare with GD-UAP and explore the transferability of adversarial attack methods on adversarial examples created on the Cifar10 dataset, logit loss is also introduced to analyze the transferability of GD-UAP and TRM-UAP. Figure 11 As shown in the figure, each sub-figure title represents a surrogate model, i.e., the model used to create UAP. The model on the horizontal axis of each figure represents the test model, with the logit loss of all original samples calculated as a reference. As can be seen from the figures, except for a small number of shallow networks (such as ResNet18) where GD-UAP and TRM-UAP have similar results, TRM-UAP has a higher logit loss value on the remaining models, indicating that the proposed method has good transferability.

[0105] 3. Visualization Results and Analysis

[0106] The UAP visualization produced by the TRM-UAP method on the ImageNet validation set is as follows: Figure 12 As shown, the UAP value has been magnified by 255 times for easier demonstration. The image reveals numerous local features within the perturbation. However, perturbations generated by different proxy models exhibit certain differences. Shallow networks like AlexNet extract sharp, textured local features, while VGG networks, with their deeper network layers, extract smoother features and more color variations in local features compared to AlexNet. Perturbations generated using ResNet152 and GoogleNet as proxy models display richer noise patterns, forming unique feature patterns. Attack examples on ImageNet include... Figure 13 As shown in the diagram. In each subgraph, the first row represents normal samples, and the second row represents their corresponding adversarial samples. The probabilities in parentheses represent the prediction probabilities given by the model. It can be seen that the model gives a higher classification probability for the wrong class in the prediction of adversarial samples, and from a human visual perspective, there is no obvious difference between normal samples and adversarial samples, ensuring the concealment of adversarial samples.

[0107] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for improving the portability of general adversarial attacks by maximizing the truncation ratio, characterized in that: Includes the following steps: S1: Generate artificial images using course optimization methods, and then linearly overlay the artificial images with randomly initialized perturbation images as input data; S2: Input the input data into a standard CNN model for training; S3: Extract the output values ​​of multiple selected layers in the CNN model and manually activate all output values; S3 involves manually maximizing all output values, and the steps are as follows: The perturbation image v is constrained by the infinity norm and its constant value δ, l′ represents the selected activation layer with positive activation, and l″ represents the selected activation layer with negative activation. This indicates that the value is currently active. Indicates negative values ​​for activation; S4: Calculate the target loss function, update the perturbation value based on the loss value, and crop the perturbation value of the perturbation image after each update to satisfy the infinite norm constraint. Set the hyperparameter α to adjust the ratio of positive and negative activation values ​​of the truncated output. The training of UAP reaches the maximum number of iterations T or the deception rate verified by surrogate data reaches the convergence threshold F. max UAP is considered to have converged at that time; The target loss function in S4 is as follows: Where |D t | is set D t The number of artificial images in China This represents the sum of positive and negative activation values ​​in the t-th iteration. and represent the positive activation value and negative activation value of the i-th convolutional layer, respectively.

2. The method for maximizing the portability of general adversarial attacks by maximizing the truncation ratio as described in claim 1, characterized in that: The steps in S1 for generating artificial images using the course optimization method are as follows: The generation process of artificial images is controlled by parameters of a specific distribution and the number of perturbation iterations, as defined below: D a <D b <…<D n D t ={x|x~P(θ0,t)} (1) Where D t Let P be the set of artificial images x at the t-th iteration, and let P be the distribution of artificial images with default parameter θ0. a <D b Describe set D b The pattern of the artificial image in the set D is greater than that of the set D a The complexity lies in the fact that as the number of training iterations t increases, the distribution parameter θ0 also gradually increases. This is in contrast to the set of artificial images D created using a Gaussian distribution. t Defined as: Where μ0 and σ0 represent the initial mean and standard deviation of the Gaussian distribution, respectively, γ represents the growth step size, t represents the number of training iterations, and t0 represents a predefined threshold that determines the growth of the standard deviation, i.e., the standard deviation grows once every t0 iterations during training, with an increment of γ. When the artificial image is generated from the jigsaw puzzle image, its sample set D... t Defined as: in It is the distribution of jigsaw puzzle images. The initial frequency, γ′, and t′0 represent the growth step size when the artificial image is generated from the jigsaw puzzle image, and the growth of the standard deviation is determined by a predefined threshold.

Images