Adversarial attack sample generation and restoration method fully recoverable to original image

Abstract

The application relates to an adversarial attack sample generation and recovery method which can be completely recovered into an original image. The adversarial attack sample generated by one-pixel attack only modifies one pixel point, the modified pixel point is called an adversarial pixel point, the original pixel value of the adversarial pixel point is converted into binary coding, and then the binary coding information is embedded into the generated adversarial sample through a pixel value sorting algorithm to obtain a completely recoverable adversarial sample. A receiver receives the adversarial sample, obtains a prediction error histogram of the embedded image to perform reverse decoding, obtains the binary coding information embedded in the image and the recovered one-pixel adversarial sample. The position of the adversarial pixel point is detected by calculating the point with the largest difference from the neighborhood mean value. The original pixel value of the adversarial pixel point is converted according to the binary coding information, and finally the original image can be completely recovered according to the original pixel value and the position of the adversarial pixel point.

Description

Technical Field

[0001] This invention relates to the field of adversarial sample generation methods, specifically to a method for generating and restoring adversarial attack samples that can be completely restored to the original image. Background Technology

[0002] Adversarial attacks involve adding subtle noise to input image samples, causing the model to produce an incorrect output. Generally, adversarial examples generated by adversarial attacks are difficult to completely reconstruct from the original image. However, adversarial examples generated through reversible adversarial attacks can be reconstructed from the original image using algorithms. Currently, most research on reversible adversarial attacks only manages to reconstruct the adversarial example into an image that the model can classify as the original category; it does not guarantee that the reconstructed image will be completely identical to the original.

[0003] In fields such as military and medical applications, adversarial attack algorithms are often used to process image samples before network transmission to prevent them from being arbitrarily identified and captured by models. However, even if the generated adversarial examples only add very small perturbations, misdiagnosis may occur in medical images; and unacceptable errors may occur in high-precision applications such as military applications. Therefore, it is very meaningful to generate adversarial examples that can be completely restored to the original image using fully recoverable adversarial attacks, which can satisfy transmission security while allowing the receiver to completely recover the original image from the adversarial examples. Summary of the Invention

[0004] The purpose of this invention is to provide a method for generating and restoring adversarial attack samples that can be completely restored to the original image, thereby achieving recoverable adversarial attacks.

[0005] To achieve the above objectives, the present invention adopts the following technical solution.

[0006] A method for generating and restoring adversarial attack samples that can be fully restored to the original image is disclosed. This method generates adversarial samples by modifying only one pixel (called the adversarial pixel) through a one-pixel attack. The original pixel value of the adversarial pixel is converted into binary code, and then the binary code information is embedded into the generated adversarial sample using a pixel value ordering (PVO) algorithm, resulting in a fully recoverable adversarial sample. This sample can be completely restored to its original state without requiring any additional information. The specific implementation steps are as follows:

[0007] S1 uses the differential evolution algorithm to find the best solution for which pixel to attack and how to modify its value, and generates a one-pixel adversarial sample image.

[0008] S101, Obtain the experimental sample dataset, and set the dataset solution space to...

[0009] (x, y, R, G, B)

[0010] x, y∈[0, 31]; R, G, B∈[0, 255].

[0011] Where x is the x-coordinate of the pixel, y is the y-coordinate of the pixel, the origin is at the top left corner, R is Red (the value corresponding to the red channel of the pixel), G is Green (the value corresponding to the green channel of the pixel), and B is Blue (the value corresponding to the blue channel of the pixel).

[0012] x and y are generated using a uniform distribution U(1, 32), and R, G, and B are generated using a normal distribution N(μ = 128, σ = 127). This process is repeated to generate a total of 400 parent candidate solutions, which are then used to initialize the solution set.

[0013] S102, the offspring candidate solutions are generated using the following formula.

[0014] x i (g+1)=x r1 (g)+α(x r2 (g)-x r3 (g)),

[0015] r1≠r2≠r3.

[0016] In the above formula, x i A child candidate solution is generated from 400 parent candidate solutions, where r1, r2, and r3 represent three different parent candidate solutions, r1, r2, r3 ∈ [0, 399]. α is a user-defined hyperparameter, which can be set to α = 0.5, and g is the current iteration number. The 400 parent candidate solutions are iteratively cross-mutated to generate 400 child candidate solutions. These are then selected to determine the optimal solution. The original image is processed according to the selected optimal solution, and adversarial pixels are inserted. The processed image is then input into the model for detection to determine if the attack is effective. If the attack is effective, a one-pixel adversarial sample is generated that modifies only one pixel (i.e., only one adversarial pixel).

[0017] S2, Embedded Information Encoding.

[0018] Record the optimal solution (x′, y′, R′, G′, B′), use the x′ and y′ coordinates to find the R, G, and B values ​​of the corresponding adversarial pixel in the original image, obtain the original pixel value (R0, G0, B0) of the adversarial pixel, and convert it into a fixed-length binary code, where R0, G0, and B0 are each 8 bits, for a total of 24 bits.

[0019] S3 embeds binary encoded information into the adversarial sample generated in S1.

[0020] S301, the one-pixel adversarial sample obtained in S1 is divided into blocks. The pixels in each block are sorted in ascending order, and the difference between the two pixels with the largest pixel values ​​is recorded as PE. max After processing all blocks of the sample, a prediction error histogram (PEH) is obtained. max Longitudinal stripes with a value of 0 remain unchanged, PE max The longitudinal stripe region with a value of 1 is used as the embedding region, PE max Vertical stripes with a value greater than 1 are shifted one unit to the right in succession;

[0021] S302, scan each block sequentially, and modify the embedded region (PE) of the scanned area. max For the vertical stripe region (where b is 1), the following operations are performed on each symbol b of the pixel bit information obtained in S2: when symbol b is 0, the pixels in the corresponding embedded region block are not changed; when symbol b is 1, the maximum pixel value in the corresponding region is incremented by 1 to make PE... max =2;

[0022]

[0023] The above process can generate adversarial examples that can be completely restored to the original image.

[0024] S4 is an adversarial example that can be completely restored to the original image.

[0025] The receiver receives the corresponding adversarial example that can be fully recovered to the original image, and obtains the prediction error histogram (PE) of the embedded image. max A region with a value of 1 represents a corresponding code element of 0; PE max The region with a value of 2 represents the corresponding code element as 1, and the pixel P with the largest value in that region is also included. max -1 restores the original pixel value; PE maxFor regions >2, a left-shift restoration operation is performed accordingly. This extracts the binary encoding information of the adversarial pixels embedded in the image and restores the one-pixel adversarial sample before the information was embedded. The original pixel values ​​(R0, G0, B0) of the adversarial pixels are obtained by converting the binary encoding information of the adversarial pixels. Median filtering is performed on the R, G, and B channels of the one-pixel adversarial sample to obtain three matrices. The absolute values ​​of these matrices are then subtracted from the R, G, and B channels of the one-pixel adversarial sample before median filtering, resulting in three absolute difference matrices. The sum of these three absolute difference matrices yields the total absolute difference matrix. The position of the point with the largest value in this matrix is ​​the position of the adversarial pixel, and its coordinates are denoted as (x0, y0). Thus, complete information including the coordinates and original pixel values ​​of the adversarial pixels (x0, y0, R0, G0, B0) is obtained. Finally, based on the coordinates and original pixel values ​​of the adversarial pixels, the original image can be completely restored.

[0026] The beneficial effects of this invention are:

[0027] (1) While ensuring the quality of the final image sample, an adversarial attack sample that can be completely restored to the original image was generated, thus realizing a fully recoverable adversarial attack.

[0028] (2) The attack success rate indicates that the algorithm strategy is effective. By using PVO to embed the original pixel value of the adversarial pixel into the adversarial sample, the generated new adversarial sample containing the original pixel value of the adversarial pixel can still play the role of disturbing the model classification.

[0029] (3) This invention does not require extensive knowledge of the target model's details; it only requires inputting the image into the model to obtain the classification result. It utilizes the idea of ​​differential evolution to reduce the reliance on acquiring detection results. The characteristics of black-box attacks mean that this invention is not only applicable to a specific deep learning model, but also applicable to other models without requiring changes to the strategy or structure.

[0030] (4) Based on the characteristics of generating adversarial attack samples, this invention detects the position of adversarial pixels by calculating the point with the largest difference from the neighborhood mean, which reduces the adversarial pixel coordinate information that needs to be embedded in the sample and increases the number of adversarial attack samples that meet the information embedding requirements.

[0031] (5) The adversarial attack samples generated by the method of the present invention can be completely restored to the original image. They can be used in military, medical and other fields, including scenarios where it is required to ensure the privacy of image transmission and restore the hidden image to the original image without loss. It is also of great significance to the research of deep learning models. Attached Figure Description

[0032] Figure 1This is a flowchart illustrating the generation of fully recoverable adversarial examples in the method of this invention.

[0033] Figure 2 This is a schematic diagram of the prediction error histogram operation process in the method of the present invention.

[0034] Figure 3 This is a flowchart of the method for restoring the original image in this invention.

[0035] Figure 4 The following are example diagrams of samples generated at each stage by the method of the present invention in the embodiments. Detailed Implementation

[0036] To better understand the above-described objects, features, and advantages of the present invention, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Many specific details are set forth in the following description to provide a thorough understanding of the invention; however, the invention may be practiced in other ways different from those described herein, and therefore, the invention is not limited to the specific embodiments disclosed below.

[0037] Typically, adversarial attack algorithms do not record the changed pixel information; they only focus on the success of the final attack. This invention records the original pixel values ​​of the pixels modified by the adversarial attack algorithm when generating adversarial examples (called adversarial pixels). Combined with reversible information hiding technology, the original pixel values ​​are embedded into the generated adversarial examples as new, fully recoverable adversarial examples. When subsequently restoring the original image, the original pixel values ​​of the adversarial pixels embedded in the image are extracted using a corresponding algorithm. The location of the adversarial pixels is detected by calculating the position of the point with the largest difference from the neighborhood mean. Finally, based on the original pixel values ​​and location information of the adversarial pixels, the original image can be completely restored.

[0038] In the method for generating and restoring adversarial attack samples that can be fully restored to the original image in this invention, an adversarial sample is generated by one-pixel attack, which modifies only one pixel (i.e., only one adversarial pixel). The original pixel value information of the adversarial pixel is converted into corresponding binary encoded information, and then the binary encoded information is embedded into the generated adversarial sample by a pixel-value-ordering (PVO) algorithm to obtain a fully recoverable adversarial sample. The method flow is as follows: Figure 1 As shown. The specific implementation steps are as follows.

[0039] Step 1: Use the Differential Evolution (DE) algorithm to find the optimal solution for the position of adversarial pixels and the modification of pixel values, and generate one-pixel adversarial sample images.

[0040] In this embodiment, samples from the CIFAR-10 dataset were used as experimental samples, and subsequent steps also used samples from the CIFAR-10 dataset. The solution space is set to...

[0041] (x, y, R, G, B)

[0042] x, y∈[0, 31]; R, G, B∈[0, 255].

[0043] Where x is the x-coordinate of the pixel, y is the y-coordinate of the pixel, the origin is at the top left corner, R is Red (the value corresponding to the red channel of the pixel), G is Green (the value corresponding to the green channel of the pixel), and B is Blue (the value corresponding to the blue channel of the pixel).

[0044] x and y are generated using a uniform distribution U(1, 32), and R, G, and B are generated using a normal distribution N(μ = 128, σ = 127). This process is repeated 400 times to generate a total of 400 parent candidate solutions, which are then used to initialize the solution set.

[0045] Then, the offspring candidate solutions are generated using the following formula.

[0046] x i (g+1)=x r1 (g)+α(x r2 (g)-x r3 (g)),

[0047] r1≠r2≠r3.

[0048] Where, x i A child candidate solution is defined as r1, r2, r3 ∈ [0, 399], where r1, r2, and r3 are random numbers representing three different parent candidate solutions; α is a user-defined hyperparameter, which can be set to α = 0.5; and g is the current iteration number. 400 parent candidate solutions are iteratively cross-mutated to generate 400 child candidate solutions, which are then selected to determine the optimal solution. The pixels in the original image modified based on the optimal solution's position and pixel value are the adversarial sample points, thus generating adversarial samples. The adversarial samples are input into the model for identification; the more the matching score deviates from the true category, the more significant the attack effect. If the identification result deviates from the true category, the attack is successful; if the attack fails, the iteration continues. If the maximum number of iterations is reached without success, the algorithm terminates, and the attack fails; if the attack succeeds, a one-pixel adversarial sample with only one modified pixel (i.e., only one adversarial pixel) is output. In this embodiment, the maximum number of iterations is set to 100. This invention uses classic image classification models such as LeNet and ResNet to test the attack effect of the invented method.

[0049] Step 2: Embedded information encoding.

[0050] Record the optimal solution (x′, y′, R′, G′, B′). Use the x′ and y′ coordinates to find the R, G, and B values ​​of the corresponding adversarial pixel in the original image, i.e., (R0, G0, B0). Convert the pixel value (decimal value) into a fixed-length binary code, with R0, G0, and B0 each being 8 bits, for a total of 24 bits.

[0051] Step 3: Embed the binary encoded information into the adversarial sample generated in Step 1.

[0052] The one-pixel adversarial sample obtained in Step 1 is divided into blocks. The pixels in each block are sorted in ascending order, and the difference between the two largest pixels is recorded as PE. max After processing all blocks of the sample, a Prediction Error Histogram (PEH) is obtained. max Longitudinal stripes with a value of 0 remain unchanged, PE max The longitudinal stripe region with a value of 1 is used as the embedding region, PE max Vertical stripes greater than 1 are shifted one unit to the right in sequence, such as... Figure 2 As shown.

[0053] Scan each block sequentially, and modify the embedded regions (PEs) that are scanned. max For the region corresponding to the vertical stripe with a value of 1, the following operations are performed on each symbol b of the pixel bit information obtained in Step 2: When symbol b is 0, the pixels in the corresponding embedded region block are not changed; when symbol b is 1, the maximum pixel value in the corresponding region is incremented by 1, making PE... max =2.

[0054]

[0055] The above process can generate adversarial examples that can be completely restored to the original image.

[0056] Step 4: Restoration of adversarial examples that can be completely restored to the original image.

[0057] The receiver receives the corresponding adversarial example that can be fully recovered to the original image, and obtains the prediction error histogram (PE) of the embedded image. max A region with a value of 1 represents a corresponding code element of 0; PE max The region with a value of 2 represents the corresponding code element as 1, and the pixel P with the largest value in that region is also included. max -1 restores the original pixel value; PE maxFor regions >2, a left-shift restoration operation is performed. This extracts the binary encoding information of the adversarial pixels embedded in the image and restores the one-pixel adversarial sample before the information was embedded. The original pixel values ​​(R0, G0, B0) of the adversarial pixels are obtained based on the binary encoding information. Median filtering is applied to the R, G, and B channels of the one-pixel adversarial sample to obtain three matrices. The absolute values ​​of these matrices are then subtracted from the R, G, and B channels of the one-pixel adversarial sample before median filtering, resulting in three absolute difference matrices. The sum of these three absolute difference matrices yields a total absolute difference matrix. The position of the point with the largest value in this matrix is ​​the position of the adversarial pixel, denoted as (x0, y0). This provides complete information including the coordinates and original pixel values ​​of the adversarial pixel (x0, y0, R0, G0, B0). Finally, the position of the adversarial pixel is determined based on its coordinates, and its pixel value is restored to its original value (R0, G0, B0), thus completely restoring the original image. Figure 3 As shown.

[0058] In actual testing, Figure 1 In the process example, the original image input model (using LeNet as an example) results in the classification result of "airplane"; the adversarial sample generated by inputting a one-pixel results in the classification result of "ship"; the fully recoverable adversarial sample generated by this method results in the classification result of "ship", and the attack is still successful.

[0059] The main experimental environment is shown in Table 1.

[0060] Table 1. Main experimental environment (CPU: i5-8300H, GPU: 1050-TI 4G)

[0061]

[0062] In the experimental design, taking LeNet as an example, the model was configured to be trained on the CIFAR-10 dataset. The main training parameters were set to batch_size=128 and learning rate lr=0.01. After training for 100 epochs, the model basically converged.

[0063] After model training, 100 samples are randomly selected from the CIFAR-10 dataset for attack testing. A one-pixel attack is set, allowing only one adversarial pixel. Successfully generated adversarial samples are retained, and PVO (Profile Value Optimization) is calculated. If the image's PVO is greater than the length of the binary encoded information to be embedded, embedding is performed; otherwise, the sample is deemed insufficient for embedding. The embedded image is then input back into the model for prediction. Valid adversarial samples are counted, and the results are analyzed. This process is repeated for the next sample until the total number of iterations reaches the set 100.

[0064] The experiment included two different schemes for comparison. The main difference lay in whether the position information (x0, y0) of the adversarial pixel altered by the one-pixel attack was also hidden in the one-pixel adversarial example using PVO. In Scheme 1, Step 2 embedded the position information of the adversarial pixel and its original pixel value (decimal value) into a fixed-length binary code. x0 and y0 were each 5 bits, and R0, G0, and B0 were each 8 bits, for a total of 34 bits, all embedded into the one-pixel adversarial example. The corresponding Step 4 directly recovered the complete pixel value information (x0, y0, R0, G0, B0) through PVO and replaced the adversarial pixel value with its original pixel value. Scheme 2 followed the same steps as the present invention, except that Step 2 only embedded the original pixel value (decimal value) of the adversarial pixel into a fixed-length binary code, with R0, G0, and B0 each being 8 bits, for a total of 24 bits.

[0065] In the 100 samples tested in Experiment Scheme 1, 66 adversarial samples were successfully generated through one-pixel attack. After calculating the amount of data, 44 samples had sufficient data. PVO operation was performed to embed information to obtain 44 images, of which only 2 attacks failed. The success rate of the adversarial sample attack generated by the algorithm in the image samples with sufficient data was 95.5%.

[0066] The samples generated at each stage by the method of this invention are as follows: Figure 4As shown, a, b, and c represent the original image of a successful attack, the adversarial sample generated by a one-pixel attack, and the adversarial sample generated by the method of this invention that can be restored to the original image, respectively. The true category of the image is "ship," the adversarial sample input model classification result is "bird," and the adversarial sample generated by the method of this invention input model classification result is "bird." Similarly, d, e, and f represent the original image of the test sample, the adversarial sample generated by a one-pixel attack, and the adversarial sample generated by the method of this invention, respectively. The true category of the image is "truck," the adversarial sample input model classification result is "frog," and the adversarial sample generated by the method of this invention input model classification result is "frog."

[0067] The adversarial examples generated by the method of this invention visually differ from those generated by a one-pixel attack by only one pixel, i.e., only one adversarial pixel. The actual difference is evaluated using the Peak Signal-to-Noise Ratio (PSNR). Figure 4 The PSNR calculated between b and c is 58.61. Figure 4 The PSNR calculated between e and f is 66.47. The adversarial sample generated by the method of this invention, which can be completely restored to the original image, has little difference from the one-pixel adversarial sample generated by the existing method, thus ensuring the quality of the final image sample.

[0068] The attack success rate indicates the effectiveness of the algorithm strategy. Using PVO to embed pixel information into adversarial examples does not significantly weaken the attack effect in most cases. The final generated adversarial examples not only contain information that fully restores the original image (i.e., the original pixel values ​​of the adversarial pixels) but also maintain the adversarial attack effect. This invention does not require extensive knowledge of the target model's details; only the image input and the model's classification results are needed for implementation. The use of differential evolution reduces the reliance on obtaining detection results. The black-box attack characteristic makes this invention applicable not only to a single deep learning model without requiring changes to the strategy or structure but also to other models.

[0069] With the experimental conditions unchanged, this invention tested the attack performance of various models using Experimental Scheme 1, and the results are shown in Table 2 below. Whether using the LeNet model with fewer parameters or the ResNet and DenseNet models with more parameters, this invention can maintain good attack performance.

[0070] Table 2. Test results of different models in Experimental Scheme 1.

[0071]

[0072] It is not difficult to see that even if the attack has a high success rate, whether the purpose of this invention can be successfully achieved ultimately depends on whether the image embedding is sufficient. Experimental scheme 1 has a low embedding capacity. In order to increase the embedding capacity, this invention designed experimental scheme 2, which does not require the embedding of coordinate information and compresses the information embedding amount from 34 bits in experimental scheme 1 to 24 bits. The same experiment was then carried out, and the results are shown in Table 3.

[0073] Table 3. Test results of different models in Experiment Scheme 2.

[0074]

[0075] Experimental scheme 2 reduces the amount of adversarial pixel coordinate information that needs to be embedded, thus significantly increasing the proportion of images with sufficient embedding. Taking the ResNet model experiment as an example, experimental scheme 1 requires embedding 34 bits of adversarial pixel information, and the proportion of images with sufficient embedding in the number of images successfully attacked in one-pixel attacks is 58.5%, while experimental scheme 2 only requires embedding 24 bits of adversarial pixel information, increasing this proportion to 85.4%. At the same time, the number of samples that ultimately succeeded in the attack increased from 21 to 30, an improvement of 42.9%. For all three models, the attack success rate improved by about 20%. This key change significantly improved the final effect of the invention.

Claims

1. A method for generating and restoring adversarial attack samples that can be completely restored to the original image, characterized in that, One-pixelattack adversarial attacks generate adversarial samples that modify only one pixel. The modified pixel is called the adversarial pixel. The original pixel value of the adversarial pixel is converted into its corresponding binary code. Then, a pixel value sorting algorithm is used to embed the binary code information into the generated adversarial sample, resulting in a fully recoverable adversarial sample. The specific implementation steps are as follows: S1, using the differential evolution algorithm, finds the position of the adversarial pixel and the optimal solution after modification, and generates a one-pixel adversarial sample image; S101, Obtain the experimental sample dataset, and set the solution space as... (x, y, R, G, N) x, y∈[0, 31]; R, G, B ∈ [0, 255]. Where x is the horizontal coordinate of a pixel in the image, y is the vertical coordinate of a pixel in the image, R is Red (the value corresponding to the red channel of the pixel), G is Green (the value corresponding to the green channel of the pixel), and B is Blue (the value corresponding to the blue channel of the pixel). x and y are generated using a uniform distribution U(1, 32), and R, G, and B are generated using a normal distribution N(μ = 128, σ = 127). This process is repeated to generate a total of 400 parent candidate solutions, which are then used to initialize the solution set. S102, the offspring candidate solutions are generated using the following formula. x i (g+1)=x r1 (g)+α(x r2 (g)-x r3 (g)), r1≠r2≠r3 In the above formula, x i A child candidate solution is generated from 400 parent candidate solutions, where r1, r2, and r3 are three different parent candidate solutions, r1, r2, and r3 ∈ [0, 399]. α is a user-defined hyperparameter, which can be set to α = 0.5, and g is the current iteration number. The 400 parent candidate solutions undergo iterative cross-mutation to generate 400 child candidate solutions, which are then selected to determine the optimal solution. The original image is then processed according to the selected optimal solution, and adversarial pixels are inserted. The processed image is then input into the model for detection to determine if the attack is effective. If the attack is effective, a one-pixel adversarial sample with only one modified pixel is generated. S2, embed information encoding, record the optimal solution (x′, y′, R′, G′, B′), use the x′, y′ coordinates to find the original pixel value (R0, G0, B0) of the adversarial pixel point at the corresponding position in the original image, and convert this pixel value into a fixed-length binary code; S3 embeds binary encoded information into the one-pixel adversarial sample generated in S1 to generate an adversarial sample that can be completely restored to the original image; S4, Reconstruction of adversarial examples that can be fully restored to the original image. The receiver receives the corresponding adversarial examples that can be fully restored to the original image and obtains the prediction error histogram of the embedded image, PE. max A region with a value of 1 represents a corresponding code element of 0; PE max The region with a value of 2 represents the corresponding code element as 1, and the pixel P with the largest value in that region is also included. max -1 restores the original pixel value; PE max For regions >2, a left-shift restoration operation is performed. This extracts the binary encoding information of the adversarial pixels embedded in the image and restores the one-pixel adversarial sample before the information was embedded. The original pixel value (R0, G0, N0) of the adversarial pixel is obtained by converting the binary encoding information of the adversarial pixel. Median filtering is performed on the R, G, and B channels of the one-pixel adversarial sample to obtain three matrices. The absolute values ​​of these matrices are then subtracted from the R, G, and B channels of the one-pixel adversarial sample before median filtering, resulting in three absolute difference matrices. The sum of these three absolute difference matrices yields the total absolute difference matrix. The position of the point with the largest value in this matrix is ​​the position of the adversarial pixel, and its coordinates are denoted as (x0, y0). Thus, complete information (x0, y0, R0, G0, N0) including the coordinates and original pixel value of the adversarial pixel is obtained. Finally, the original image can be completely restored based on the coordinates and original pixel value of the adversarial pixel.

2. The method for generating and restoring adversarial attack samples that can be fully restored to the original image according to claim 1, characterized in that, The specific method for step S3 is as follows: S301, the adversarial sample obtained in S1 is divided into blocks, the pixels in each block are sorted in ascending order, and the difference between the two largest pixels is recorded as PE. max After processing all blocks of the sample, a prediction error histogram is obtained, PE. max Longitudinal stripes with a value of 0 remain unchanged, PE max The longitudinal stripe region with a value of 1 is used as the embedding region, PE max Vertical stripes with a value greater than 1 are shifted one unit to the right in succession; S302, scan each block sequentially, and modify the embedded regions (PEs) that are scanned. max For the vertical stripe region where the value is 1, the following operation is performed on each symbol b of the pixel bit information obtained in S2: when symbol b is 0, the pixels in the corresponding embedded region block are not changed; when symbol b is 1, the maximum pixel value in the corresponding region is incremented by 1, making PE... max =2; The above process can generate adversarial examples that can be completely restored to the original image.

3. The method for generating and restoring adversarial attack samples that can be fully restored to the original image according to claim 1, characterized in that, In step S2, the original pixel values ​​(R0, G0, N0) of the pixel are 8 bits each, for a total of 24 bits.

Images